Permissions Release Notes: IT Risk Management (Spring '26)

For users with access toIT Risk Management, theProcessing activities,Assets,Vendors, andEntitiesitems on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
View risk email templates	The View risk email templates permission has been added and now controls users' ability to view email templates for risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Privacy Program Auditor, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit risk email templates permission.
Restore risks from recycle bin	The Restore risks from recycle bin permission has been added and now controls users' ability to restore risk assessments from the recycle bin.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Delete risks in bulk or the Delete risks permission.
Delete risks from recycle bin	The Delete risks from recycle bin permission has been added and now controls users' ability to delete risk assessments from the recycle bin.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Delete risks in bulk or the Delete risks permission.
Link risk attribute categories	The Link risk attribute categories permission has been added and now controls users' ability to create links between categories and risk attributes.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Governance Viewer, Data Mapping Automation Manager, Digital Policy Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Ethics Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incident General User, Incidents Manager, Invited, Managed Service Provider, Maturity & Planning Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Privacy Rights Automation Manager, Program Benchmarking Manager, Project Owner, Project Respondent, Project Viewer, Site Admin, Supplier Manager, Sustainability Manager, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the Show risk attributes permission.
Access for invited users to view and reassign users	The Access for invited users to view and reassign users permission has been added and now controls invited users' ability to view the user list and reassign work.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, Digital Policy Manager, ERM Manager, ESG Manager, Ethics Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Maturity & Planning Manager, Privacy Officer, Program Benchmarking Manager, Site Admin, Supplier Manager, Sustainability Manager, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View manage users list permission.
View parent risks	The View parent risks permission has been added and now controls users' ability to view risks in the parent hierarchy.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Project Respondent, Project Viewer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the View risk hierarchy permission.
View child risks	The View child risks permission has been added and now controls users' ability to view risks in the child hierarchy.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Project Respondent, Project Viewer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the View risk hierarchy permission.
Create control task attachments	The Create control task attachments permission has been added and now controls users’ ability to create attachments on control tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Create control task comments	The Create control task comments permission has been added and now controls users’ ability to create comments on control tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Create controls tasks	The Create controls tasks permission has been added and now controls users’ ability to create tasks on controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Edit control implementation approver field	The Edit control implementation approver field permission has been added and now controls users’ ability to edit the control implementation approver field.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Approver, IT Risk Manager, Invited, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View control implementations permission.
Edit control implementation owner field	The Edit control implementation owner field permission has been added and now controls users’ ability to edit the control implementation owner field.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Approver, IT Risk Manager, Invited, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View control implementations permission.
Edit control tasks	The Edit control tasks permission has been added and now controls users’ ability to edit tasks on controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Link control entities	The Link control entities permission has been added and now controls users’ ability to create links between entities and controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Link control inventories	The Link control inventories permission has been added and now controls users’ ability to create links between inventories and controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Link control risks	The Link control risks permission has been added and now controls users’ ability to create links between risks and controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Privacy Notice Author, Privacy Notice Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Control implementation edit permission.
Unlink control entities	The Unlink control entities permission has been added and now controls users’ ability to remove links between entities and controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Delete control implementation permission.
Unlink control inventories	The Unlink control inventories permission has been added and now controls users’ ability to remove links between inventories and controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Delete control implementation permission.
Unlink control risks	The Unlink control risks permission has been added and now controls users’ ability to remove links between risks and controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Delete control implementation permission.
View control task attachments	The View control task attachments permission has been added and now controls users’ ability to view attachments on control tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Auditor, Compliance Manager, Data Mapping Automation Manager, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, ERM Manager, ESG Manager, Enterprise Policy Manager, Privacy Notice Author, Privacy Notice Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Officer, Project Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View control implementations permission.
View control task comments	The View control task comments permission has been added and now controls users’ ability to view comments on control tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Auditor, Compliance Manager, Data Mapping Automation Manager, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, ERM Manager, ESG Manager, Enterprise Policy Manager, Privacy Notice Author, Privacy Notice Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Officer, Project Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View control implementations permission.
View control tasks	The View control tasks permission has been added and now controls users’ ability to view tasks on controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Auditor, Compliance Manager, Data Mapping Automation Manager, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View control implementations permission.

