IT & Security Risk Management - December 5, 2025 - 202512.1.0

Fixed

Resolved an issue that prevented users from re-adding a deleted framework to the Framework library after its controls were moved to a different framework.
Resolved an issue that prevented custom controls from appearing during risk creation when more than two controls were added to the new risk record.
Resolved an issue that caused incorrect control implementation details to appear on the Control details screen after changing the control’s workflow stage.
Resolved an issue that caused disabled control attributes to appear when creating a new control.
Users can no longer manage risk control, threat, and vulnerability categories when the View category manager for controls, threats, and vulnerabilities permission is disabled.
Users can now access comments in which they were mentioned directly from an email notification link without encountering an error.
Resolved an issue where risks added through an assessment did not save data entered in the Treatment field.
Resolved an issue that prevented highlighted text in the Description field from saving when configuring a workflow stage rule to create a task.

Existing Public Preview Features

AI Evidence Analysis

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility: Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.
Relationship Management: Add risks to existing control implementations or associate additional controls directly to risks.
Merge & Split Controls: Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Standard / Framework Changes

New Indiana Consumer Data Privacy Act Framework Added

The Indiana Consumer Data Privacy Act (ICDPA), effective January 1, 2026, establishes a comprehensive framework for data privacy, ensuring that personal data of Indiana residents is managed with care and transparency. This legislation grants consumers substantial rights over their data while defining clear requirements for businesses to uphold transparency and responsible data management.

We’ve made implementing the ICDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of the ICDPA.

For more information, see Supported Control Frameworks.

California Consumer Privacy Act (CCPA as amended) 2025 Framework Updated

Framework content updated to align with the latest CPPA regulations, approved by the California Office of Administrative Law in September 2025, related to automated decision-making technology (ADMT), privacy risk assessments, and cybersecurity audits. The regulations introduce new requirements for businesses to assess and document risks associated with their data processing and cybersecurity practices, incorporate enhanced notices, and extend consumer choice mechanisms to individuals impacted by ADMT.

The updated California Consumer Privacy Act (CCPA, as amended) (2025) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Permissions

The following permissions have been added to give users the ability to access and view content available within tabs on theRisk detailsscreen:

Risk comments tab
Risk controls tab
Risk workflow and approval tab
Risk history tab
Risk related tab

These permissions have been granted to custom roles with the Access risks permission and the following system roles:

AI Governance manager
Assessments manager
Audit manager
Compliance manager
Data access and usage manager
Data governance manager
Data mapping manager
ERM manager
ESG Manager
Enterprise policy manager
Privacy notice author
Privacy notice manager
Exchange manager
IT risk manager
Incidents manager
Invited user
Managed service provider
Privacy officer
Privacy program auditor
Project owner
Project respondent
Project viewer
TPDD compliance manager
TPDD enhanced due diligence requester
TPDD admin
Tech risk & compliance admin
Vendor manager
Vendorpedia assessment coordinator
IT risk approver
Site admin

New Permissions

Risk assessments tab
Risk issues tab
Risk activity tab
Risk related risks tab

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

AI Governance manager
Assessments manager
Audit manager
Compliance manager
Data access and usage manager
Data governance manager
Data mapping manager
ERM manager
ESG Manager
Enterprise policy manager
Privacy notice author
Privacy notice manager
Exchange manager
IT risk manager
Incidents manager
Invited user
Managed service provider
Privacy officer
Privacy program auditor
Project owner
Project respondent
Project viewer
TPDD compliance manager
TPDD enhanced due diligence requester
TPDD admin
Tech risk & compliance admin
Vendor manager
Vendorpedia assessment coordinator
IT risk approver
Site admin

These permissions have been granted to custom roles that were previously assigned the following combination of permissions:

View risk assessment list
Issue view related
Audit access
ERM risk hierarchy view
Relate risks view

News & Release Notes