IT & Security Risk Management - September 4, 2026 - 202609.1.0

General Availability

New Business Objective Reports

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens using the Risk PDF report and Business objective PDF report templates. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Using Reports Gallery Templates.

Workflow List Table Experience Updates

Workflow list tables have been enhanced to deliver a more consistent and intuitive table experience. This update includes:

  • Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

  • A column picker that gives users more control over which columns are displayed in the table

  • A repositioned context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

These enhancements will be reflected on the workflow list tables for the following objects:

  • Business objectives

  • Controls

  • Issues

Assign Tasks Using User-Type Attributes

Assign tasks with the Create Task stage rule action to either system users or eligible single-select, user-type attributes. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior. This enhancement will be available for the following workflows:

  • Business objectives

  • Controls

Send Notifications to User Groups

Select a group in the Assignee field of a Send Notification rule action. This helps route workflow notifications to all relevant team members across standard workflows. This enhancement will be available for the following workflows:

  • Business objectives

  • Controls

  • Risks

Fixed

  • Resolved an issue that prevented bulk actions, such as launching assessments or deleting risks, from working on the Risk register.

  • Resolved an issue that caused the filter pane to display incorrectly in the Select risks to assess modal when a small number of records were returned.

  • Resolved an issue that caused a persistent loading spinner to appear when attempting to update multiple risk approvers on the Details tab of an assessment.

  • Resolved an issue that prevented risks assigned to owners using custom workflows from displaying in the Assigned actions table on the Homepage.

  • Resolved an issue that allowed users in a lower organization to successfully create risks for a higher organization via the Create risks bulk import template.

  • Resolved an issue that prevented users from bulk assigning owners to control implementations that used custom workflows.

  • Resolved an issue that prevented users from saving control implementations when using the Add other option for single-select or multi-select attributes.

  • Resolved an issue that caused the Status column for related processing activities to display as blank in Control implementation column reports.

  • addendum: The release note pertaining to deleting operators or functions was removed on September 11, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow list screen

Column sorting, search, activation, archival

Workflow rule actions

Advance to stageandChange workflow

Workflow rule event triggers

Attribute updatedandApproval rejected

Routing rules

Workflow assignment upon object creation

Workflow stage rule actions

Create tasks, send notifications manually or using system and custom templates, update attributes, generate PDF reports, and launch assessments.

Stage detail settings

Set required attributes for this stage, stage approval requirements, allow comments when moving to this stage, and close stage.

TheReason for Closureattribute can now be used as a condition when configuringStage rulesandWorkflow rules.

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Standard / Control Framework Changes

California Consumer Privacy Act (CCPA as amended) (2025) Framework Updated

Framework content has been expanded to include all requirements associated with Article 9 of the CPPA regulations governing annual cybersecurity audits. Every requirement within Article 9 is now represented by an associated control in the framework, providing comprehensive coverage of the regulation's cybersecurity audit obligations.

For more information, see Supported Control Frameworks.

Things to Know

TheDelete recordsbutton is now called theRecycle binbutton on theAssets,Processing activities,Entities, andVendorsscreens. This enhancement better reflects the increased functionality available via theRecycle binscreen.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.