Permissions Release Notes: IT Risk Management (Summer '26 - Current)

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
View column reports for controls	The View column reports for controls permission has been added and now controls users' ability to view column reports for controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Reports view and Export controls list permissions.
View PDF reports for controls	The View PDF reports for controls permission has been added and now controls users' ability to view PDF reports for controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Reports view and Custom control PDF permissions.
Edit column reports for controls	The Edit column reports for controls permission has been added and now controls users' ability to edit column reports for controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Reports create and Export controls list permissions.
Edit PDF reports for controls	The Edit PDF reports for controls permission has been added and now controls users' ability to edit PDF reports for controls.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Reports create and Custom control PDF permissions.
View assignments for business objectives	The View assignments for business objectives permission has been added to give users the ability to view assignments for business objectives.	This permission has been granted to the following system roles: IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has not been granted to custom roles by default but can be configured.
Edit assignments for business objectives	The Edit assignments for business objectives permission has been added to give users the ability to edit assignments for business objectives.	This permission has been granted to the following system roles: IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has not been granted to custom roles by default but can be configured.
Share business objectives	The Share business objectives permission has been added to give users the ability to share access to business objectives.	This permission has been granted to the following system roles: IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has not been granted to custom roles by default but can be configured.
View access to business objectives	The View access to business objectives permisison has been added to give users the ability to view users and their access levels for business objectives.	This permission has been granted to the following system roles: IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has not been granted to custom roles by default but can be configured.
View attachments for business objectives	The View attachments for business objectives permission has been added and now controls users' ability to view attachments for business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective document view permission.
Delete attachments for business objectives	The Delete attachments for business objectives permission has been added and now controls users' ability to remove attachments from business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective document delete permission.
View tasks for business objectives	The View tasks for business objectives permission has been added and now controls users' ability to view tasks for business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective task view permission.
Create tasks for business objectives	The Create tasks for business objectives permission has been added and now controls users' ability to add tasks to business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective task add permission.
Edit tasks for business objectives	The Edit tasks for business objectives permission has been added and now controls users' ability to edit tasks for business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective task edit permission.
Delete tasks from business objectives	The Delete tasks from business objectives permission has been added and now controls users' ability to delete tasks from business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective task delete permission.
View comments in business objectives	The View comments in business objectives permission has been added and now controls users' ability to view comments in business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective comments view permission.
Create comments for business objectives	The Create comments for business objectives permission has been added and now controls users' ability to add comments to business objectives.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective comments add permission.
View workflows for business objectives	The View workflows for business objectives permission has been added and now controls users' ability to view the workflow and approval tab for business objective workflows.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective workflow approval tab permission.
Edit saved views of business objective list	The Edit saved views of business objective list permission has been added and now controls users' ability to create and edit saved views of the business objective list.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Objective saved views permission.
Link business objective related risks	The Link business objective related risks permission has been added and now controls users' ability to create links between business objectives and related risks.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Create risks permission.
Unlink business objective related risks	The Unlink business objective related risks permission has been added and now controls users' ability to remove links between business objectives and related risks.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Unlink risks permission.

Updated Permissions

The following permissions have been updated in the platform:

Permission name	Explanation of changes
View control implementation details	The View control implementation details permission now controls users' ability to view control implementations assigned to the current organization and respective child organizations. This permission has been removed from custom roles that were not previously assigned the View all org control implementation permission and the following system roles: Auditor, Data Governance Manager, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, Invited, IT Risk Approver, Managed Service Provider, Policy Owner, Project Respondent
View evidence task basic fields	The View evidence task basic fields permission now controls users' ability to view evidence tasks assigned to the current organization and respective child organizations. This permission has been removed from custom roles that were not previously assigned the View all org control implementation permission and the following system roles: Auditor, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, Invited, IT Risk Approver, Managed Service Provider, Project Owner, Project Respondent, Project Viewer

