---
title: What's New
slug: ps/help/en_us/nsa/22x/nsa-ics/ag/whats-new
docTags: 
createdAt: 2026-07-22T09:12:32.220Z
---

## Version 25.1.0.0

:::ExpandableHeading
### SKU based licensing

Features part of SKU based licensing:

- Custom WAF blocking rules
- Features access management
- Patch lifecycle management
- AI Chat interface
- Threat Neutralizer
- Scanning with Indicator of Comromise
- Platform-specific Client OS packages

**Note**: These features are in Beta and will be enabled for few customers. Customers who want to test these features must reachout via their Ivanti Sales Reps.
:::

:::ExpandableHeading
### Features access management

NSA provides centralized control of features on the ICS Gateways/Gateway Groups directly from NSA User Interface. Multiple features can be selected across multiple gateways and enabled/disabled in one action. For details, see [Features Access Management](docId\:cEXAJmp23j44EdOgsGO4K).
:::

:::ExpandableHeading
### Scanning with Indicator of Compromise

The Indicator of Compromise (IoC) feature is a licensed NSA capability that scans ICS gateways for runtime anomalies and threats. It reports gateway health status to the ICT service and triggers admin alerts. For details, see [Scanning with Indicator of Compromise](docId\:rAVGucM2HSZKJtF72ivqw).
:::

:::ExpandableHeading
### Feature parity with ICS Gateway release

- RSA Authentication Manager (formerly known as ACE/Server) is supported that allows user authentication based on credentials from the RSA SecurID® product from RSA Security Inc. For details, see [Using a RSA Server (REST API)](docId\:xspmMKlIYdJkGpv_mrnQI).
- Microsoft's Windows Hello for Business (WHfB) is supported which is passwordless authentication solution for Windows devices. For details, see[Windows Hello for Business SSO Server](docId\:xspmMKlIYdJkGpv_mrnQI).
- Post-Quantum Cryptography (PQC) is supported to protect against future quantum computer attacks. For details, see [Inbound SSL Options](docId\:Ie3a96GcGf22zYaDVjwnE) and [Outbound SSL Options](docId\:Ie3a96GcGf22zYaDVjwnE).
:::

:::ExpandableHeading
### Patch lifecycle management

Patch packages provides a controlled patch lifecycle for gateways, enabling seamless patch upgrades, rollback, and removal without disrupting gateways operations. This feature is controlled by the feature entitlement. For details, see [Patch Lifecycle Management](docId\:OCsHa-ksFP2a79Rmz0Vhg).
:::

:::ExpandableHeading
### Custom WAF blocking rules

Tenant admins can create WAF rules to block specific traffic such as bad IPs, malicious payloads, etc. This feature is controlled by the feature entitlement. For details, see [Creating Custom WAF Rules](docId\:Ie3a96GcGf22zYaDVjwnE).
:::

:::ExpandableHeading
### Platform-specific Client OS packages

The ISAC Client Components now offers different client versions list per OS. The platform-specific option lets tenant admins to independently activate packages and enforce Minimum Support Version per OS., and force upgrade ISAC Desktop clients. This feature is controlled by the feature entitlement. For details, see [Manage Ivanti Secure Access Client Versions](docId\:q2SWzExiSq6OxuG47Wuyb), and [Upgrading Gateways and Clusters with Ivanti Secure Access Client](docId\:OCsHa-ksFP2a79Rmz0Vhg).

- Combined ISAC package supporting all Desktop Client OSes continues to be supported as is.
- On uploading a new Client package, only the affected clients receive the upgrade prompt.
- Applying client hotfix for specific OS saves time for tenant admins who manage multiple ICS deployments. 
:::

:::ExpandableHeading
### Automated license expiry detection

Automated monitoring of license expiry ensures efficient license management, timely awareness, and improved operational efficiency. This feature introduces daily tenant lifecycle checks, milestone-based notifications through email and alerts, and a configurable 30-day grace period. For details, see [NSA Licensing/Subscription](docId\:giMBWDXdcRTaW6IzFdYQJ).
:::

:::ExpandableHeading
### Archiving config sync rule

Archiving config sync rule allows to deactivate the rule temporarily instead of deleting the rule. The archived rule can be unarchived without losing its configuration for later use. For details, see [Archiving Config Sync Rule](docId\:cEXAJmp23j44EdOgsGO4K).
:::

:::ExpandableHeading
### Config cleanup on Tenant / Gateway deletion 

Deleting a gateway or self-deregistration automatically performs end-to-end cleanup and stops communication with NSA. Disabling a tenant automatically cleans up associated gateways and blocks NSA access. VTM synchronizes blacklist data and blocks traffic from deleted gateways and disabled tenants. 
:::