IT & Security Risk Management - February 20, 2026 - 202602.1.0 (Winter Release)

General Availability

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register. This feature is related to the following idea: CNTRL-I-46.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues. This feature is related to the following idea: GCIA-I-1166.

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Fixed

  • Resolved an issue that caused users to be incorrectly routed to the Assessment list screen when opening a linked assessment.

  • Resolved an issue that caused assessment rules to create duplicate risks.

  • Resolved an issue that prevented users from advancing the risk workflow when the stage contained required attributes.

  • Resolved an issue that caused the number of related controls displayed on the Risks tab of the Inventory details screen to be incorrect.

  • Resolved an issue that caused the child risks to display on the old parent risk instead of appearing on the newly assigned parent risk.

  • Resolved an issue that prevented risk details from updating with the correct parent risk hierarchy level.

  • Resolved an issue that caused an invalid risk message to display after the associated risk was deleted.

  • The Control implementations change status permission now correctly controls access to the Change status button, and the Control change workflow permission correctly controls visibility of the Change workflow button, both available on the Control details screen.

  • Resolved an issue that caused deleted controls to appear on the reassessment PDF report.

  • Resolved an issue that caused evidence collection notifications to incorrectly send both before and after the collection due date.

  • Resolved an issue that prevented custom attributes from appearing on the Controls tab of the Initiative details screen.

  • Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for issues, objectives, controls, and risks. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Things to Know

TheRisk Domaincolumn has been added to theAttributesfolder for theInventory Risk Domain Aggregate Risk LevelsandRisk datatables. These attributes enable domain-based risk aggregation to support more accurate cross-domain risk analysis and governance insights.

Use of the same attribute in multiple actions is now supported in Objective workflow stage rules. Previously once an attribute was used in an action within a stage rule, it was no longer available for other stage rules.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to IT & Security Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.