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name	New permission name	System roles	Custom roles
Objective document add	Create attachments for business objectives	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective document add permission.
	Edit attachments for business objectives
Objective view	View basic fields for business objectives	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective view permission.
	View advanced fields for business objectives
	View activity for business objectives
	View attributes for business objectives
Objective create	Create business objectives	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective create permission.
	Bypass business objective workflows approvers
	Create attributes for business objectives
	Create business objective workflows
Objective update	Edit business objectives	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective update permission.
	Change business objective workflow
	Change business objective workflow
	Edit attributes for business objectives
	Edit business objective workflows
Objective delete	Delete business objectives	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective delete permission.
	Bulk delete business objectives
	Delete business objective workflows
Objective export	Export business objectives column reports	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective export permission.
	Export business objectives PDF reports
Reports view	View business objective column reports	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Reports view permission.
	View business objectives PDF reports
Reports create	Edit business objectives column reports	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Reports create permission.
	Edit business objectives PDF reports
Objective public views	Edit public views of business objective list	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	These permissions have been granted to custom roles that were previously assigned the Objective public views permission.
	Edit saved views of business objective list

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name	Explanation of changes
View assignments for business objectives	When the View assignments for business objectives permission is removed from the custom role, the Edit assignments for business objectives permission will be automatically removed.
Edit assignments for business objectives	When the Edit assignments for business objectives permission is added to the custom role, the View assignments for business objectives permission will be automatically added.
View attachments for business objectives	When the View attachments for business objectives permission is added to the custom role, then the following permissions will be automatically added: Create attachments for business objectives Edit attachments for business objectives Delete attachments for business objectives When the View attachments for business objectives permission is removed from the custom role, then the following permissions will be automatically removed: Create attachments for business objectives Edit attachments for business objectives Delete attachments for business objectives
Create attachments for business objectives	When the Create attachments for business objectives permission is added to the custom role, then the following permissions will be automatically added: View attachments for business objectives Edit attachments for business objectives Delete attachments for business objectives When the Create attachments for business objectives permission is removed from from the custom role, then the following permissions will be automatically removed: View attachments for business objectives Edit attachments for business objectives Delete attachments for business objectives
Edit attachments for business objectives	When the Edit attachments for business objectives permission is added to the custom role, then the following permissions will be automatically added: View attachments for business objectives Create attachments for business objectives Edit attachments for business objectives When the Edit attachments for business objectives permission is removed from from the custom role, then the following permissions will be automatically removed: View attachments for business objectives Create attachments for business objectives Edit attachments for business objectives
Delete attachments for business objectives	When the Delete attachments for business objectives permission is added to the custom role, the View attachments for business objectives permission will be automatically added.
View attributes for business objectives	When the View attributes for business objectives permission is removed from the custom role, the Create attributes for business objectives and Edit attributes for business objectives permissions will be automatically removed.
Create attributes for business objectives	When the Create attributes for business objectives permission is added to the custom role, the View attributes for business objectives permission will be automatically added.
Edit attributes for business objectives	When the Edit attributes for business objectives permission is added to the custom role, the View attributes for business objectives permission will be automatically added.
Edit business objectives	When the Edit business objectives permission is added to the custom role, the View basic fields for business objectives permission will be automatically added.
Delete business objectives	When the Delete business objectives permission is added to the custom role, the View basic fields for business objectives permission will be automatically added.
View basic fields for business objectives	When the View basic fields for business objectives permission is removed from the custom role, then the following permissions will be automatically removed: Create business objectives Edit business objectives Delete business objectives View advanced fields for business objectives
View advanced fields for business objectives	When the View advanced fields for business objectives permission is added to the custom role, the View basic fields for business objectives permission will be automatically added.
View comments in business objectives	When the View comments in business objectives permission is removed from the custom role, the Create comments for business objectives permission will be automatically removed.
Create comments for business objectives	When the Create comments for business objectives permission is added to the custom role, the View comments in business objectives permission will be automatically added.
View business objective related risks	When the View business objective related risks permission is removed from the custom role, the Link business objective related risks and Unlink business objective related risks permissions will be automatically removed.
Link business objective related risks	When the Link business objective related risks permission is added to the custom role, the View business objective related risks permission will be automatically added.
Unlink business objective related risks	When the Unlink business objective related risks permission is added to the custom role, the View business objective related risks permission will be automatically added.
View tasks for business objectives	When the View tasks for business objectives permission is removed from the custom role, then the following permissions will be automatically removed: Add tasks to business objectives Create tasks for business objectives Delete tasks from business objectives
Add tasks to business objectives	When the Add tasks to business objectives permission is added to the custom role, the View tasks for business objectives permission will be automatically added.
Create tasks for business objectives	When the Create tasks for business objectives permission is added to the custom role, the View tasks for business objectives permission will be automatically added.
View business objective workflows	When theView business objective workflows permission is removed from the custom role, then the following permissions will be automatically removed: Create business objective workflows Edit business objective workflows Delete business objective workflows
Create business objective workflows	When the Create business objective workflows permission is added to the custom role, the View business objective workflows permission will be automatically added.
Edit business objective workflows	When the Edit business objective workflows permission is added to the custom role, the View business objective workflows permission will be automatically added.
Delete business objective workflows	When the Delete business objective workflows permission is added to the custom role, the View business objective workflows permission will be automatically added.

