Permissions Release Notes: IT Risk Management (Summer '25 - Winter '26)
This article contains historical IT Risk Management permissions release notes from the Summer '25, Fall '25, and Winter '26 seasons. For permissions release notes starting from the Spring '26 season onward, click here.
This article consolidates all permissions release notes for IT Risk Management from the OneTrust 202508.1.0 release through the OneTrust 202602.1.0 release, providing a reference point for changes that impact roles, access, and permissions. Each section below corresponds to a release version and includes permissions release notes announced for the product in the respective release. The absence of a release below indicates that there were no permissions release notes announced for the product for that release. For details on permissions release notes across the platform, see Permissions Release Notes Catalog.
Starting in the OneTrust 202601.1.0 release, permissions release notes related to this product will be exclusively published in this article. If permissions release notes exist, the following note will appear within the Permissions section for the respective product on the myOneTrust Release Notes page with a link to this article:
"Permission changes have been implemented to improve platform usability and administrative efficiency. For more information, see Permissions Release Notes: [Product Name]. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog."
February 20, 2026 - 202602.1.0 (Winter Release)
- New Permissions
-
The following permissions have been added to the platform and have been granted to system and custom roles as defined below:
Permission name
Explanation of changes
System roles
Custom roles
Convert risks to issues
The Convert risks to issues permission has been added to give users the ability to convert risk records into issues from the Risk Register or Risk details screen.
This permission has been granted to the Site Admin system role.
This permission has not been granted to custom roles by default but can be configured.
Control implementations change status
The Control implementations change status permission has been added and now controls users’ ability to update control statuses in bulk from the Control list screen.
This permission has been granted to the following system roles:
AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager
This permission has not been granted to custom roles by default but can be configured.
January 30, 2026 - 202601.2.0
- Assessments – Invited User Security Enhancements
-
OneTrust is implementing new permission controls for Invited Users and Project Respondents to align front-end access controls with back-end API behaviors. This update ensures that low-privilege users cannot access metadata or assessment content outside their assigned scope. A new permission will be available for customers who need to restore the broader access level previously granted to their Invited Users.
No action is required unless you want Invited Users to retain their previous access. If you want Invited Users to retain their previous access, you can assign the newly introduced Advanced assessment metadata permission manually to a custom copy of the Invited User role after the change goes live in OneTrust 202601.2.0. Those users with the Invited User role will then need to be reassigned to the custom invited user role with the new permission.
For more information, see Assessments – Invited User Security Enhancements, Invited Users FAQ, and Project Respondents FAQ. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.
January 9, 2026 - 202601.1.0
- New Permissions
-
The following permissions have been added to the platform and have been granted to system and custom roles as defined below:
Permission name
Explanation of changes
System roles
Custom roles
Edit risk owner
The Edit risk owner permission has been added and now controls users’ ability to change the risk owner.
This permission has been granted to the following system roles:
AI Governance manager, Assessments manager, Compliance manager, Data access and usage manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, Enterprise policy manager, Privacy notice author, Privacy notice manager, Exchange manager, IT risk manager, Incidents manager, Invited user, Managed service provider, Policy owner, Privacy officer, Project owner, Project respondent, TPDD compliance manager, TPDD enhanced due diligence requester, TPDD admin, Tech Risk & Compliance admin, Vendor manager, IT risk approver
This permission has been granted to custom roles that were previously assigned the Assign risk owners permission.
Edit risk approver
The Edit risk approver permission has been added and now controls users' ability to change the risk approver.
This permission has been granted to the following system roles:
AI Governance manager, Assessments manager, Data access and usage manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, Exchange manager, IT risk manager, Incidents manager, Managed service provider, Privacy officer, TPDD compliance manager, TPDD enhanced due diligence requester, TPDD admin, Tech Risk & Compliance Admin, Vendor manager, IT risk approver
This permission has been granted to custom roles that were previously assigned the Edit risk approvers permission.
Edit risk category
The Edit risk category permission has been added and now controls users' ability to change the risk category.
This permission has been granted to the following system roles:
AI Governance manager, Assessments manager, Compliance manager, Data access and usage manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, Enterprise policy manager, Privacy notice author, Privacy notice manager, Exchange manager, IT risk manager, Incidents manager, Managed service provider, Policy owner, Privacy officer, Project owner, Project respondent, TPDD compliance manager, TPDD enhanced due diligence requester, TPDD admin, Tech Risk & Compliance admin, Vendor manager, IT risk approver
This permission has been granted to custom roles that were previously assigned the Edit risk categories permission.