Updated Permissions

The following permissions have been updated in the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
Change risk workflow	The Change risk workflow permission has been updated and continues to control users’ ability to change the selected workflow in a risk.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Change risk workflow permission of the same name.
Export risk library	The Export risk library permission has been updated and continues to control users’ ability to export and download the risk library.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, IT Risk Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Export risk library permission of the same name.
Edit risks	The Edit risks permission has been updated and continues to control users’ ability to create risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Edit risks permission of the same name.
Reopen risks	The Reopen risks permission has been updated and continues to control users’ ability to reopen risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Reopen risks permission of the same name.
Create risk score attributes	The Create risk score attributes permission has been updated and continues to control users’ ability to create risk score attributes.	This permission has been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Create risk score attributes permission of the same name.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name	New permission name	System roles	Custom roles
Create library risks	Create risks in library	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Create library risks permission.
	Edit risks in library
Create risks	Create risks		These permissions have been granted to custom roles that were previously assigned the Create risks permission.
	Link risk related objects	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager
Delete risks	Delete risks	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Delete risks permission.
	Unlink risk related objects
	Remove related object from risks
Manage risk attributes	Create risk attribute setup	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Manage risk attributes permission.
	View risk attribute setup
	Edit risk attribute setup
	Delete risk attribute setup
Configure risk categories	View risk categories	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Configure risk categories permission.
	Create risk categories
	Edit risk categories
	Delete risk categories
Risk V2 setting	View risk settings	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	These permissions have been granted to custom roles that were previously assigned the Risk V2 setting permission.
	Edit risk settings
Manage risk workflows Access risk workflow setup	View risk workflow setup	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Project Respondent, Project Viewer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the Manage risk workflows permission or the Access risk workflow setup permission.
	Create risk workflow setup	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Manage risk workflows permission.
	Edit risk workflow setup
	Delete risk workflow setup
	Archive risk workflow setup
Relate risks create	Link parent risks	These permissions have been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Relate risks create permission.
	Link child risks
Relate risks delete	Unlink child risks	These permissions have been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Relate risks delete permission.
	Unlink parent risks
Control navigation workflow	Change control workflow stage	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, Incidents Manager, IT Risk Approver, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Control navigation workflow permission.
	Approve control workflow stages
Control workflow	Archive control workflows	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Control workflow permission.
	Create control workflows
	Delete control workflows
	Edit control workflows
Standard and framework library	View standards and frameworks	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, Incidents Manager, IT Risk Manager, Maturity & Planning Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Program Benchmarking Manager, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Standard and framework library permission.
	Edit standards and frameworks

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name	Explanation of changes
Create risk attribute setup	When the Create risk attribute setup permission is added to the custom role, the View risk attribute setup permission will be automatically added.
View risk attribute setup	When the View risk attribute setup permission is removed from the custom role, the following permissions will be automatically removed: Create risk attribute setup Edit risk attribute setup Delete risk attribute setup
Edit risk attribute setup	When the Edit risk attribute setup permission is added to the custom role, the View risk attribute setup permission will be automatically added.
Delete risk attribute setup	When the Delete risk attribute setup permission is added to the custom role, the View risk attribute setup permission will be automatically added.
View risk categories	When the View risk categories permission is removed from the custom role, the following permissions will be automatically removed: Create risk categories Edit risk categories Delete risk categories
Create risk categories	When the Create risk categories permission is added to the custom role, the View risk categories permission will be automatically added.
Edit risk categories	When the Edit risk categories permission is added to the custom role, the View risk categories permission will be automatically added.
Delete risk categories	When the Delete risk categories permission is added to the custom role, the View risk categories permission will be automatically added.
View risk settings	When the View risk settings permission is removed from the custom role, the Edit risk settings permission will be automatically removed.
Edit risk settings	When the Edit risk settings permission is added to the custom role, the View risk settings permission will be automatically added.
View risk workflow setup	When the View risk workflow setup permission is removed from the custom role, the following permissions will be automatically removed: Create risk workflow setup Edit risk workflow setup Delete risk workflow setup Archive risk workflow setup
Create risk workflow setup	When the Create risk workflow setup permission is added to the custom role, the View risk workflow setup permission will be automatically added.
Edit risk workflow setup	When the Edit risk workflow setup permission is added to the custom role, the View risk workflow setup permission will be automatically added.
Delete risk workflow setup	When the Delete risk workflow setup permission is added to the custom role, the View risk workflow setup permission will be automatically added.
Archive risk workflow setup	When the Archive risk workflow setup permission is added to the custom role, the View risk workflow setup permission will be automatically added.
Link parent risks	When the Link parent risks permission is added to the custom role, the View parent risks permission will be automatically added.
Unlink parent risks	When the Unlink parent risks permission is added to the custom role, the View parent risks permission will be automatically added.
Link child risks	When the Link child risks permission is added to the custom role, the View child risks permission will be automatically added.
Unlink child risks	When the Unlink child risks permission is added to the custom role, the View child risks permission will be automatically added.

