IT Risk Management - October 16, 2026 - 202610.1.0

Tables and table functionalities on the Options tab of the Attribute details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, seeTable Enhancements Across the OneTrust PlatformandTable Enhancements User Guide.

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

These enhancements will be available for the following IT Risk Management workflows:

• Business Objectives

  Note: Business Objectives object is still under Public Preview.

• Controls

• Issues

• Risks

  Note: Risks workflow adoption is still under Public Preview.

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following IT Risk Management objects:

• Business Objectives

  Note: Business Objectives object is still under Public Preview.

• Controls

• Risks

  Note: Risks workflow adoption is still under Public Preview.

• Threats

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

For more information, see Managing Risk Workflows.

Create Projects from the Inventory menu to track risks across your organization with a consolidated view of associated risks in the Risks tab. This feature brings together direct and indirect risks from linked inventories, assessments, and template rules into a single aggregated project-level risk score to help teams gain a more holistic understanding of risks.

For more information, see Managing Projects in IT Risk Management.

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of assigning a value of zero when using the formula builder. This setting helps to define how blank inputs are interpreted in the formula builder throughout the OneTrust Platform for all net new formulas.

For more information, see Configuring Formulas using the Formula Attribute.

The Alabama Personal Data Protection Act (APDPA), effective May 1, 2027, establishes a comprehensive framework for data privacy, ensuring that the personal data of Alabama residents is managed with care and transparency. This legislation grants consumers substantial rights over their personal data while defining clear requirements for businesses relating to privacy notices, consumer rights requests, targeted advertising, the sale of personal data, profiling, sensitive data, data minimization, processor obligations, and data security. We've made implementing the APDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of the APDPA.

For more information, see Supported Control Frameworks.