Edit threat
The Edit threat permission has been added and now controls users' ability to edit the risk threat.
This permission has been granted to the following system roles:
Assessments manager, Data access and usage manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, IT risk manager, Incidents manager, Privacy officer, Tech Risk & Compliance admin, Vendor manager, IT risk approver
This permission has been granted to custom roles that were previously assigned the Remove threats permission.
Edit risk treatment
The Edit risk treatment permission has been added and now controls users' ability to edit the risk treatment.
This permission has been granted to the following system roles:
AI Governance manager, Assessments manager, Compliance manager, Data access and usage manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, Enterprise policy manager, Privacy notice author, Privacy notice manager, Exchange manager, IT risk manager, Incidents manager, Invited user, Managed service provider, Policy owner, Privacy officer, Project owner, Project respondent, TPDD compliance manager, TPDD enhanced due diligence requester, TPDD admin, Tech Risk & Compliance admin, Vendor manager, IT Risk approver
This permission has been granted to custom roles that were previously assigned the Edit risk treatments permission.
Edit vulnerability
The Edit vulnerability permission has been added and now controls users' ability to edit the risk vulnerability.
This permission has been granted to the following system roles:
Assessments manager, Data access and usage manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, IT risk manager, Incidents manager, Privacy officer, Tech Risk & Compliance admin, Vendor manager, IT risk approver
This permission has been granted to custom roles that were previously assigned the Remove vulnerabilities permission.
December 5, 2025 - 202512.1.0
- New Permissions
-
The following permissions have been added to the platform and have been granted to system and custom roles as defined below:
Permission name
Explanation of changes
System roles
Custom roles
Risk comments tab
These permissions have been added to give users the ability to access and view content available within tabs on the Risk details screen.
These permissions have been granted to the following system roles:
AI Governance manager, Assessments manager, Audit manager, Compliance manager, Data access and usage manager, Data governance manager, Data mapping manager, ERM manager, ESG Manager, Enterprise policy manager, Privacy notice author, Privacy notice manager, Exchange manager, IT risk manager, Incidents manager, Invited user, Managed service provider, Privacy officer, Privacy program auditor, Project owner, Project respondent, Project viewer, TPDD compliance manager, TPDD enhanced due diligence requester, TPDD admin, Tech risk & compliance admin, Vendor manager, Vendorpedia assessment coordinator, IT risk approver, Site admin
These permissions have been granted to custom roles that were previously assigned the Access risks permission.
Risk controls tab
Risk workflow and approval tab
Risk history tab
Risk related tab
Risk assessments tab
These permissions have been added and now control users’ ability to access and view content available within tabs on the Risk details screen.
These permissions have been granted to the following system roles:
AI Governance manager, Assessments manager, Audit manager, Compliance manager, Data access and usage manager, Data governance manager, Data mapping manager, ERM manager, ESG Manager, Enterprise policy manager, Privacy notice author, Privacy notice manager, Exchange manager, IT risk manager, Incidents manager, Invited user, Managed service provider, Privacy officer, Privacy program auditor, Project owner, Project respondent, Project viewer, TPDD compliance manager, TPDD enhanced due diligence requester, TPDD admin, Tech risk & compliance admin, Vendor manager, Vendorpedia assessment coordinator, IT risk approver, Site admin
These permissions have been granted to custom roles that were previously assigned the following combination of permissions:
-
View risk assessment list
-
Issue view related
-
Audit access
-
ERM risk hierarchy view
-
Relate risks view
Risk issues tab
Risk activity tab
Risk related risks tab
-
October 27, 2025 - 202510.2.0 (Fall Release)
- New Permissions
-
The following permissions have been added to the platform and have been granted to system and custom roles as defined below:
Permission name
Explanation of changes
System roles
Custom roles
Create relationship between control library and evidence library
The Create relationship between control library and evidence library and Remove relationship between control library and evidence library permissions have been added and now control user’s ability to manage control and evidence task library relationships.
These permissions have been granted to the following system roles:
AI Governance manager, Assessments manager, Audit manager, Compliance manager, Data Governance manager, Data Mapping Automation manager, ERM manager, ESG manager, Enterprise policy manager, Exchange manager, IT risk manager, Incidents manager, Maturity & Planning Manager, Policy owner, Privacy notice author, Privacy notice manager, Privacy officer, Program Benchmarking manager, Site admin, Tech Risk & Compliance Admin, Vendor manager
These permissions have been granted to custom roles that were previously assigned the following combination of permissions:
-
Controls library edit control
-
Add evidence tasks
-
Edit evidence task library
Remove relationship between control library and evidence library
-
- Split Permissions
-
The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:
Old permission name
New permission name
System roles
Custom roles
Manage control categories
View category manager for controls, threats and vulnerabilities
These permissions have been granted to the following system roles:
AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ESG Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Project Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager
These permissions have been granted to custom roles that were previously assigned the Manage control categories permission.
