Since our roadmap in September, nine more versions of COD have come out, most recently 3.7.10 on 17 October 2026. That sounds like small stuff, but it is not. Next to many fixes, a few bigger building blocks have arrived, above all in GRC. Here is the overview.
Registers for processes and suppliers
GRC → Registers now holds processes and suppliers next to the assets, each with a list, a detail page and a change history. Processes, asset groups and suppliers can be linked. Through essential links, a process passes its level on to the asset groups and suppliers that depend on it. A graph shows these links as a tree, down to the single asset if you like. You can also fill the registers by CSV import. A check shows beforehand what will be created and what does not fit.
Supplier evidence
For every supplier you record certificates, audits and questionnaires. From the level of the supplier, COD works out which evidence is required, where it stands and what comes next. A widget of its own on the GRC dashboard shows the suppliers that need attention.
Forms with signatures
With 3.7.7, GRC does forms. You build a template in the designer from sections, fields, tables and signature fields. From it you create documents that are filled in and signed in the order of the template, with the password and, where set up, a second factor. After the last signature, COD creates a PDF with all values and the signature log.
KPIs per period
KPIs now hold one value per month, quarter or half-year. COD computes several new KPIs itself, such as overdue activities or the closure rate of findings. The dashboard shows the trend of the last twelve periods with target and rating.
One audit for the whole platform
Since 3.7.8 the Admin Area has an Audit page with three tabs. Changes lists the changes from COD, GRC, network, hypervisor and the NAC, Backup and Stronghold modules in one place. Module Access counts who used which module. Access Review gives you a table for the yearly access review, as CSV and as PDF.
The audit does not store passwords, keys or tokens. The database refuses to change or delete audit rows, apart from the purge after the retention you set and corrections that come with an update. Every night COD seals the new entries in a signed checkpoint. If you like, COD forwards the audit by syslog over TLS to your own system.
Projects and a new GRC dashboard
Under GRC → Projects you group activities and cases into projects, with progress, due dates and an order of your own. The GRC dashboard has a new layout. At the top you find the risk matrix and your open tasks, below them the top risks, gaps in threat treatment and the state of your documents. A click on a figure opens the matching, filtered list.
New Admin Area and ISO/IEC 27019
3.7.10 brings a rebuilt Admin Area with a side menu. Users sit in one table, roles and permissions in a matrix of modules and locations. For the energy sector you can now switch on ISO/IEC 27019 with its twelve energy controls. Under Norms, COD also shows when a requirement is covered by the matching requirement of another norm.
Anything else?
On top come many fixes, for example in firewall monitoring, the Layer 3 map, backups and Cisco switches. The full notes for every version are in COD itself, in the What's New window.
Which functions your contract covers follows solely from the service description in the version that applies to your contract.
What comes next
What we plan next is on our roadmap. Anything shown there as in progress or planned is not a commitment. Content, order and timing may still change.
Fancy a live demo?
Want to see it for yourself? Get in touch and we will be happy to show you.
Module overview: extocode.com
extocode GmbH · Central Operations Dashboard