IT & Security Risk Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Risk Register Table Enhancements

Tables and table functionalities on the Risk register screen across all products have been upgraded to improve usability, accessibility, and customization. Updates include resizable columns, more records per view, simplified row actions, and a more consistent user experience. The default Risk register view has also been updated to display columns in the following order:

  • ID

  • Risk name

  • Description

  • Residual risk score

  • Risk owners

  • Stage

Note:

If needed, you can create a custom view and add these columns previously included in the default view: ID, Risk Name, Risk Template, Description, Residual Risk Score, Organization, Source, Risk Owners, Type, Controls, Stage, Treatment Status, and Inherent Risk Score.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

User Groups as Respondents in Launch Assessment Actions

Assign user groups as respondents in the Launch Assessment action for supported object workflows, and send assignment notifications to the selected group. This makes it easier to assign assessments to groups of users without adding each user individually.

Impacted object workflows:

  • Controls

addendum: This release note was updated on August 14, 2026 to remove Issues, Objectives, and Risk workflow support for User Groups as Respondents in Launch Assessment actions.
Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Fixed

  • Resolved an issue that prevented invited users assigned as Risk owners from submitting exception requests.

  • Resolved an issue that prevented users from adding controls to risks within TPRM assessments.

  • addendum: The release note pertaining to the Risk Approver field continuously loading was removed on August 14, 2026.
  • addendum: The release note pertaining to the Processing Activity Status column displaying blank values was removed on August 14, 2026.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

  • The Approval rejected workflow rule event trigger has been added and allows you to change the workflow or current workflow stage when a workflow stage is rejected.

  • Workflow stage rules can now be configured to send notifications using system or custom email templates. Notifications can also be configured manually.

  • The Reason for Closure attribute can now be used as a condition when configuring Stage rules and Workflow rules. The Reason for closure and Closure note attributes have been added to the system-generated Treatment details attribute group.

For more information, see Managing Risk Workflows.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

  • Create task

  • Send notification

  • Update attribute

  • Generate PDF report

  • Launch assessment

Stage Settings:

  • Required attributes and comments upon stage change

  • Stage approval requirements

  • Close stage

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Things to Know

Control owners and Control approvers can now view related controls, issues, and evidence task details to perform required actions, even if they do not have the corresponding view access.

TheDelete controloption on theControlstab of theInventory detailsscreen is now only available on the primary inventory record.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.