Add categories in category manager for controls, threats and vulnerabilities
Edit categories in category manager for controls, threats and vulnerabilities
- Removed Permissions
-
The following permissions have been removed from the platform or removed from select system roles as defined below:
Permission name
Explanation of changes
Add control implementation
The Add control implementation and Bulk create control implementations permissions have been removed from the Project Owner system role.
Bulk create control implementations
September 12, 2025 - 202509.1.0
-
As part of permission standardization efforts, some permissions have been updated. Because of this, some custom roles may no longer be able to view vendor records or other inventory items. This change is expected. Please review your custom roles and enable the permissions below as necessary to restore access:
-
Assets: Data Mapping Automation inventory assets
-
Processing Activities: Data Mapping Automation inventory processing activity
-
Entities: Data Mapping Automation entities inventory
-
Vendors: Vendor Basic Fields View & Vendor Advanced Fields View
-
Attributes: Inventory view attributes
-
August 23, 2025 - 202508.2.0
- Linked Permissions
-
The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.
Permission name
Explanation of changes
Manage risk workflows
-
When the Manage risk workflows permission is added to the custom role, the View risk workflows permission will be automatically added.
-
When the View risk workflows permission is removed from the custom role, the Manage risk workflows permission will be automatically removed.
-
August 1, 2025 - 202508.1.0 (Summer Release)
- New Permissions
-
The following permissions have been added to the platform and have been granted to system and custom roles as defined below:
Permission name
Explanation of changes
System roles
Custom roles
Edit Threat Attribute
The Edit Threat Attribute permission has been added to give users the ability to create and edit custom Threat Library attributes.
These permissions have been granted to the following system roles:
Assessments Manager, Data Mapping Automation Manager, ERM Manager, Incidents Manager, ITRM Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager
This permission has not been granted to custom roles by default but can be configured.
Edit Vulnerability Attribute
The Edit Vulnerability Attribute permission has been added to give users the ability to create and edit custom Vulnerability Library attributes.
These permissions have been granted to the following system roles:
Assessments Manager, Data Mapping Automation Manager, ERM Manager, Incidents Manager, ITRM Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager
This permission has not been granted to custom roles by default but can be configured.
View Objectives
The View Objectives permission has been added to give users the ability to view business objective details.
These permissions have been granted to the following system roles:
ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin
This permission has not been granted to custom roles by default but can be configured.
Create Risk Relationship
The Create Risk Relationship permission has been added to give users the ability to create parent and child risk relationships.
These permissions have been granted to the following system roles:
ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin
This permission has not been granted to custom roles by default but can be configured.
View Risk Relationship
The View Risk Relationship permission has been added to give users the ability to view parent and child risk relationships.
These permissions have been granted to the following system roles:
ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin
This permission has not been granted to custom roles by default but can be configured.
Delete Risk Relationship
The Delete Risk Relationship permission has been added to give users the ability to unlink or remove parent and child risk relationships.
These permissions have been granted to the following system roles:
ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin
This permission has not been granted to custom roles by default but can be configured.
Risk Hierarchy View
The Risk Hierarchy View permission has been added to give users the ability to view the risk hierarchy of parent and child risk relationships.
These permissions have been granted to the ERM Manager and Site Admin system roles.
This permission has not been granted to custom roles by default but can be configured.
View Risk Rollup Attribute
The View Risk Rollup Attribute permission has been added to give users the ability to view the roll-up risk scores computed at individual risks to the parent risks.
These permissions have been granted to the ERM Manager and Site Admin system roles.
This permission has not been granted to custom roles by default but can be configured.
Merge Control Implementations
The Merge Control Implementations permission has been added to give users the ability to merge implementations of the same Library Control together.
These permissions have been granted to the following system roles:
AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager
This permission has been granted to custom roles that were previously assigned the Control Admin permission.
Split Control Implementations
The Split Control Implementations permission has been added to give users the ability to split a shared control implementation into separate implementations.
Merge Evidence Task Implementations
The Merge Evidence Task Implementations permission has been added to give users the ability to merge evidence task implementations together.
These permissions have been granted to the following system roles:
AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Governance Manager, Data Mapping Automation Manager, ESG Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager
This permission has been granted to custom roles that were previously assigned the Control Library Evidence Task permission.