IT & Security Risk Management - November 14, 2025 - 202511.1.0

Fixed

  • Resolved an issue that caused risk workflow stages to advance after one approver completed the review, even when the Set approval requirements setting was configured to require all approvers.

  • Resolved an issue that prevented users from creating risks from the Risk library.

  • Resolved an issue that caused the Bypass other approvers setting to appear on the Review modal when only one approver was assigned.

  • The following fields are now correctly translated to Portuguese for Insights Dashboards:

    • Current stage approvers

    • Last updated by

    • Last update date

    • Related

    • Related object GUID

    • Related object name

    • Related object type

  • Resolved an issue that prevented the Add controls to inventory screen from loading when adding controls to a vendor record.

  • Resolved an issue that prevented fields updated on the Risk details screen from appearing in exported reports.

  • Resolved an issue that caused the View library control details link to appear twice on a single assessment question.

  • Resolved an issue that caused control formulas to calculate incorrectly when two formula attributes were configured, and one attribute referenced the other.

  • Resolved an issue that prevented custom control implementations from being added to inventories based on new control profile rules.

  • The Get List of Control Implementations by Entity API responses now include option names for numerical single select attributes when retrieving a list of control implementations for processing activities.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Standard / Framework Changes

Connecticut Data Privacy Act (CTDPA) Framework Updated

Framework content updated to align with amendments from Senate Bill 1295 which lowered the threshold for applicability from businesses processing data of 100,000 consumers to 35,000 and expanding the scope to include the sale of consumer data without limitation. The updated Connecticut Data Privacy Act (CTDPA) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.