Renamed Permissions

The following permissions have been renamed to improve clarity on the actions associated with each individual permission. No changes have been made to permission functionality.

Old permission name	New permission name
Edit custom risk attributes	Edit risk custom attributes
Submit risk treatment	Submit risk treatments
Move risk stages in bulk	Change risk stages in bulk
User can be risk admin	Act as an admin on risks
View library risks	View risk library
Risks library bulk import	Bulk create risks in library
Risks library bulk update	Bulk edit risks in risk library
View risk recycle bin	View risks in recycle bin
User can approve risks	Approve risks
Delete risks in bulk	Bulk delete risks
Create risks in bulk	Bulk create risks
Update risks in bulk	Bulk edit risks
Advance to next stage of custom risk workflow	Change risk workflow stage
Bypass approvals in risk workflow	Bypass risk workflows approvers
Risk V2 add related entity	Add related objects to risks
Add control attributes	Create control attributes
Add control attributes groups	Create control attribute groups
Add control implementations	Create controls
Add control implementations attachment	Create control attachments
Add Evidence Task(s)	Create control evidence tasks
Add library evidence tasks	Create library evidence tasks
Add rules in control profile	Create control profile rules
Bulk create control implementations	Bulk create controls
Control add attachment	Upload control attachments
Control change workflow	Change control workflow
Control download attachment	Download control attachments
Control implementation delete task	Delete control task
Control implementation edit	Edit control implementations
Control implementations change status	Edit control status
Control library evidence task	View evidence templates
Controls library add control	Create control templates
Controls library bulk import controls	Bulk create control templates
Controls library edit control	Edit controls
Controls library export controls	Export control templates
Controls library import framework	Import controls
Controls library remove control	Delete controls
Create bulk relate controls import	Bulk link control templates
Create control profile	Create control profiles
Delete control implementation	Delete control implementations
Delete control implementations attachment	Delete control attachments
Delete control profile	Delete control profiles
Delete library evidence task	Delete evidence templates
Edit control attributes groups	Edit control attribute groups
Edit control profile	Edit control profiles
Edit control public views	Edit a control public view
Edit evidence task library	Edit evidence templates
Evidence task library bulk import	Bulk create evidence templates
Evidence task library update bulk import	Bulk edit evidence templates
Launch control assessments	Create control assessments
Merge evidence task implementations	Merge control evidence tasks
Split control implementations	Split control evidence tasks
Update control implementations attachment	Edit control attachments
View control attributes groups	View control attribute groups
View control implementations attachment	View control attachments
View control profile	Import control profiles
View control self-assessments	View control assessments
View control workflow	View control workflows

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
Edit risk email templates	The Edit risk email templates permission has been removed from the platform.
Show risk attributes	The Show risk attributes permission has been removed from the platform.
View manage users list	The View manage users list permission has been removed from the platform.

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
Control library organization update	The Control library organization update permission has been added to give users the ability to update the organization for the Control library.	This permission has been granted to the Site Admin system role.	This permission has not been granted to custom roles.
View organization risks	The View organization risks permission has been added to give users the ability to view all risks within their organization.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incident General User, Incidents Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View all organization risks permission.
Edit required fields on risk tasks	The Edit required fields on risk tasks permission has been added and now controls users' ability to edit the required fields visible on risk tasks.	This permission has been granted to the following system roles: AI Governance Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Mark risk task as required permission.
Edit saved views in risk	The Edit saved views in risk permissions has been added and now controls users' ability to edit risk saved views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View saved views for risk register permission.
Delete saved views in risk	The Delete saved views in risk permission has been added and now controls users' ability to delete risk saved views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles with the View saved views for risk register permission.
Create saved views in risk	The Create saved views in risk permission has been added and now controls users' ability to create risk saved views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View saved views for risk register permission.
View saved views in risk	The View saved views in risk permission has been added and now controls users’ ability to view risk saved views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View saved views for risk register permission.
Edit risk public saved views	The Edit risk public saved views permission has been added and now controls users’ ability to edit public risk saved views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Privacy Officer, Privacy Program Auditor, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit public views for risk lists permission.
Edit default saved views for risks	The Edit default saved views for risks permission has been added and now controls users’ ability to edit default risk saved views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Privacy Officer, Privacy Program Auditor, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit public views for risk lists permission.
Create risk automation rules	The Create risk automation rules permission has been added and now controls users’ ability to create automation rules for risks.	This permission has been granted to the following system roles: Assessments Manager, Data Governance Manager, Data Mapping Automation Manager, ESG Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Privacy Program Auditor, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Configure risk automation rules permission.
Edit risk routing rules	The Edit risk routing rules permission has been added and now controls users’ ability to edit routing rules for risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit routing rules for risk workflows permission.
View risk routing rules	The View risk routing rules permission has been added and now controls users’ ability to view routing rules for risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit routing rules for risk workflows permission.