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
Objective document add	The Objective document add permission has been removed from the platform. There is no impact to system or custom roles.
Objective view	The Objective view permission has been removed from the platform. There is no impact to system or custom roles.
Objective create	The Objective create permission has been removed from the platform. There is no impact to system or custom roles.
Objective update	The Objective update permission has been removed from the platform. There is no impact to system or custom roles.
Objective delete	The Objective delete permission has been removed from the platform. There is no impact to system or custom roles.
Objective export	The Objective export permission has been removed from the platform. There is no impact to system or custom roles.
Objective public views	The Objective public views permission has been removed from the platform. There is no impact to system or custom roles.

Following the Public Preview release of Attribute-Based Access Control (ABAC) Phase 1: Foundations, the following updates have been made to IT Risk Management permission behavior:

• If ABAC is not enabled for your tenant, users with the View basic fields for risks permission can view standard and advanced risk attributes for all risks in their organization and below. In this scenario, the View advanced fields for risks permission does not impact access.

• If ABAC is enabled for your tenant:

  • Users with the View basic fields for risks permission granted through an assigned role can view standard risk attributes for all risks in their organization and below.

  • Users with the View basic fields for risks permission granted through an ABAC assignment, but not through an assigned role can view standard risk attributes only for risk records they have access to through ABAC assignments.

  • Users must also have the View advanced fields for risks permission to view advanced risk attributes.

For more information, see Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
View risk access requests	The View risk access requests permission has been added to give users the ability to view access requests for assessments.	This permission has been granted to the Site Admin system role.	This permission has not been granted to custom roles by default but can be configured.
Approve risk access requests	The Approve risk access requests permission has been added to give users the ability to approve access requests for risks.	This permission has been granted to the Site Admin system role.	This permission has not been granted to custom roles by default but can be configured.
Deny risk access requests	The Deny risk access requests permission has been added to give users the ability to deny access requests for risks.	This permission has been granted to the Site Admin system role.	This permission has not been granted to custom roles by default but can be configured.
Create risk type questions in templates	The Create risk type questions in templates permission has been added and now controls users’ ability to create questions for risks in templates.	This permission has been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, Incidents Manager, IT Risk Manager, Privacy Officer, Project Owner, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Add risk assessment questions permission.
View IT Risk Management	The View IT Risk Management permission has been added and now controls users’ ability to view the IT Risk Management product.	This permission has been granted to the following system roles: Assessments Manager, Basic, Compliance Manager, Data Mapping Automation Manager, ERM Manager, Incidents Manager, IT Risk Approver, IT Risk Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Access IT Risk Management permission.
View risk templates	The View risk templates permission has been added and now controls users’ ability to view risk templates in the IT Risk Management product.	This permission has been granted to the following system roles: Assessments Manager, Compliance Manager, Data Mapping Automation Manager, Incidents Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Access assessment templates permission.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name	New permission name	System roles	Custom roles
View details of a given control implementation	View details of a given control implementation	These permissions have been granted to the following system roles: AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Project Respondent, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the View details of a given control implementation permission.
	View advanced fields for controls
	View control settings
	View control activity
	View evidence task activity
	View evidence template activity
	Edit control settings

