IT Risk Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Table Enhancements for Controls

Tables and table functionalities on the Risks tab of the Control details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust platform that have adopted this standardization:

  • Workflow list screen: Column sorting, search, activation, archival

  • Workflow rule actions: Advance to stage and Change workflow

  • Workflow rule event triggers: Attribute updated and Approval rejected. Use Approval rejected to route a risk to the stage you choose when an approver rejects it.

  • Routing rules: Workflow assignment upon object creation

  • Workflow stage rule actions: Create tasks, send notifications using system and custom templates, update attributes, generate PDF reports, and launch assessments.

  • Stage detail settings: Set required attributes and comments upon stage change, stage approval requirements, Stage advancement, and Close stage.

    • Stage advancement - Define additional users who can advance a stage beyond those with role-based permissions.

    • Close stage - Adds the Reason for Closure and Closure Note attributes to the closed stage. You can also disable detail edits for closed risks.

For more information, see Managing Risk Workflows.

Nested Table & Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types, and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across Tech Risk & Compliance have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing. Business objectives are now a supported object in ABAC Phase 1: Foundations.

Tech Risk & Compliance also includes changes to risk permissions, risk field visibility, and the Stage advancement setting in risk workflows. Review custom roles related to risk management to make sure they continue to work as intended.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Tech Risk & Compliance (TRC), mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Unified Table Experience in Attribute Manager

Attribute Manager in IT Risk Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following IT Risk Management objects:

  • Business Objective

  • Control

  • Control Library

  • Control Objective

  • Risk

  • Threat

  • Vulnerability

Standardized Attribute Export

Attribute data in IT Risk Management can now be exported from the Attribute Manager, giving administrators consistent, reliable data for audits, reporting, and governance reviews. Exports can include the full attribute set or only filtered results, and column selection limits each file to the relevant fields.

These enhancements will be available for the following IT Risk Management objects:

  • Business Objective

  • Control

  • Control Library

  • Control Objective

  • Risk

  • Threat

  • Vulnerability

Text Field Character Limit

Text fields in the IT Risk Management Attribute Manager now support up to 10,000 characters. This establishes a consistent data model that lets customers reliably capture detailed, long-form input across all downstream experiences, replacing a limit of about 1,000 characters.

These enhancements will be available for the following IT Risk Management objects:

  • Business Objective

  • Control

  • Control Library

  • Control Objective

  • Risk

  • Threat

  • Vulnerability

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the IT Risk Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following IT Risk Management objects:

  • Business Objective

  • Control

  • Control Library

  • Control Objective

  • Risk

  • Threat

  • Vulnerability

IT Risk Management workflows: Reorder trigger groups and HTML sanitization checks

In IT Risk Management workflows, administrators can now reorder trigger groups to control the sequence in which rules run. HTML sanitization checks now also apply when creating rules with Create Task or Send Notification actions, helping keep task and notification content safe. These updates make workflow automation more predictable and easier to manage.

This enhancement is available for IT Risk Management workflows on the following objects:

  • Controls

  • Issues

  • Objectives

  • Risks

Fixed

  • Resolved an issue that prevented the Edit modal from opening when attempting to modify options for numerical single-select issue attributes.

  • Resolved an issue that prevented workflow trigger rules from triggering when only the Inherent risk score (impact or probability) was updated on a risk.

  • Resolved an issue that incorrectly redirected users to an assessment when clicking a Risk ID from the Assessments screen.

  • Resolved an issue that prevented the Required attribute checkbox from displaying when editing custom attributes on the Attribute manager screen.

  • Resolved an issue that caused the bulk action for unlinking controls from risks to incorrectly display as Bulk delete.

  • Resolved an issue that caused numerical single select attribute options to display their associated labels rather than raw numerical values within assessments.

  • Resolved an issue that prevented control owners from uploading task attachments and incorrectly displayed the comment input to unauthorized users.

  • Resolved an issue that prevented users from editing numerical single-select attribute options for issues.

