Soteria Software Press Release

November 4, 2026

OpenRMF® Professional v2.15 Released!

Soteria Software released a major update to their flagship product OpenRMF® Professional v2.15 today. Please log into the Software & Documentation portal under the Resources link on the website and download the upgrade as soon as you can.


OpenRMF® Professional version v2.15 was released today. This is a major release to improve performance, improve security, update features as well as several bug fixes. And this also updates DISA templates.


  • Added the Universal SIEM Asset ID to hardware records
  • Added the date purchased and date installed to hardware records
  • Allow uploading a software bill of materials (SBOM) file in CycloneDX or SPDX format for Software updates
  • Allow uploading a Nessus/ACAS Discover Scan result .nessus file to build your hardware device listing
  • Generate a FedRAMP POA&M v3.1
  • Added additional fields for POA&M for vendor information, Binding Operational Directive, and more to fill in the FedRAMP POA&M
  • Added an auto-configure folder to mount settings, licenses, and themes into to automatically update
  • Added a field to add/edit default controls in Frameworks for those that are not automatically created
  • Added a routine to migrate a Keycloak user’s individual Group Permissions to the new User Permissions, when they are valid
  • Added a journal entry when any scores or data or synchronized from the Manage System Packages page
  • Added compliance statement generation when you create your POA&M the first time to show CCI compliance for requirements if valid (CCI-000264, CCI-003867, CCI-000142, CCI-002991) regardless of framework
  • Added an external API endpoint to allow updating all SIEM enabled system packages
  • Added an external API endpoint to allow updating compliance for a given Universal Asset Id (new field) in system packages
  • Added the listing of devices in Team Subpackage upload results
  • Added a way to manage all controls, description, and supplemental text for overlays separately from default control information
  • Added a way to select more than one device profile to attach to hardware records – previously was only 1 per device
  • Added filtering on the CKL listing by hostname, checklist type, score severity and status
  • Added a way to specify the checklist template when uploading a new scan results file
  • Added pagingation to external API calls for the checklist and score listing, compliance listing, and other technology vulnerability data listing
  • Added hardware, software, and PPSM paginated external API calls for Team Subpackages
  • Added a delete from Other Technology scores to delete scans linked to a particular project
  • Added a system package preference to generate all missing policy and procedure compliance statements when generating compliance to have full coverage across all control correlation identifiers (CCI) required
  • Added a download to xlsx from the Add Compliance Statement screen to download all required controls, CCIs, and definitions as well as any statements currently in use
  • Added additional fields on the system package for tracking and generating documentation, shows when editing details
  • Added a “Generate Full SSP” to generate the system security plan with system package data, personnel, compliance and all controls in a *.docx file that attaches automatically as Evidence for download and use
  • Added CVE data on the patch vulnerability listing to parse CVE from patch upload files
  • Added a Binding Operational Directive report for system packages and team subpackages
  • Allow deleting Other Technology Vulnerability project from the team subpackage
  • Added the Impact Level 2, 4, 5, and 6 overlays used with FedRAMP frameworks as site-wide overlays for all to use
  • Added a “Related POA&Ms” side bar on checklist, patch vulnerability, other technology, compliance statement, and hardware popup screens of system packages and team subpackages to show if there are open POA&M items for that item
  • Added additional External API calls
  • Get system package preferences
  • Get a list of all site-wide overlays in xlsx
  • Get a list of all system package overlays in xlsx
  • Get a single site-wide overlay record with all overlay controls in JSON or xlsx
  • Get a single system package overlay record with all overlay controls in JSON or xlsx
  • Updated the sample system package “OpenRMF® Professional Sample” to include SBOM data, and generate a POA&M and Compliance if frameworks are already loaded
  • Updated the current site-wide overlays to use the new structure correctly with proper descriptions and supplemental text
  • Updated the System Security Plan to track the compliance framework and additional fields as well as properly display overlay information
  • Updated the Security Assessment Plan to track the compliance framework and additional fields as well as properly display overlay information
  • Updated the Risk Assessment Report to track the compliance framework and additional fields as well as properly display the counts of items based on likelihood, impact, and residual risk correctly
  • Updated compliance generation to automatically show Not Reviewed when there is no data present for that control listed
  • Improved performance on Audit, Other Technology, and Cyber Readiness backend calls
  • Fixed a bug where compliance statements were not tracking the control and CCI history correctly
  • Fixed the example compliance statement xlsx file in the online help to be the proper format as of v2.13
  • Fixed a bug where opening a compliance statement from a Not a Finding statement duplicates the POA&M item entry
  • Fixed a bug when editing compliance statements and adding a line break with shift/enter showing HTML
  • Fixed a bug where uploading a software or PPSM file listing with new hostnames did not add that hostname to the hardware listing automatically
  • Fixed a bug showing duplicate CCIs on reports and the adding compliance statements screen when you are tailoring controls
  • Fixed a bug displaying team subpackage permissions on the Team Subpackage Dashboard if your teamKey named the same across different system packages – security permissions are valid, the display was the bug
  • Fixed a bug showing the “Add Hardware” in a team subpackage when only a PatchEditor – cannot add new hardware
  • Fixed a bug when you press the Add button on the User Permissions screen multiple times that duplicates the permission listing
  • Fixed a bug when exporting the system package listing and on a few other xlsx exports of putting ‘Unknown’ for the system package framework type
  • Fixed a bug deleting inherited controls in a system package for proper full data cleanup
  • Fixed a bug when deleting hardware from a Team Subpackage where a large list of hardware would timeout in the deletion process because of a field with a missing index
  • Fixed a bug when a system package inherits multiple controls that only differ on the Source field tracking with valid POA&M items
  • Fixed a bug on exporting the summary PPTX where it warns of repairing a bad file before opening
  • Fixed a bug when marking a compliance statement Not a Finding or Not Applicable that was previously on the POA&M, where the link to the POA&M would then be removed
  • Updated code components for upgrades and CVE fixes
  • DISA Template updates as of October 26, 2026 from DISA public.cyber.mil


More information on the software release and its availability as well as training can be found at their website www.soteriasoft.com.