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name	Explanation of changes
Create assessments on risks	When the Create assessments on risks permission is added to the custom role, the View assessment details on risks permission will be automatically added.
Edit risk public saved views	When the Edit risk public saved views permission is added to the custom role, the View saved views in risk permission will be automatically added.
Edit risk routing rules	When the Edit risk routing rules permission is added to the custom role, the View risk routing rules permission will be automatically added.
Link risk attribute categories	When the Link risk attribute categories permission is added to the custom role, the View risk attribute setup permission will be automatically added.
View assessment details on risks	When the View assessment details on risks permission is removed from the custom role, the Create assessments on risks permission will be automatically removed.
View risk attribute setup	When the View risk attribute setup permission is removed from the custom role, the Create risk score attributes and Link risk attribute categories permissions will be automatically removed.
View risk routing rules	When the View risk routing rules permission is removed from the custom role, the Edit risk routing rules permission will be automatically removed.
View saved views in risk	When the View saved views in risk permission is removed from the custom role, the Edit risk public saved views and Edit default saved views for risks permissions will be automatically removed.

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
View all organization risks	The View all organization risks permission has been removed from the platform. There is no impact to system or custom roles.
Create risk column reports	The Create risk column reports permission has been removed from the platform. There is no impact to system or custom roles.
Risk control	The Risk control permission has been removed from the platform. There is no impact to system or custom roles.
Risk create	The Risk create permission has been removed from the platform. There is no impact to system or custom roles.
Create roll-up attributes	The Create roll-up attributes permission has been removed from the platform. There is no impact to system or custom roles.
View approval details for risk workflow stages	The View approval details for risk workflow stages permission has been removed from the platform. There is no impact to system or custom roles.
View risk approver details	The View risk approver details permission has been removed from the platform. There is no impact to system or custom roles.
ITRM objective management	The ITRM objective management permission has been removed from the platform. There is no impact to system or custom roles.
ITRM relate risks	The ITRM relate risks permission has been removed from the platform. There is no impact to system or custom roles.
ITRM risk assessment factors	The ITRM risk assessment factors permission has been removed from the platform. There is no impact to system or custom roles.
Add risk assessment questions	The Add risk assessment questions permission has been removed from the platform. There is no impact to system or custom roles.
Edit risks	The Edit risks permission has been removed from the platform. There is no impact to system or custom roles.
View organization risks	The View organization risks permission has been removed from the platform. There is no impact to system or custom roles.

Permission Group Change

The permission groups associated with the following permissions have been updated as defined below:

Permission name	Explanation of changes
Edit evidence task interval start month	The following permissions that previously belonged to the Controls library permission group have been moved to the Evidence Task Implementation permission group: Edit evidence task interval start month Evidence task notification configuration View evidence task interval workflow Edit evidence task interval workflow stage View EvidenceTask Interval Workflow Setup Bulk edit evidence tasks Bypass approvers on evidence task interval workflows Mark evidence as collected
Evidence task notification configuration
View evidence task interval workflow
Edit evidence task interval workflow stage
View EvidenceTask Interval Workflow Setup
Bulk edit evidence tasks
Bypass approvers on evidence task interval workflows
Mark evidence as collected
View all org control implementation	The following permissions that previously belonged to the Controls library permission group have been moved to the ControlImplementation permission group: View all org control implementation control implementation bulk update via templates Advance control in approval stage Merge control implementations Split control implementations Control bypass required approvals
control implementation bulk update via templates
Advance control in approval stage
Merge control implementations
Split control implementations
Control bypass required approvals

