IT & Security Risk Management - June 5, 2026 - 202606.1.0

Fixed

  • Resolved an issue that caused the Update library evidence tasks bulk import template to fail with a generic import error.

  • Resolved an issue that caused exported Issue register views to include unfiltered data instead of the selected saved view results.

  • Resolved an issue that caused control source values to display inconsistently as either the Risk name or Risk ID.

  • Resolved an issue that prevented users from adding control approvers to control implementations.

  • Resolved an issue that prevented documents uploaded to issue records from retaining the original file type.

  • Resolved an issue that caused mismatched values for control effectiveness attributes between the user interface and exported column reports.

  • Resolved an issue that prevented users from adding or opening control implementations on a legal entity record.

  • Resolved an issue that prevented users from saving updates to formulas for existing custom attributes.

  • Resolved an issue that caused incorrect risk score names to appear when hovering over risk score attributes.

  • Resolved an issue that prevented associated controls from appearing on the Controls tab of an asset when risks were flagged using risk templates.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

  • Create task

  • Send notification

  • Update attribute

  • Generate PDF report

  • Launch assessment

Stage Settings:

  • Required attributes and comments upon stage change

  • Stage approval requirements

For more information, see Managing Risk Workflows.

Mark Risk Workflow Stage as Closed

Leverage the new Close stage setting in Risk workflows to set a specific stage at which the record will be closed. This enhancement allows you to close risks as part of your workflow transitions at a desired point in the workflow rather than advancing to completed. By default, the record will be closed in the last workflow stage.

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Standard / Control Framework Changes

Virginia Consumer Data Protection Act (VCDPA) Framework Updated

Framework content updated to align with the latest amendment to the Virginia Consumer Data Protection Act (VCDPA), signed into law on April 13, 2026, which introduces new restrictions on the sale of precise geolocation data. The updated Virginia Consumer Data Protection Act (VCDPA) framework is now available on Compliance Automation, ITRM, and TPRM products.

For more information, see Supported Control Frameworks.

Utah Consumer Privacy Act (UCPA) Framework Updated

Framework content updated to align with the latest amendment to the Utah Consumer Privacy Act (UCPA), enacted through HB 418 (2025), which introduces a new consumer right to request correction of inaccurate personal data. The updated Utah Consumer Privacy Act (UCPA) framework will be available on Compliance Automation, ITRM, and TPRM products on June 4, 2026.

For more information, see Supported Control Frameworks.

Things to Know

Category-based score evaluations for engagement and inventory attributes are now supported in formula-based risk score calculations. The aggregated risk score and category scores will be displayed on theRiskstab of the correspondingInventory detailsscreen.

TheReason for closureattribute can now be selected as a condition to trigger risk automation rules.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.