IT & Security Risk Management - October 27, 2025 - 202510.2.0 (Fall Release)

General Availability

Seeded Risk Content

Access pre-seeded risk and business objective content for all available standards and frameworks on the Standards and Frameworks screen. This enhancement provides ready-to-use library content to enhance risk management capabilities by reducing implementation time and providing teams a head start when adopting new standards.

Note:

In the OneTrust 202509.1.0 release, pre-seeded risk category options have been added to support packaged risk and business objective content. For more information, see Adding Risk Categories.

For more information, see Supported Control Frameworks.

Filter Risk Library Content

Filter the Risk Library screen to quickly locate Risk Templates that match the defined criteria. This enhancement streamlines navigation and helps you efficiently find relevant risk content. Available filters include:

  • Category

  • Organization

  • Status

  • Standard / Framework

Formula Attribute Option Enhancements

Create formulas in the formula builder using the IF/THEN statement available for attribute options. This enhancement allows Risk Managers and Site Admins to easily configure automated risk score calculations using attribute options from single select or multi select attributes to simplify the formula setup and improve accuracy.

For more information, see Configuring Formulas using the Formula Attribute.

Insights IT & Security Risk Dashboard V2

An enhanced Insights Dashboard is now available for IT & Security Risk Management. The IT Security Risk Default V2 dashboard offers new visualizations, charts, and tabs, as well as an updated color palette, typography, and user flow. This new version provides you with an easier way to understand the current insights of your organization, helping you present critical data points to key stakeholders with confidence.

Note:

The IT Risk Management Insights Dashboard will remain available in the platform at this time, but it will be removed in a future release.

For more information, see Insights IT Security Risk Default V2 Dashboard.

@Mentions for Control Implementations, Issues, Objectives, and Risks

Mention users directly within comments to draw their attention or request their input, triggering both an in-app notification and email notification. @Mention functionality is now supported in comments on the following objects:

  • Control Implementations

  • Issues

  • Objectives

  • Risks

This enhancement improves collaboration and ensures faster, more targeted communication across your team.

Screen Header Enhancements

 

OneTrust is introducing updated screen headers to select screens across the platform to improve consistency and usability. These enhancements can include:

  • Standardized screen titles and new in-app descriptions across applicable areas of the platform, providing clearer context and quick guidance to help users understand each screen’s purpose and available actions.

  • Consolidated action buttons into a Context menu on select screens to reduce clutter and streamline navigation.

  • Renamed buttons on select screens to make actions more immediately understandable and easier to follow.

These enhancements make it easier for users to orient themselves, understand workflows, and complete tasks with greater confidence and efficiency.

Note:

While some screens already feature updated headers, not all enhancements are applied universally and may vary depending on the screen's functionality and context. Enhancements to additional screens may also become visible across the next several releases.

For more information, see Screen Header Enhancements Across the OneTrust Platform.

Fixed

  • Resolved an issue that prevented control profiles from generating custom controls when conditions were triggered.

  • Resolved an issue that prevented users from changing risk workflow stages when the workflow had four stages or less.

New Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Existing Public Preview Features

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Standard / Framework Changes

New EU Cyber Resilience Act Framework Added

The EU Cyber Resilience Act, adopted on July 11, 2024, and entering into force on January 20, 2025, introduces harmonized cybersecurity requirements for products with digital elements (PDEs) placed on the EU market. The regulation establishes obligations for manufacturers, importers, and distributors to ensure that products are designed, developed, and maintained with an appropriate level of cybersecurity throughout their entire lifecycle.

We’ve simplified implementation by making the EU Cyber Resilience Act Framework available on our platform—complete with policies, controls, implementation guidance, and evidence tasks tailored to meet the Act’s essential cybersecurity requirements. The framework helps organizations prepare for compliance ahead of the application date of January 20, 2027, when most obligations become enforceable.

Note:

The EU Cyber Resilience Act will be available on the OneTrust platform effective October 31, 2025.

For more information, see Supported Control Frameworks.

Things to Know

The following system attributes can now be deactivated in theAttribute manager:

  • Children Risks

  • Hierarchy Level

  • Orphan

  • Parent

TheID (GUID)column is now included in the related object list of evidence task column reports. You can no longer retrieve GUIDs by exporting the Control library.

TheID (GUID)column is now included in the related objects list of control implementation column reports.

The description for theEnable automated control inheritancesetting inGlobal Settingshas been updated to clarify its impact when enabled. The description now includes details on how it affects the risk import template, control implementations import template, and assessment rules.

For more information, see Risk, Controls & Evidence Settings.

Microsoft Word and Excel files uploaded during evidence collection will now be added to the Web Application Open Platform Interface (WOPI) service to render evidence previews.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Permissions

TheManage control categoriespermission has been split into theView category manager for controls, threats and vulnerabilities,Add categories in category manager for controls, threats and vulnerabilities, andEdit categories in category manager for controls, threats and vulnerabilitiespermissions.

TheAdd control implementationandBulk create control implementationspermissions have been removed from the Project owner role.

New Permissions

  • AI Governance manager

  • Assessments manager

  • Audit manager

  • Compliance manager

  • Data Governance manager

  • Data Mapping Automation manager

  • ERM manager

  • ESG manager

  • Enterprise policy manager

  • Exchange manager

  • IT risk manager

  • Incidents manager

  • Maturity & Planning Manager

  • Policy owner

  • Privacy notice author

  • Privacy notice manager

  • Privacy officer

  • Program Benchmarking manager

  • Site admin

  • Tech Risk & Compliance Admin

  • Vendor manager

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

  • Controls library edit control

  • Add evidence tasks

  • Edit evidence task library