IT & Security Risk Management - March 13, 2026 - 202603.1.0

Fixed

Resolved an issue that prevented objects related to a risk from being assigned to the correct organization.
Resolved an issue that allowed risks in Draft status to be imported into the Risk library.
Resolved an issue that caused framework imports to fail when required risk attributes were present.
Resolved an issue that prevented risk template creation when an imported framework referenced an archived risk category.
Resolved an issue that prevented the Risk register from displaying when using the browser’s back button.
Resolved an issue that caused issue attributes to display backend GUID values when used in formulas for custom risk attributes.
Resolved an issue that caused the Controls list screen to scroll to the top each time a control was selected.
Resolved an issue that prevented users from linking multiple assets to a control when using the Create control implementation relationships import template in Global Settings.
Resolved an issue that caused attachments to be uploaded multiple times to issue tasks that were either previously opened or actively open in the Tasks pane within IT Risk Management.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

New ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard that defines requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is intended for organizations that process personally identifiable information (PII) in the role of PII controller and/or PII processor, helping formalize privacy governance, accountability, and privacy risk management across the PII lifecycle.

The 2025 edition modernizes the standard and positions ISO/IEC 27701 as a standalone, certifiable privacy management system standard, making it suitable for organizations that want an auditable privacy program whether or not they already operate an ISO/IEC 27001-based information security management system.

We’ve made implementing ISO/IEC 27701:2025 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of ISO/IEC 27701:2025.

Important:

The ISO/IEC 27701:2025 framework will be available on the OneTrust Platform effective March 23, 2026.

For more information, see Supported Control Frameworks.

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.