IT & Security Risk Management - January 30, 2026 - 202601.2.0

Fixed

  • Resolved an issue that prevented workflow rules from allowing Operator values when using a formula-type attribute as the condition.

  • Resolved an issue that prevented the Risk hierarchy list screen from exporting to Excel.

  • Resolved an issue that prevented users with the View risk activity permission from viewing finding activities on the Activity tab of the Risk details screen.

  • Resolved an issue where users with only the View risk levels permission could view the Settings navigation menu due to an incorrect linkage with the Risk V2 Setting permission.

  • Resolved an issue that prevented control workflows from launching assessments from stage rules when a control entered the designated stage for the first time.

  • Resolved an issue that caused users to receive duplicate evidence collection notifications.

  • Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Permissions

Assessments – Invited User Security Enhancements

OneTrust is implementing new permission controls for Invited Users and Project Respondents to align front-end access controls with back-end API behaviors. This update ensures that low-privilege users cannot access metadata or assessment content outside their assigned scope. A new permission will be available for customers who need to restore the broader access level previously granted to their Invited Users.

No action is required unless you want Invited Users to retain their previous access. If you want Invited Users to retain their previous access, you can assign the newly introduced Advanced assessment metadata permission manually to a custom copy of the Invited User role after the change goes live in OneTrust 202601.2.0. Those users with the Invited User role will then need to be reassigned to the custom invited user role with the new permission.

For more information, see Assessments – Invited User Security Enhancements, Invited Users FAQ, and Project Respondents FAQ. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Framework Changes

New China Personal Information Protection Law Framework Added

The China Personal Information Protection Law, effective November 1, 2021, establishes a comprehensive framework for the processing of personal information in China, setting clear requirements for transparency, lawful basis, and accountability. The law grants individuals robust rights over their personal information while imposing specific obligations on organizations—particularly for sensitive personal information, cross-border transfers, and the use of processors—to ensure responsible handling throughout the data lifecycle.

We’ve made implementing the PIPL easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of the PIPL.

Important:

The China Personal Information Protection Law will be available on the OneTrust platform effective February 6, 2026.

For more information, see Supported Control Frameworks.

New Databricks AI Governance and Security Framework Added

The Databricks AI Governance & Security Framework provides a structured approach to managing AI risks across the full AI lifecycle—spanning data, models, infrastructure, and operations—while embedding governance and security controls directly into the AI stack.

We’ve simplified adoption of the Databricks AI Governance & Security Framework by offering a unified framework on the our platform, combining both the Databricks AI Governance Framework and the Databricks AI Security Framework into a single, integrated control set. The framework includes controls, implementation guidance, evidence tasks, policies, and risks aligned to Databricks’ governance and security expectations, enabling organizations to operationalize AI governance and security in a scalable way.

Important:

The Databricks AI Governance & Security Framework will be available on the OneTrust platform effective Feb 15, 2026.

For more information, see Supported Control Frameworks.

Things to Know

Download all attachments from an assessment by clicking theDownload allbutton on theAttachmentspane. This enhancement streamlines attachment downloading and prevents you from downloading multiple attachments individually.

Remove workflow approvers when an assessment is copied or reassessed by enabling theRemove workflow approvers when reassessing or duplicatingsetting on theTemplate detailsscreen. This enhancement allows you to configure workflow approvers when reassessing or copying assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.