Tech Blog - October 2026

New features added and issues addressed in the TurboQSA product. October 2026.

featured image for post Tech Blog - October 2026

October was a landmark month for TurboQSA. We shipped four new assessment standards, cross-standard evidence mapping, and a reworked dashboard that puts what needs your attention front and center. Let's recap our progress in October 2026:

A milestone for TurboQSA: welcome to Turbo Assessment

TurboQSA is growing into something bigger. We're proud to introduce Turbo Assessment - turboassessment.com - our growing portfolio of assessment tools, built to take our assessment technology beyond PCI.

TurboQSA remains our dedicated PCI offering, supporting PCI DSS and PCI PIN assessment work. Turbo Assessment expands that foundation to more assessment standards - ISO 27001, SOC 2, HIPAA, FedRAMP, NIST, GDPR, CMMC, and more - with TurboAI private AI functionality built for assessment teams handling sensitive information.

Rooted in PCI. Built to go further.

New Features

  • CMMC Level 2 assessments: We now support CMMC Level 2 assessments with 110 practices and 320 objectives, SPRS scoring, POA&M tracking, Word export, and a dedicated C3PAO Assessor role.
  • SOC 2 assessments: We now support SOC 2 Type I and Type II assessments with all 61 Trust Services Criteria, project lifecycle, sub-report assembly, and Word and Excel matrix exports, plus a dedicated CPA assessor role.
  • ISO/IEC 27001:2022 assessments: We now support ISO 27001 assessments with templates, Word export, and Statement of Applicability export in spreadsheet and JSON formats, plus a dedicated ISO Lead Auditor role.
  • FedRAMP 20x assessments: We now support FedRAMP 20x assessments end to end, from scoping through Word and JSON exports, with an interactive glossary and NIST SP 800-53A finding states.
  • FedRAMP rev5 package checklist: The package checklist now has modernized interactive controls and rendering.
  • Cross-standard evidence mapping: You can now reuse one piece of evidence across up to 8 standards in the Client Evidence Library, with assessor-confirmed mapping suggestions and annotated-set export.
  • SAQ as its own project type: SAQ projects now have their own project type with a guiding panel and unrelated ROC items hidden.
  • Report table of contents: Report view now has a Contents panel, docked to the side and off by default.
  • Dashboard "needs your attention": The main dashboard now surfaces mentions grouped by project with a guided walkthrough, plus response requests and upcoming interviews.
  • PCI PIN dashboard support: PCI PIN projects now appear on the dashboard with proper annex and control-objective sections.
  • PCI PIN summary of findings: Part I, section 1.5 now auto-populates with a single option per hierarchy.
  • Clone from project overview: You can now clone a project right from its overview page.
  • Integration API key admin: The API key grid is now cleaner, with an active/inactive filter and pagination.

Bug Fixes & Improvements

  • Project list performance: We fixed the project list slowdown and the memory blowup behind it.
  • Large file uploads: Files over 250 MB are no longer sent to AI processing or decoded during Word rendering, so huge uploads can't crash AI features.
  • Evidence uploads and cloning: We fixed same-file upload handling, missing-file handling, and orphaned files, so cloning no longer loses or duplicates evidence.
  • User search: We fixed the search error and made matching case-insensitive.
  • AI finding suggestions: They no longer write an error message into the rationale box on non-PCI standards, where manual entry applies instead.
  • Status and progress displays: We corrected progress display for SAQ items and for the new standards.
  • Default RFT responses: They now appear on all control types, not just requirements, and the N/A override delete is fixed.
  • Vectorized-font PDFs: Pages with no extractable text are now treated as images, so AI can process them.
  • Translations: PCI DSS ROC, DESV, and SAQ text is now fully translated into Spanish and Portuguese, the Attestation of Compliance UI is translated, and engagement tasks are fully translated.
  • Report view: It now has an actions menu and universal search, fixed loading overlay races, and controls that wrap instead of overflowing on long translations.
  • Faster page loads: Login and dashboard now load on demand, and English renders immediately.
  • Disabled users: Disabled-but-assigned users remain visible (read-only) in Manage participants.
  • Requirement Report timezones: Timezone handling in the Requirement Report is now correct.
  • Engagement task assignees: A search field is added and overflow is fixed for large teams.
  • Eligibility SAQ table: Column widths are fixed for P2PE and SAQ A.
  • Usage screen layering: The layering glitch in system and observation lists is fixed.
  • Text fields: They no longer jump scroll to top while editing.
  • Cloning dialog: The 'Requirement responses only' choice now applies only to selected tree sections, and the dialog is fully translated.

Stay tuned for more updates as we continue expanding TurboQSA's capabilities - and subscribe to our LinkedIn page!