Third-Party Risk Management - October 16, 2026 - 202610.1.0

General Availability

Table Enhancements for Third-Party Risk Management
Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Contracts screen

  • Attachments tab of the Contract details screen

  • Related tab of the Contract details screen

  • Engagements screen

  • Engagements tab of the Inventory Details screen

  • The following tabs on the Engagement overview screen:

    • Assessments

    • Contracts

    • Documents

    • Risks

    • Related

    • Personal

    • Issues

For more information, seeTable Enhancements Across the OneTrust PlatformandTable Enhancements User Guide.

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following Third-Party Risk Management objects:

  • Contracts

  • Engagements

Fixed

  • Resolved an issue that caused vendor change events to be published and downstream workflow rules to be reevaluated when formula evaluations resulted in no persisted value changes.

  • Resolved an issue that prevented the External contact name and External contact email attributes from displaying on the Engagements tab of the Vendor details screen.

  • Resolved an issue that prevented users from relating controls to vendor records on the Vendor details screen.

  • Resolved an issue where the Vendor filter appeared in advanced filters on a vendor's Engagement tab and returned incorrect results.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Third-Party Management.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Standard / Control Framework Changes

New Alabama Personal Data Protection Act Framework Added

The Alabama Personal Data Protection Act (APDPA), effective May 1, 2027, establishes a comprehensive framework for data privacy, ensuring that the personal data of Alabama residents is managed with care and transparency. This legislation grants consumers substantial rights over their personal data while defining clear requirements for businesses relating to privacy notices, consumer rights requests, targeted advertising, the sale of personal data, profiling, sensitive data, data minimization, processor obligations, and data security. We've made implementing the APDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of the APDPA.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

  • The record-level Attachments tab has been consolidated and renamed to Documents across all inventory types.

  • Breadcrumb navigation on the Issue details screen now dynamically reflects the user's entry path from either the Vendor details or Engagement details screen.

  • DORA attributes are now locked and non-editable when a vendor record is overridden in hierarchy settings to maintain data integrity at the local level.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.