IT & Security Risk Management - July 17, 2026 - 202607.1.0

General Availability

Delete Risk Library Records

Permanently delete records from the Risk library screen using the Context menu for each record. This enhancement allows you to delete risk library records, including records that were previously used to create risks, to maintain an accurate and up-to-date risk library.

For more information, see Using the Risk Library. This feature is related to the following idea: OT-I-10764.

Enhancements to IT Risk Management APIs

The following enhancements have been made to the IT Risk Management APIs:

• Added the associatedAttributeValueInformation object to include attribute option information in the Create Multiple Vulnerabilities, Update Vulnerabilities, Create Multiple Threats, and Update Threats APIs.

• Updated the Get List of Evidence Task Implementations API with the following enhancements:

  • Added the approver object to the response for evidence approver tracking.

  • Added the collectionStartMonth response parameter for collection period tracking.

  • Added the aiEvidenceAnalysisResult object to the response to return AI evidence analysis results with scoring and indicators.

• Updated the Update Control API to include the viewOnly response parameter for read-only control tracking.

• Updated the Create Multiple Vulnerabilities, Update Vulnerabilities, Create Multiple Threats, and Update Threats APIs to include the optionSelectionValue parameter within the attributes object of the request.

• Updated the Update Vulnerabilities and Update Threats APIs to include the displayLabel parameter in both the request and response for display labeling.

• Updated the Search Control Implementation Attributes API with the following enhancements:

  • Added the optionsByDomain object to the response. This object contains attribute domain option override information for domain-specific option overrides.

  • Added the formulaByDomain object to the response. This object contains attribute formula details for domain-specific formulas.

  • Added the displayResponseType response parameter for interface display type specification.

  • Added the optionListUrl, optionType, permissions, and applicationUrl parameters to the optionMetadata object of the response.

• Updated the fileDescription parameter to optional instead of required for the Attach Files to Control Implementation API.

• The max length of the description parameter value in the Create Control, Update Control, and Update Control Implementation APIs has increased from 3000 to 4000.

Fixed

• Resolved an issue that prevented Risk Owners and Risk Approvers from adding controls to a risk record.

• Resolved an issue that caused selected control implementations to become unselected when navigating between pages on the implementation selection screens.

• Resolved an issue that caused control implementations to disappear when editing records on the Control profile screen.

• Resolved an issue that prevented the Cancel and Apply buttons on the Control library filter pane from displaying correctly based on the browser zoom level.

• Resolved an issue that caused an error message to appear when assigning a custom Risk result value on the Risk details screen.

• Resolved an issue that prevented workflow rules from triggering when the required conditions were met.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

• Create task

• Send notification

• Update attribute

• Generate PDF report

• Launch assessment

Stage Settings:

• Required attributes and comments upon stage change

• Stage approval requirements

• Close stage

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: IT Risk Management (Summer '26 - Current). For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

New ISO 22301

ISO 22301:2019 is the international standard for Business Continuity Management Systems (BCMS). It provides organizations with a structured approach to establishing, implementing, maintaining, and continually improving business continuity capabilities to prepare for, respond to, and recover from disruptive incidents.

We’ve made implementing ISO 22301:2019 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance, and evidence tasks (including guidance) to help you establish, maintain, and improve a Business Continuity Management System aligned with ISO 22301 requirements.

Note:

The ISO 22301:2019 framework will be available on the OneTrust Platform on July 31, 2026. This framework requires a content license to view copyrighted content, which is separate from the license covering OneTrust's software. For more information, see About Licensed Frameworks.

For more information, see Supported Control Frameworks.

Things to Know

Net-new accounts now have a singleRegulatory/compliancerisk category available. The duplicateRegulatory / complianceoption is no longer available for selection.

Note:

Existing customers will still have access to both attributes.

Assess riskquestion types now support theClosure noteandReason for closureattributes when configuring questions in theTemplate builder.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.