Thank you,

Stacey

Last week, SmartSuite CEO and co-founder Jon Darbyshire took the stage at the ISACA GRC Conference 2026 in San Diego — and the room was packed. He opened with a question every GRC leader in that audience had to answer honestly: where does your program actually stand today, and what does moving forward really look like? His answer was a maturity model any GRC leader can use to find themselves on the map — and figure out what the next step actually requires.

The five stages of GRC maturity

01 — Fragmented: spreadsheets & email. Risk data lives in someone's inbox, not a system.
02 — Digitized: siloed point tools. Every function bought its own solution — none of them talk to each other.
03 — Integrated: shared data & taxonomy. Teams finally agree on a common risk-and-control language.
04 — Connected: one operational layer. Governance runs inside the work itself, not alongside it.
05 — Adaptive: AI-assisted & continuous. The program improves itself in real time.

As Jon told the room, most programs today sit at stages 1–3 — and that's the norm, not a red flag. Connected is a climb, not a rip-and-replace. You don't need to tear out your existing tools to start moving up the ladder; you need a shared taxonomy, a plan to connect your data, and a path to bring AI in once that foundation is real.

What Connected and Adaptive actually deliver

It's easy to talk about "connected" in the abstract. Jon made it concrete with a single example — one risk, traced end to end:

An organization sets an objective, owned by a process, which carries a risk, managed by controls, proven by evidence. In a Connected or Adaptive program, that entire chain lives in one shared model — so when a regulation changes, a vendor issue surfaces, or an incident hits, every connected view updates automatically. No re-keying. No stale reports. No hunting across five tools to find out what actually changed.

Why this matters to you

Moving up the maturity model isn't just an architecture upgrade — it's a direct line to measurable benefits:

• Faster response — a single change ripples to every affected control, policy, and evidence record automatically, instead of waiting on manual updates across teams.

• Less duplicate work — one control can satisfy many obligations, eliminating repetitive evidence requests for your first line.

• Real-time visibility — leadership sees current risk posture, not a quarter-old snapshot.

• AI that's actually reliable — AI assistance and automation are only as good as the data underneath them; a connected foundation is what makes Adaptive GRC trustworthy rather than risky.

• A practical, low-disruption path — you can climb the model in phases, using tools you already have, rather than a disruptive rip-and-replace.

Where does your program sit today?

If you're evaluating where you land on this model — or want to talk through what a practical path from Fragmented or Digitized toward Connected and Adaptive looks like for your organization — we'd love to help.

Contact SmartSuite today to learn more and start mapping your own path up the maturity model.

I'd like to learn and also explore partnerships, in terms of content sharing and eventually, co-hosting webinars together.

I bring corporate finance experience, digital marketing expertise and partnership-building skills to improve workflows, control budgets, generate qualified leads and grow revenue. Fluent in five languages, I work confidently across international markets and multicultural teams.

The Record Selector on Linked Records now opens as an inline dropdown by default instead of a full modal. Picking from a short list of existing records to link takes one click and no modal round-trip; the modal experience is still available for longer lists and advanced browsing. Service desks assigning a ticket to one of a small set of Change Requests, sales teams linking a deal to an Account from a short recent-account list, GRC compliance teams connecting a control test to a filtered short-list, and PMO leads connecting a task to a Sprint from a handful of active options all get quicker linking on the common case.

Key Highlights

• Dropdown by Default: The Record Selector now opens as an inline dropdown when users click into a Linked Record cell, cutting the full-modal round-trip out of the common single-click pick.

• Same Records, Same Configuration: The dropdown surfaces the same records the modal would show — same Solution-Manager-configured static and dynamic filters, same sort order, same Fields configuration (from the Advanced Settings introduced in prior releases), same Grouping (from the Jul 27 Grouping for Record Selector release).

• Modal Still Available: When users need the richer browsing experience — grouped views, filter panels, advanced controls that don't fit inline — the modal is one click away as an expansion from the dropdown.

• Inline Search: Users can type in the dropdown to filter the visible records, the same way they would inside the modal.

• No Configuration Migration: Existing Linked Record fields inherit the dropdown default automatically; no Solution Manager action required, no data changes, no configuration migration.

How It Works

• Open a record and click into any Linked Record cell to open the Record Selector. The Selector opens inline as a dropdown by default.

• Scroll through the visible records or type to search within the list; click a record to link it. No modal opens.

• When the dropdown isn't enough (long list needing filter panels, grouped browsing, or other advanced controls), click the expand affordance to open the full modal instead — same records, same configuration, richer surface.