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
Create bulk threats	The Create bulk threats permission has been added and now controls users’ ability to create threats in bulk.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Import threats in bulk permission.
Create bulk vulnerabilities	The Create bulk vulnerabilities permission has been added and now controls users’ ability to create vulnerabilities in bulk.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Import vulnerabilities in bulk permission.
Import frameworks to threat library	The Import frameworks to threat library permission has been added and now controls users’ ability to import standards and frameworks to the threat library.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Add framework threats in bulk permission.
Import frameworks to vulnerability library	The Import frameworks to vulnerability library permission has been added and now controls users’ ability to import standards and frameworks to the vulnerability library.	This permission has been granted to the following system roles: ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin	This permission has been granted to custom roles that were previously assigned the Add framework vulnerabilities in bulk permission.
Export threats library	The Export threats library permission has been added and now controls users’ ability to download the threat library.	This permission has been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Export threat library permission.
Export vulnerability library	The Export vulnerability library permission has been added and now controls users’ ability to download the vulnerability library.	This permission has been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Export vulnerabilities library permission.
Create assessments on risks	The Create assessments on risks permission has been added and now controls users’ ability to create assessments on risks.	This permission has been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Project Owner, Tech Risk & Compliance Admin, Vendor Manager, Site Admin	This permission has been granted to custom roles that were previously assigned the Launch risk assessments permission.
Delete library risks	The Delete library risks permission has been added and now controls users’ ability to delete records in the risk library.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, Incidents Manager, IT Risk Manager, Managed Service Provider, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Edit risks in library permission.
Create attribute groups	The Create attribute groups permission has been added and now controls users' ability to create risk attribute groups.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, TPDD Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the Create risk attribute setup permission.
Edit attribute groups	The Edit attribute groups permission has been added and now controls users' ability to edit risk attribute groups.		This permission has been granted to custom roles that were previously assigned the Edit risk attribute setup permission.
View attribute groups	The View attribute groups permission has been added and now controls users' ability to view risk attribute groups.		This permission has been granted to custom roles that were previously assigned the View risk attribute setup permission.
Delete attribute groups	The Delete attribute groups permission has been added and now controls users' ability to delete risk attribute groups.		This permission has been granted to custom roles that were previously assigned the Delete risk attribute setup permission.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name	New permission name	System roles	Custom roles
Delete threats	Delete threats	These permissions have been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Delete threats permission.
	Delete bulk threats
Delete vulnerabilities	Delete vulnerabilities	These permissions have been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Delete vulnerabilities permission.
	Delete bulk vulnerabilities
Configure threat library	View threat library	These permissions have been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the View threat library permission or the Configure threat library permission.
	Create threat		These permissions have been granted to custom roles that were previously assigned the Configure threat library permission.
	Edit threats
Configure vulnerability library	View vulnerability library	These permissions have been granted to the following system roles: Assessments Manager, Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Incidents Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager	These permissions have been granted to custom roles that were previously assigned the Configure vulnerability library permission.
	Create vulnerability
	Edit vulnerabilities

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name	Explanation of changes
Edit saved views in risk	When the Edit saved views permission is added to the custom role, the View saved views in risk permission will be automatically added.
Delete saved views in risk	When the Delete saved views in risk permission is added to the custom role, the View saved views in risk permission will be automatically added.
Create saved views in risk	When the Create saved views in risk permission is added to the custom role, the View saved views in risk permission will be automatically added.
View saved views in risk	When the View saved views in risk permission is removed from the custom role, the following permissions will be automatically removed: Edit saved views in risk Delete saved views in risk Create saved views in risk

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
Launch risk assessments	The Launch risk assessments permission has been removed from the platform. There is no impact to system or custom roles.
View assessment details on risks	The View assessment details on risks permission has been removed from the following system roles: Audit Manager, Compliance Manager, Data Access and Usage Manager, Data Governance Manager, ESG Manager, Enterprise Policy Manager, Managed Service Provider, Privacy Notice Author, Privacy Notice Manager, Privacy Program Auditor, Vendorpedia Assessment Coordinator
View risk workflow setup	The View risk workflow setup permission has been removed from the following system roles: Compliance Manager, Data Access and Usage Manager, Enterprise Policy Manager, IT Risk Approver, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Program Auditor, Project Owner, Project Respondent, Project Viewer, Vendorpedia Assessment Coordinator
View basic fields for risks	The View basic fields for risks permission has been removed from the following system roles: Audit Manager, Compliance Manager, Privacy Notice Author, Privacy Notice Manager, Invited, Managed Service Provider, Privacy Program Auditor, Project Viewer, Project Respondent, Vendorpedia Assessment Coordinator, IT Risk Approver Note: Following ABAC Phase 1: Foundations, Attribute-Based Access Control (ABAC), users with the View basic fields for risks permission granted via role assignment can view standard risk attributes for all risks in their organization and below. Users assigned to specific risk records can view standard attributes only for those assigned risks. To view all risk attributes, users must also have the View advanced fields for risks permission. For organizations not using ABAC, users with the View basic fields for risks permission can view all risk fields within their organization and below. In this scenario, the View advanced fields for risks permission does not impact access. For more information, see Managing Attribute Based Access Control (ABAC) for Tech Risk & Compliance.
View advanced fields for risks	The View advanced fields for risks permission has been removed from the following system roles: Audit Manager, Compliance Manager, Privacy Notice Author, Privacy Notice Manager, Invited, Managed Service Provider, Privacy Program Auditor, Project Viewer, Project Respondent, Vendorpedia Assessment Coordinator, IT Risk Approver
Edit risk advanced fields	The Edit risk advanced fields permission has been removed from the Managed Service Provider and IT Risk Approver system roles.
Dedupe risk	The Dedupe risk permission has been removed from the platform. There is no impact to system or custom roles.
User can be risk owner	The User can be risk owner permission has been removed from the platform. There is no impact to system or custom roles.
Customize risk matrix size	The Customize risk matrix size permission has been removed from the platform. There is no impact to system or custom roles.
Edit risk matrix scores	The Edit risk matrix scores permission has been removed from the platform. There is no impact to system or custom roles.
View aggregated risk values	The View aggregated risk values permission has been removed from the platform. There is no impact to system or custom roles.
View risk levels	The View risk levels permission has been removed from the platform. There is no impact to system or custom roles.
Risk workflow stage trigger rules	The Risk workflow stage trigger rules permission has been removed from the platform. There is no impact to system or custom roles.
RMRequiringSystemAttributes	The RMRequiringSystemAttributes permission has been removed from the platform. There is no impact to system or custom roles.
Configure risk category translations	The Configure risk category translations permission has been removed from the platform. There is no impact to system or custom roles.