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
Mark risk task as required	The Mark risk task as required permission has been removed from the platform.
View saved views for risk register	The View saved views for risk register permission has been removed from the platform.
Edit public views for risk lists	The Edit public views for risk lists permission has been removed from the platform.
Configure risk automation rules	The Configure risk automation rules permission has been removed from the platform.
Edit routing rules for risk workflows	The Edit routing rules for risk workflows permission has been removed from the platform.

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
View risk basic fields	The View risk basic fields permission has been added to give users the ability to manage the fields visible in basic views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Project Respondent, Project Viewer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the Access risks permission.
View risk advanced fields	The View risk advanced fields permissions has been added to give users the ability to manage the fields visible in the advanced views.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Project Owner, Project Respondent, Project Viewer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the Access risks permission.
Edit risk advanced fields	The Edit risk advanced fields permission has been added to give users the ability to edit the fields visible within the basic and advanced view.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles with the Edit risks permission.
Create risk controls	The Create risk controls permission has been added and now controls users’ ability to create controls on risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Add controls to risks permission.
Remove risk controls	The Remove risk controls permission has been added and now controls users’ ability to remove controls from risks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Remove controls from risks permission.
Create risk comments	The Create risk comments permission has been added and now controls users’ ability to create comments on a risk.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Add comments to risks permission.
Delete risk task attachments	The Delete risk task attachments permission has been added and now controls users’ ability to delete risk attachments.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Delete risk attachments permission.
Create risk task comments	The Create risk task comments permission has been added and now controls users’ ability to add comments to a risk.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit risk tasks permission.
Create issues related to risks	The Create issues related to risks permission has been added and now controls users’ ability to create issues related to a risk.	This permission has been granted to the following system roles: AI Governance Manager, Compliance Manager, ERM Manager, Enterprise Policy Manager, IT Risk Approver, IT Risk Manager, Policy Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Issue create permission.
Link issues to risks	The Link issues to risks permission has been added and now controls users’ ability to link issues to a risk.	This permission has been granted to the following system roles: AI Governance Manager, Compliance Manager, ERM Manager, Enterprise Policy Manager, IT Risk Approver, IT Risk Manager, Policy Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Issue edit related permission.
View risk attachments	The View risk attachments permission has been added and now controls users’ ability to view risk attachments.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Download risk attachments permission.
Create risk attachments	The Create risk attachments permission has been added and now controls users’ ability to create risk attachments.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit risk attachments permission.

Updated Permissions

The following permissions have been updated in the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of Changes	System roles	Custom roles
Edit risk attachments	The Edit risk attachments permission has been updated and continues to control users’ ability to edit risk attachments.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Edit risk attachment permission of the same name.
Delete risk attachments	The Delete risk attachments permission has been updated and continues to control users’ ability to delete risk attachments.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Delete risk attachments permission.
View risk tasks	The View risk tasks permission has been updated and continues to control users’ ability to view risk tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Governance Viewer, Data Mapping Automation Manager, Digital Policy Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Ethics Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incident General User, Incidents Manager, Invited, Managed Service Provider, Maturity & Planning Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Privacy Program Auditor, Privacy Rights Automation Manager, Program Benchmarking Manager, Project Owner, Project Respondent, Project Viewer, Site Admin, Supplier Manager, Sustainability Manager, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager, Vendorpedia Assessment Coordinator	This permission has been granted to custom roles that were previously assigned the earlier View risk tasks permission of the same name.
Create risk tasks	The Create risk tasks permission has been updated and continues to control users’ ability to create risk tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Create risk tasks permission of the same name.
Delete risk tasks	The Delete risk tasks permission has been updated and continues to control users’ ability to delete risk tasks.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Delete risk tasks permission of the same name.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name	New permission name	System roles	Custom roles
Edit risk tasks	Edit risk tasks	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Managed Service Provider, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Edit risk tasks permission.
	Create risk task attachments
	Create risk task comments