Third refinement in the Linked Records 2.0 arc, following the Sticky Add New button and Grouping for Record Selector from Jul 27.

Learn More

The Files and Images field can now cap how many attachments a single field instance will accept. Solution admins turn on "Limit the number of allowed attachments" in field settings and set the maximum — the field then refuses uploads beyond that count. Contract tables enforcing exactly one signed PDF per record, product catalogs capping reference images at a fixed number, HR employee profiles allowing only one headshot, and any workflow where the attachment count is a first-class part of the data model get field-level enforcement.

Key Highlights

• New Field-Level Setting: "Limit the number of allowed attachments" appears in the Files and Images field's configuration modal. Off by default; existing fields keep their current unlimited behavior until an admin explicitly turns the limit on.

• Whole-Number Maximum: When enabled, a numeric input accepts a whole-number maximum (default 1). Decimals, zero, and values above the system maximum are silently ignored — the input reverts to the last valid value, keeping the setting model predictable.

• Enforcement at Upload Time: The constraint is enforced at the record edit surface — uploads beyond the configured count are refused, so the invariant holds when the value is entered rather than surfaced as a validation error after save.

• Backward Compatible: Existing Files and Images fields are unaffected unless a solution admin opts into the limit. No migration; no accidental data loss on records already exceeding a newly-configured limit.

• Same Governance Model as Other Fields: The setting sits with the rest of the Files and Images field configuration, exposed to Solution Managers and Workspace Admins per the standard field-configuration permission model.

How It Works

• Open the field settings on a Files and Images field (or create a new one).

• Toggle on "Limit the number of allowed attachments." A numeric input appears with a default value of 1.

• Enter the maximum attachment count (whole numbers only). Save the field.

• On the record edit surface, the field now refuses uploads beyond the configured count. Users see the constraint at the point of upload rather than after save.

Available on all plans; existing Files and Images fields keep their prior unlimited behavior until an admin explicitly opts into the limit.

Conditional logic is coming to SmartSuite. Tell us what you'd automate first. 👇

Shared Forms — public-link forms that any recipient can fill out without a SmartSuite login — now open natively inside the SmartSuite mobile app on iOS and Android instead of the mobile browser. Recipients tapping a shared form link on a phone or tablet with the SmartSuite app installed land in the app itself, keeping form submissions in one place alongside the rest of their SmartSuite work. Event teams collecting attendee registrations, HR teams running employee satisfaction surveys, and customer success teams gathering feedback from mobile-heavy audiences all benefit from the tighter mobile experience.

Key Highlights

• Native App Handoff: When a recipient taps a public form link on a device that has the SmartSuite mobile app installed, the form opens in the app instead of the mobile browser. Matches the native experience the app already provides for Grid, Calendar, Card View, Chart View, and Internal Forms.

• Same Submission Behavior: Public-link submissions still don't require a SmartSuite login, still track SmartSuite Form as the Created By value (matching Shared Form semantics on desktop), and still respect any form field / submission logic configured on the underlying Form View.

• Completes the Mobile Forms Story: Shipping alongside Mobile: Internal Forms Support — together, Internal Forms (logged-in members, permission-aware) and Shared Forms (public link, browser-independent) now both work natively on the mobile app.

• No New Configuration: Form authors don't need to enable a mobile mode. Any Shared Form with a public link automatically routes to the native app when the recipient has it installed.

How It Works

• Publish a Form View with the Shareable Link option — same setup as before.

• Distribute the link (email, chat, embed on a website, share in-app) as you normally would.

• When a recipient taps the link on a phone or tablet with the SmartSuite mobile app installed, the form opens in the app.

• The recipient fills in the form and submits. The submission is recorded exactly as before — SmartSuite Form remains the Created By value, form-submission automations fire, and the underlying Form View permissions apply.

With Shared Forms on mobile complementing this release's Internal Forms mobile support, SmartSuite's mobile Forms coverage closes — both form modes work natively on phone and tablet, and the recipient experience matches the tighter native handling the app already provides across other view types.

Learn More

Internal Forms — the logged-in-member form mode that respects field and record permissions and captures the submitting member as Created By — now work natively on SmartSuite Mobile. Previously desktop-only; this release brings the full Internal Form experience to iOS and Android with no separate configuration required. Field service techs submitting inspection forms from the job site, HR managers filing employee change requests on the road, and ITSM operators opening tickets from a phone all get the same permissioned form experience on mobile they already had on desktop.