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
View access to shared risks	The View access to shared risks permission has been added to give users the ability to view shared risks.	This permission has been granted to the following system roles: IT Risk Manager, Site Admin, Tech Risk & Compliance Admin	This permission has not been granted to custom roles by default but can be configured.

Updated Permissions

The following permissions have been updated in the platform and have been granted to system and custom roles as defined below:

Permission name	Explanation of changes	System roles	Custom roles
Change risk workflow stage	The Change risk workflow stage permission has been updated and continues to control users' ability to change the selected workflow stage within a risk record.	This permission has been granted to the following system roles: AI Governance Manager, Assessments Manager, Data Access and Usage Manager, Data Governance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Managed Service Provider, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager	This permission has been granted to custom roles that were previously assigned the earlier Change risk workflow stage permission of the same name.
Create risk attachments	The Create risk attachments permission has been granted to additional system roles to better support risk management.	This permission has been additionally granted to the Audit manager and Vendorpedia assessment coordinator system roles.	No changes have been made to custom roles.

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name	Explanation of changes
Create risk score attributes	When the Create risk score attributes permission is added to the custom role, the View risk attribute setup and Create risk attribute setup permissions will be automatically added.
Edit required fields on risk tasks	When the Edit required fields on risk tasks permission is added to the custom role, the View risk tasks and Edit risk tasks permissions will be automatically added.

Unlinked Permissions

The following permissions have been unlinked and will no longer be added or removed automatically from the custom role during configuration as defined below.

Permission name	Explanation of changes
Create risk tasks	When the Create risk tasks permission is removed from the custom role, the Create risk task attachments and Create risk task comments permissions will no longer be automatically removed. Each permission is now standalone and must be explicitly removed from the custom role.
Edit risk attachments	When the Edit risk attachments permission is removed from the custom role, the Delete risk attachments permission will no longer be automatically removed. Each permission is now standalone and must be explicitly removed from the custom role.
View assessment details on risks	When the View assessment details on risks permission is removed from the custom role, the View assessment workflows permission will no longer be automatically removed. Each permission is now standalone and must be explicitly removed from the custom role.

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name	Explanation of changes
View risk comments	The View risk comments permission has been removed from the Policy owner role.
View risk history	The View risk history permission has been removed from the Invited user role.
View risk workflow setup	The View risk workflow setup permission has been removed from the following system roles: Compliance manager, Enterprise policy manager, IT risk approver, Policy owner, Privacy notice author, Privacy notice manager, Project owner, Project respondent, Project viewer, Vendorpedia assessment coordinator

For historical IT Risk Management permissions release notes from the Spring '26 season, see the Permissions Release Notes: IT Risk Management (Spring '26) article.

For historical IT Risk Management permissions release notes from the Summer '25, Fall '25, and Winter '26 seasons, see the Permissions Release Notes: IT Risk Management (Summer '25 - Winter '26) article.