IT & Security Risk Management - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented users from deactivating score and formula-type attributes in the Attribute manager.

  • Resolved an issue that prevented users from adding related objects to risks on the Related tab of the Risk details screen.

  • Resolved an issue that prevented option values for Risk level attributes from appearing when exporting PDF and column reports.

  • Resolved an issue that caused risk comment fields to display HTML tags instead of rendered text when exporting PDF and column reports.

  • Resolved an issue that prevented rich text in control implementation guidance from appearing when exporting PDF and column reports.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Standard / Control Framework Changes

NIST SP 800-53 Updated from Release 5.1.1 to Release 5.2

NIST has issued Release 5.2 of Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, updating the framework to strengthen the security and reliability of software updates and patches. According to NIST, this revision was made in response to Executive Order 14306 and focuses on software and system resiliency by design, developer testing, update deployment and management, and software integrity and validation.

We have updated our NIST SP 800-53 framework on the OneTrust platform from Release 5.1.1 to Release 5.2 to reflect these changes. The update includes newly added controls and control enhancements, revisions to certain existing control requirements, and updates to control guidance section that provide additional implementation examples.

For more information, see Supported Control Frameworks.

India Digital Personal Data Protection Act (DPDPA) 2025 Rules Updated

Framework content has been updated to align with the Digital Data Protection Rules, 2025, issued by India’s Ministry of Electronics and Information Technology (MeitY), which operationalize the Digital Personal Data Protection Act, 2023. The Rules introduce detailed, enforceable requirements across notice and consent, data principal rights, breach notification and consent manager obligations.

Customers can review and accept these updates through the Framework Updates functionality within the Standards & Frameworks library.

Important:

The updated India Digital Personal Data Protection Act (DPDPA) (2025) framework will be available on the OneTrust platform on April 6, 2026.

For more information, see Supported Control Frameworks.

Things to Know

TheView Risk Approverpermission no longer controls visibility of theRisk approvercolumn on theRisk registerscreen.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to IT & Security Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.