COD 3.7.0 was released in September 2026. The focus is on GRC. GRC now uses KPIs to show where your management system stands, and it records training sessions and emergency exercises. On top of that, COD comes as an Ubuntu package from this version on. At the end, we look at what comes next.
KPIs in GRC
GRC has a new KPIs page for information security and quality. Predefined KPIs are already in place, each with a target, a tolerance and a responsible role. COD calculates some of the values itself from activities and training. You enter others yourself as yearly figures, for example the click rate in phishing tests. COD rates the KPIs against target and tolerance. If there are too few figures, COD shows the value without a rating. For the management review, you freeze a year and create a PDF report from it.
Training Sessions and Emergency Exercises
You now record your organization's training sessions and emergency exercises directly in GRC, on the new Training page. You define which roles, teams or people are required to attend. COD works out who that includes, and you tick off who took part. An overview compares required and actual attendance for each topic and person. The entries feed straight into the KPIs.
More Meaningful Activities
Activities now carry a due date, a protection goal and a rating of how effective the measure was. The list can also show only overdue items. Recurring activities create their next occurrence by themselves once completed. Two new tiles on the GRC dashboard show this year's KPIs and upcoming deadlines.
Installation as an Ubuntu Package
COD and its modules now come as packages from the extocode package repository, for Ubuntu 24.04 and 26.04. Updates work just as they do for any other Ubuntu package.
- Initial setup in the browser: A wizard checks the database connections, generates the keys and creates the first administrator.
- Backup before database changes: Before an update changes a database, it creates a backup of its own. That covers the databases of the platform, GRC and the Backup, NAC and Stronghold modules. This backup does not replace your regular data backup.
- Existing installations: To move to 3.7, you switch an existing installation to the packages once. A guide takes you through the switch.
Rolling Out Modules from the Admin Area
As a superadmin, you now set up Automation, Backup, NAC and Stronghold in the Admin Area. A wizard connects a module on the COD server to the selected location and passes its configuration to it. Only modules enabled for your tenant are offered.
Why It Matters
For a management system, maintaining documents is not enough. You also need to see whether the measures are working. With 3.7, KPIs, training and effectiveness ratings sit right next to your risks, documents and assets.
For partners and operators, COD becomes easier to install and keep up to date. If extocode runs COD for you, we install new versions ourselves.
The features your contract covers are set out solely in the service description, in the edition that applies to your contract.
What Comes Next
On our new roadmap page, we now show what is new in COD, what we are working on and what we plan next. It also lists the earlier versions since 3.0. Anything in progress or planned is not a commitment. Content, order and timing may still change.
Want a Live Demo?
Would you like to see COD 3.7 in action? Get in touch, and we will be happy to show you.
Module overview: extocode.com
extocode GmbH · Central Operations Dashboard