IT & Security Risk Management - May 15, 2026 - 202605.1.0 (Spring Release)

General Availability

Control Enhancements

Improve control management and oversight across the OneTrust Platform with improvements to reporting, relationship coverage, and workflow behavior. Enhancements include:

Support for assess issue question types on assessments in Dashboards and Reporting.
Support for Engagements as related objects in issue column reports.
Support for stage filters in custom control workflows.
Ability to use AI Systems as target object types when creating control relationships.
Ability to update the Organization field on Control library records.

These enhancements provide clearer insights into control performance, improved visibility into relationships across objects, and a more reliable experience when managing controls at scale.

Fixed

Resolved an issue that prevented Maturity attribute options from displaying the correct translation when linking controls to an inventory.
Resolved an issue that caused errors when mapping single‑select value lists during risk‑to‑issue conversion when disabled attribute options were present.
Resolved an issue that prevented aggregate risk scores from calculating for engagements, which blocked workflow rules from progressing.
Resolved an issue that prevented invited users from submitting assessments when adding links to existing entities.
Resolved an issue that prevented Risk library records from reflecting Description field translations when modified in Global Settings.
Resolved an issue that prevented Category options from appearing for engagements when configuring formulas using formula attributes.
Resolved an issue that caused risks deleted prior to assessment archival to reappear in the Risk register after the assessment was restored.
Resolved an issue that prevented edited notification subjects from being applied when sending notifications from Business objective workflow stage rules.
Resolved an issue that caused risk fields to reload while editing a risk.
Resolved an issue that caused the inherent risk level to be set to null when moving assessment templates between tenants.

New Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

Create task
Send notification
Update attribute
Generate PDF report
Launch assessment

Stage Settings:

Required attributes and comments upon stage change
Stage approval requirements

For more information, see Managing Risk Workflows.

Mark Risk Workflow Stage as Closed

Leverage the new Close stage setting in Risk workflows to set a specific stage at which the record will be closed. This enhancement allows you to close risks as part of your workflow transitions at a desired point in the workflow rather than advancing to completed. By default, the record will be closed in the last workflow stage.

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

For users with access to IT Risk Management, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

Saudi Arabia Personal Data Protection Law (PDPL) Framework Added

The Saudi Arabia Personal Data Protection Law (PDPL) establishes a comprehensive legal framework governing the processing of personal data within the Kingdom of Saudi Arabia. It applies to organizations that process personal data of individuals residing in Saudi Arabia, regardless of where the processing entity is located, and introduces requirements focused on transparency, purpose limitation, data subject rights, and accountability.

We’ve made implementing PDPL easy by offering the framework on our platform and ensuring users can leverage overlap with other privacy frameworks available in the platform. The platform includes survey questions to help define scope, bringing together relevant policies, controls, control implementation guidance, and evidence tasks (including guidance) to support compliance with PDPL requirements.

For more information, see Supported Control Frameworks.

South Korea AI Basic Act Framework Added

South Korea’s Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust establishes a national legal framework for AI governance, transparency, safety, and trust. Effective January 22, 2026 as a matter of law, it introduces core obligations relating to AI transparency, safety measures for certain advanced AI systems, responsibilities for providers of high-impact AI, human rights impact assessment, and the appointment of a local representative for certain foreign AI business operators. It also includes separate obligations for synthetic content disclosure and public-sector procurement prioritization in certain cases.

We’ve streamlined South Korea AI Basic Act compliance by offering the framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned to the law’s requirements for AI business operators, including those providing high-impact AI and certain foreign AI business operators. The framework is designed to help organizations operationalize governance, transparency, risk management, and accountability for AI systems in scope under the Act.