Third-Party Risk Management - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types, and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across Third-Party Management have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Third-Party Management (TPM), mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Unified Table Experience in Attribute Manager

Attribute Manager in Third-Party Risk Management now offers a unified, standardized table experience with paginated, resizable tables and consistent search, sort, and filter behavior. This replaces inconsistent filtering, sorting, and table behavior across Attribute Manager experiences, making configuration faster, easier, and more reliable for Site Admins and managers who configure objects, attributes, and assessments, and reducing the risk of misinterpreting data.

These enhancements will be available for the following Third-Party Risk Management objects:

  • Contract

  • Engagements

Standardized Attribute Export

Attribute exports in Third-Party Risk Management now include additional columns for standardization. This provides administrators consistent, reliable data for audits, reporting, and governance reviews..

These enhancements will be available for the following Third-Party Risk Management objects:

  • Contract

  • Engagements

Standard Table Experience and Customize Option Order for Attribute Options

The attribute options table in the Third-Party Risk Management Attribute Manager now uses the standard OneTrust table, providing a consistent, standardized table experience. The new Reorder options experience makes it easier to customize the order of attribute options. A Customize option order setting now appears above the options list in place of the checkbox and drag handle on each row, and the Search options field remains in the same place. Adopting the standard table simplifies maintaining attribute options and supports future maintenance.

These enhancements will be available for the following Third-Party Risk Management objects:

  • Contract

  • Engagements

AI Document Summarization for Vendor Documents
From a vendor record's Documents tab, you can generate an AI-driven summary of a vendor-provided document to support review during onboarding and assessment.
AI Document Scanning for Engagements and Contracts
For supported assessment templates, AI Document Scanner can use an uploaded document to identify Engagement or Contract references, match them to existing records associated with the vendor being assessed, and populate supported object and attribute responses.

Fixed

  • Resolved an issue that caused the Save button to remain incorrectly disabled when editing condition values in an existing engagement workflow stage rule.

  • Resolved an issue that caused assessment submissions to fail with a locked error when invalid email addresses were provided for contract or engagement questions.

  • Resolved an issue that caused recipient identification fields to be empty in DORA ROI reports. Reports now ensure the system uses the unique identifier rather than the display label for linked entities.

  • Resolved an issue that prevented stage rules from running in cloned engagement workflows.

  • Resolved an issue in the TPRM Agent that caused an incorrect error message to display when the website attribute was disabled.

  • Resolved an issue that prevented the New record creation and Allow multi select options from displaying when adding engagement questions to assessment templates.

New Public Preview Features

AI Auto-Responses for Engagement and Contract Assessments
AI Inventory Analysis can reuse eligible responses from up to three completed assessments associated with the same Engagement to help complete supported non-attribute Engagement and Contract questions.
Third-Party Red Flag Monitoring
Third-Party Red Flag Monitoring identifies new HackNotice breach alerts for eligible third-party vendors connected to Exchange, creates an issue for the affected vendor, and sends email and in-app notifications to help your team review the alert.

Standard / Control Framework Changes

New Colorado Automated Decision-Making Technology Framework Added

Colorado Automated Decision-Making Technology (Colorado Senate Bill 26-189) establishes requirements for developers and deployers of automated decision-making technology (ADMT) that materially influences consequential decisions, such as decisions about employment, housing, lending, insurance, and health care. The law applies to covered consequential decisions made on or after January 1, 2027.

We've made implementing Colorado's ADMT requirements easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers developer documentation, consumer notices, recordkeeping, data access and correction, and human review. It also addresses related Colorado provisions for conversational AI services and misleading AI claims about psychotherapy.

Scoping survey questions help users identify relevant controls based on their role, organization type, and activities. Control guidance identifies applicable dates and explains how to implement the requirements.

For more information, see Supported Control Frameworks.

New Canada OSFI E-23 Model Risk Management Framework Added

Guideline OSFI E-23 Model Risk Management (2027) **sets out supervisory expectations for how federally regulated financial institutions manage model risk. It covers traditional, AI, and machine learning models and calls for oversight proportionate to the risks they pose. The guideline takes effect on May 1, 2027.

We've made implementing OSFI E-23 easy by offering a framework on the OneTrust platform with controls, implementation guidance, and mapped evidence tasks. The framework covers model governance, inventory and risk ratings, independent review, deployment, monitoring, and retirement.

Selecting the framework in the scoping survey brings the full control set into scope. Institutions can use the guidance and evidence tasks to assess their practices and document how they manage model risk throughout the lifecycle.

For more information, see Supported Control Frameworks.

New NIS 2 (Sweden) Framework Added

Sweden's implementation of the NIS 2 Directive, through the Cybersecurity Act (Cybersäkerhetslag), effective January 15, 2026, establishes cybersecurity requirements for essential and important entities operating across covered sectors in Sweden. The legislation establishes requirements relating to cybersecurity risk management measures, incident reporting, supply chain security, business continuity, access control, cryptography, management responsibilities, and other measures designed to achieve a high level of cybersecurity.

We've made implementing NIS 2 (Sweden) easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of NIS 2 (Sweden).

For more information, see Supported Control Frameworks.

Cyber Essentials UK v3.3 Framework Updated

Framework content has been updated to align with version 3.3 of the Cyber Essentials Requirements for IT Infrastructure. The updated requirements provide additional clarity around cloud services, passwordless authentication, scope, and software development, while continuing to address the five core technical control areas: firewalls, secure configuration, security update management, user access control, and malware protection.

For more information, see Supported Control Frameworks.

Delaware Personal Data Privacy Act (as amended) (2027) Framework Updated

Framework content has been updated to reflect amendments to the Delaware Personal Data Privacy Act (DPDPA) that take effect January 1, 2027. Updates address new and revised requirements relating to the law's applicability, sensitive data, consumer rights, third-party data disclosures, profiling, and other controller and processor obligations.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

Assessment Bulk Imports

Contract and engagement question responses, including associated attribute-question responses, can now be populated during assessment bulk imports.

System User Attributes

System user attributes in engagement and contract details now correctly reflect the configured email display settings.

Attribute List Exports

An Export action is now available on the Engagements and Contracts attribute list screens, allowing users to perform full or filtered-view asynchronous exports.

Risk Email Recipients

Email notifications for risks now support user groups as recipients for risk owners and approvers.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.