New Public Preview Features

AI-Powered Control Recommendations on Risks | Available with Solution Packaging Only

Review AI-powered control recommendations, implementation guidance, and mitigation rationale directly from a risk or risk template to identify relevant custom, library, or AI-generated controls. This enhancement helps accelerate risk treatment, improve control reuse and coverage, and establish more consistent and traceable relationships between risks and controls.

Existing Public Preview Features

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Project Risk Assessments

Create Projects from the Inventory menu to track risks across your organization with a consolidated view of associated risks in the Risks tab. This feature brings together direct and indirect risks from linked inventories, assessments, and template rules into a single aggregated project-level risk score to help teams gain a more holistic understanding of risks.

For more information, see Managing Projects in IT Risk Management.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of assigning a value of zero when using the formula builder. This setting helps to define how blank inputs are interpreted in the formula builder throughout the OneTrust Platform for all net new formulas.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

Colorado Automated Decision-Making Technology (Colorado Senate Bill 26-189) establishes requirements for developers and deployers of automated decision-making technology (ADMT) that materially influences consequential decisions, such as decisions about employment, housing, lending, insurance, and health care. The law applies to covered consequential decisions made on or after January 1, 2027.

We've made implementing Colorado's ADMT requirements easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers developer documentation, consumer notices, recordkeeping, data access and correction, and human review. It also addresses related Colorado provisions for conversational AI services and misleading AI claims about psychotherapy.

Scoping survey questions help users identify relevant controls based on their role, organization type, and activities. Control guidance identifies applicable dates and explains how to implement the requirements.

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

Guideline OSFI E-23 Model Risk Management (2027) **sets out supervisory expectations for how federally regulated financial institutions manage model risk. It covers traditional, AI, and machine learning models and calls for oversight proportionate to the risks they pose. The guideline takes effect on May 1, 2027.

We've made implementing OSFI E-23 easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers model governance, inventory and risk ratings, independent review, deployment, monitoring, and retirement.

Selecting the framework in the scoping survey brings the full control set into scope. Institutions can use the guidance and evidence tasks to assess their practices and document how they manage model risk throughout the lifecycle.

For more information, see Supported Control Frameworks.

New NIS 2 (Sweden) Framework Added

Sweden's implementation of the NIS 2 Directive, through the Cybersecurity Act (Cybersäkerhetslag), effective January 15, 2026, establishes cybersecurity requirements for essential and important entities operating across covered sectors in Sweden. The legislation establishes requirements relating to cybersecurity risk management measures, incident reporting, supply chain security, business continuity, access control, cryptography, management responsibilities, and other measures designed to achieve a high level of cybersecurity.

We've made implementing NIS 2 (Sweden) easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of NIS 2 (Sweden).

For more information, see Supported Control Frameworks.

Cyber Essentials UK v3.3 Framework Updated

Framework content has been updated to align with version 3.3 of the Cyber Essentials Requirements for IT Infrastructure. The updated requirements provide additional clarity around cloud services, passwordless authentication, scope, and software development, while continuing to address the five core technical control areas: firewalls, secure configuration, security update management, user access control, and malware protection.

For more information, see Supported Control Frameworks.

Delaware Personal Data Privacy Act (as amended) (2027) Framework Updated

Framework content has been updated to reflect amendments to the Delaware Personal Data Privacy Act (DPDPA) that take effect January 1, 2027. Updates address new and revised requirements relating to the law's applicability, sensitive data, consumer rights, third-party data disclosures, profiling, and other controller and processor obligations.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

Rollup Score Type Enhancement

Custom score attributes with a Rollup score type can now be edited directly from the Context menu on the Attribute manager screen.

Inherited Risk Columns on Inventory and Project Details

The Risk tab of the Inventory details and Project details screens now includes Inherited from and Relationship type columns. These columns identify the source and nature of risks associated with the entity, such as risks propagated from linked assets to a project.

Stage Filter for Controls

A Stage filter is now available for controls, allowing users to filter and export control records based on their current workflow stage.

Attribute Description Tooltips

Tooltips now display attribute descriptions when hovering over attribute labels on the Control implementation details and Control library screens.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.