Where COD is heading

Current version

COD 3.7

Version 3.7.0 was released in September 2026.

New in 3.7.0

• KPIs in GRC. Measure information security and quality with predefined indicators, each with a target, a tolerance and a rating. COD calculates some of the values from activities and training sessions. You enter the remaining yearly figures yourself. For the management review you freeze the year and create a PDF report.
• Training sessions and emergency exercises in GRC. Define which roles, teams or people must attend, and check off who took part. An overview compares required and actual attendance.
• More meaningful activities. Activities get a due date, a protection goal (confidentiality, integrity or availability) and an effectiveness rating. Recurring activities create their next occurrence by themselves once you complete them.
• Installation as Ubuntu packages. You install and update COD like any other Ubuntu package. Packages are available for Ubuntu 24.04 and 26.04. The initial setup runs in the browser. Before changing a database, an update takes its own backup. That covers the databases of the platform, GRC and the Backup, NAC and Stronghold modules. This backup does not replace your regular backups. Servers without direct internet access get the packages through a proxy. A migration guide helps you switch existing installations over.
• Module rollout from the Admin Area. Set up Automation, Backup, NAC and Stronghold from the Admin Area.

The next maintenance release is in preparation. It is meant to add packages for Ubuntu 22.04. This is not a commitment.

The features your contract covers are set out solely in the service description, in the edition that applies to your contract.

Maintenance and feature updates 3.6.1 to 3.6.5.

• One GRC for the whole organization. Choose a home location and assign the locations it covers.
• Create tickets in your Odoo helpdesk directly from COD, with prefilled fields.
• Accounts are locked instead of deleted, with a reason and a log entry. If you wish, a nightly check against Active Directory locks accounts that are no longer authorized there.
• TACACS+ shows each user's effective access as a diagram and tests whether a command would be allowed on a device you pick.
• The catalog texts of the Statement of Applicability (SoA) can be shown in German or English and exported that way as a PDF.

Two new modules and more for assets.

• Stronghold is a vault for passwords and secrets with end-to-end encryption, including a browser extension for Chrome and Firefox.
• TACACS+ manages users, devices, rules and logs of the TACACS+ server that comes with COD in one place. A simulator checks in advance whether a command would be allowed.
• Every asset has its own page with monitoring, placement, interfaces, contacts, contracts and dependencies.
• You maintain rooms and racks by drag and drop.

The topology shows firewalls as nodes, and GRC documents embed the live topology.

GRC manages several standards on a single data set, with cases, activities and an org chart.

The Monitoring module connects to your Zabbix, with dashboard, hosts and problems right in COD.

Firewall reachability, a collection status for every device in the inventory, and COD in your own colors.

A management system for information security and VPN management for WireGuard, OpenVPN and IPsec.

A new design with dark mode, global search and certificate management with your own certificate authority.