IT & Security Risk Management - June 26, 2026 - 202606.2.0

Fixed

  • Resolved an issue that recorded incorrect user details on the Activity tab of the Risk details screen for deleted risk records.

  • Resolved an issue that prevented the Add control button from responding when adding controls within risks in Third-party risk management assessments.

  • Resolved an issue that prevented users from filtering controls using custom attributes on the Controls tab of the Inventory details screen.

  • Resolved an issue that prevented custom reports from displaying the correct control effectiveness data.

  • Resolved an issue that prevented users with the Data mapping automation manager role moving risk workflow stages in bulk.

  • Resolved an issue that prevented associated controls from appearing on the Controls tab of the Inventory details screen when risks were created using risk templates.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

  • Create task

  • Send notification

  • Update attribute

  • Generate PDF report

  • Launch assessment

Stage Settings:

  • Required attributes and comments upon stage change

  • Stage approval requirements

  • Close stage

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Standard / Control Framework Changes

New Oklahoma Consumer Data Privacy Act Framework Added

The Oklahoma Consumer Data Privacy Act (OKCDPA), effective January 1, 2027, establishes a comprehensive data privacy framework and mandates transparency and consumer rights regarding personal data collected by for-profit entities conducting business in Oklahoma.

We’ve made implementing the OKCDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance, and evidence tasks (including guidance) to help you in meeting the requirements of the OKCDPA.

For more information, see Supported Control Frameworks.

New NIS2 Germany Framework Added

Germany’s NIS2 Implementation Act, effective December 6, 2025, transposes the EU NIS2 Directive into German law and strengthens cybersecurity requirements for essential, important, and critical entities operating in Germany. The framework introduces obligations relating to cybersecurity risk management, incident reporting, governance oversight, registration with the Federal Office for Information Security (BSI), and supply chain security.

We’ve made implementing NIS2 Germany easier by offering the framework on our platform and ensuring users can benefit from its overlap with other cybersecurity and information security frameworks that exist on our platform. The platform contains survey questions to help define scope and bring in all relevant controls, control implementation guidance, and evidence tasks, including guidance, to support compliance with Germany’s NIS2 requirements.

Note:

The NIS2 Germany Framework will be available on the OneTrust platform on July 3rd, 2026.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

When adding a new standard or framework, existing business objectives shared across the new framework and the tenant are updated to the latest name and description (if applicable) while preserving the original organization value.

The character limit for numerical - single select options for risk attributes has been increased to 400 characters.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.