Key Highlights

• Full Internal Form Behavior on Mobile: Same field permissions (hidden fields removed, view-only fields read-only, editable fields fillable), same record permissions (creation gated by the member's permission on the target table, dynamic record permissions honored), same Created By attribution (the submitting logged-in member, not "SmartSuite Form") as on desktop.

• Two Entry Points Preserved: Members open Internal Forms on mobile from either a Button field configured with the Open a Form action, or from a Form View in the mobile app — matching the desktop entry-point model.

• Automatic Availability: An Internal Form is available for mobile use as soon as it's created. No separate mobile toggle or mobile-only configuration to manage — the same form that works internally on desktop works internally on mobile.

• Login-Required URLs: If someone opens an Internal Form URL and isn't logged in, SmartSuite requires them to log in first — same behavior as on desktop, preserving the member-attribution guarantee that distinguishes Internal Forms from Shared Forms.

• Independent from Shared Form Sharing: A form can be used internally on mobile even when its public sharing toggle is off. The two form modes stay independent — no need to expose an internal-only form to the public just to make it mobile-accessible.

How It Works

• Update to the latest SmartSuite mobile app on iOS or Android.

• Open a Dashboard, Record Page, or Form View in the mobile app that contains a Button configured with Open a Form, or navigate directly to a Form View for a form you have permission to fill out.

• Tap the Button or open the Form View. The Internal Form loads with the member's field permissions applied, dynamic record permissions evaluated, and standard form fields presented as configured.

• Fill in the form and submit. The record is created with the submitting member as Created By, source details captured (Form title, submission date, submission source), and any downstream "When a form is submitted" automations fire the same way they would for a desktop submission.

With Internal Forms working natively on mobile, the last major gap between mobile and desktop form workflows closes — permissioned form submission with member attribution now works wherever the submitter is.

Learn More

Comments and Checklist Items now support Team assignments and Team @-mentions, extending the Teams Field infrastructure from field-level assignments into the two most conversational surfaces in SmartSuite. Assign a Team to a comment or checklist item instead of picking a specific member, or @-mention a Team inline; every Team member gets an in-app notification and (if a Team Email is configured at the workspace level) one email goes to that address instead of individual member emails. ITSM service desks routing tickets to on-call teams, GRC compliance teams assigning control-review checklists to review committees, PMO leads @-mentioning cross-functional teams in project discussions, and HR teams distributing onboarding checklists across a Team all get first-class Team routing.

Key Highlights

• Team Assignments on Comments and Checklists: Assign a Team to a comment or checklist item exactly the way you'd assign a member. Every Team member receives an in-app notification; email routing follows the workspace-level Team Email setting (single address if configured, individual members if not).

• Team @-Mentions on Comments and Checklists: Type

  @

  followed by a Team name in a comment or checklist item; the mention resolves to the whole Team with matching notifications. Notification wording distinguishes mentions from assignments ("mentioned {Team} team" vs "assigned {Team} team").

• Same Governance as the Teams Field: Only active, non-deleted Teams that currently have Contributor or Assignee access to the record appear in the picker or @-mention list. Deleted or Inactive Teams are filtered out; the "Everyone" pseudo-team is never available.

• Team Email Deduplication: If a Team has a Team Email configured at the workspace level, that single address gets the email — no individual member emails. Multi-team memberships deduplicate cleanly so users aren't double-emailed when a Team Email address is in play.

• Full Audit Trail: Team assignments and mentions log in the record's activity history the same way Member assignments and mentions do — preserving traceability for compliance, incident post-mortems, and audit reviews.

How It Works

• Open a record and go to the Comments panel (or open a Checklist field and target a checklist item).

• Type

  @

  followed by a Team name in the comment field. The picker shows Teams that are active, non-deleted, and currently have Contributor or Assignee access to the record.

• Optionally check "Assign Comment" (or the equivalent on a checklist item) if you want the mention to be an assignment as well as a mention.

• Send the comment / save the checklist item. In-app notifications go to every Team member; email routes to the Team Email if configured, else to individual members (capped at 50 recipients).

• Resolve/reopen a Team-assigned comment the same way you'd resolve a member-assigned one. Team members see the resolution notification.

With Team assignments and @-mentions on comments and checklists, SmartSuite closes the gap between record-level Team routing (already available on the Teams Field) and conversation-level Team routing — the right responder can now be "whoever on this Team picks it up first" across every collaboration surface.

Learn More