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name	Explanation of changes
View risk comments	When the View risk comments permission is removed from the custom role, the Create risk comments permission will be automatically removed.
Create risk comments	When the Create risk comments permission is added to the custom role, the View risk comments permission will be automatically added.
View risk controls	When the View risk controls permission is removed from the custom role, the following permissions will be automatically removed: Create risk controls Remove risk controls
Create risk controls	When the Create risk controls permission is added to the custom role, the View risk controls permission will be automatically added.
Remove risk controls	When the Remove risk controls permission is added to the custom role, the View risk controls permission will be automatically added.
View risk tasks	When the View risk tasks permission is removed from the custom rule, the following permissions will be automatically removed: Create risk tasks Edit risk tasks Delete risk tasks Create risk tasks attachments Delete risk tasks attachments Create risk tasks comments
Create risk tasks	When the Create risk tasks permission is added to the custom role, the following permissions will be automatically added: View risk tasks Create risk tasks attachments Create risk tasks comments When the Create risk tasks is removed from the custom role, the following permissions will be automatically removed: Create risk tasks attachments Create risk tasks comments
Edit risk tasks	When the Edit risk tasks permission is added to the custom role, the following permissions will be automatically added: View risk tasks Create risk tasks attachments Create risk tasks comments
Delete risk tasks	When the Delete risk tasks permission is added to the custom role, the following permissions will be automatically added: View risk tasks Delete risk tasks attachments When the Delete risk tasks permission is removed from the custom role, the Delete risk tasks attachments permission will be automatically removed.
Create risk task attachments	When the Create risk task attachments permission is added to the custom role, the View risk tasks permission will be automatically added.
Delete risk task attachments	When the Delete risk task attachments permission is added to the custom role, the View risk tasks permission will be automatically added.
Create risk task comments	When the Create risk task comments permission is added to the custom role, the View risk tasks permission will be automatically added.
Create issues related to risks	When the Create issues related to risks permission is added to the custom role, the View issues related to risks permission will be automatically added.
Link issues to risks	When the Link issues to risks permission is added to the custom role, the View issues related to risks permission will be automatically added.
View risk attachments	When the View risk attachments permission is removed from the custom role, the following permissions will be automatically removed: Delete risk attachments Edit risk attachments Create risk attachments
Create risk attachments	When the Create risk attachments permission is added to the custom role, the View risk attachments permission will be automatically added.
Edit risk attachments	When the Edit risk attachments permission is added to the custom role, the following permissions will be automatically added: Delete risk attachments View risk attachments
Delete risk attachments	When the Delete risk attachments permission is added to the custom role, the View risk attachments permission will be automatically added.
View risk basic fields	When the View risk basic fields permission is removed from the custom rule, the following permissions will be automatically removed: Edit risk approver Edit risk category Edit risk owner Edit risk threats Edit risk treatment Edit risk vulnerabilities View risk advanced fields
View risk advanced fields	When the View risk advanced fields permission is added to the custom role, the View risk basic fields permission will be automatically added.
Edit risk advanced fields	When the Edit risk advanced fields permission is added to the custom role, the View risk advanced fields permission will be automatically added.

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
Add controls to risks	The Add controls to risks permission has been removed from the platform.
Remove controls from risks	The Remove controls from risks permission has been removed from the platform.
Add comments to risks	The Add comments to risks permission has been removed from the platform.
Download risk attachments	The Download risk attachments permission has been removed from the platform.

Renamed Permissions

The following permissions have been renamed to improve clarity on the actions associated with each individual permission. No changes have been made to permission functionality.

Old permission name	New permission name
permission.name.objectives.view	View objectives

For historical IT Risk Management permissions release notes from the Summer '25, Fall '25, and Winter '26 seasons, see the Permissions Release Notes: IT Risk Management (Summer '25 - Winter '26) article.