Third-Party Risk Management - April 2, 2026 - 202604.1.0

General Availability

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Question library screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Enhancements to Contracts and Engagements APIs

The following changes have been made to the Contracts and Engagements APIs:

• Added the type, sourceId, and sourceName response parameters to contract attachment responses, allowing users to identify the attachment type and source details for contract attachments. These parameters are now returned by the following APIs:

  • Get Contract API

  • Search Contracts API

  • Create Contract API

  • Update Contract API

• Added the displayResponseType response parameter to attribute responses for engagement and contract schemas. This parameter indicates how the attribute is rendered in the UI and is now returned by the Get Engagement Schema API and Get Contract Schema API.

Fixed

• Resolved an issue that prevented questionnaire reports from sending via stage rules.

• Resolved an issue that prevented vendor workflows from advancing to the next stage when triggered by the Assessment Auto-Approved trigger.

• Resolved an issue that caused attribute values for Type of ICT Services in the DORA Report of Information export from consistently displaying expected rows for the combination of functions.

• Resolved an issue that prevented saved views of the Contracts list screen from capturing the accurate filter results.

New Public Preview Features

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Existing Public Preview Features

Separated Files Export for DORA ROI Report

Generate the register of information (ROI) report as a compressed file containing separate .csv files for each tab of the report. This enhancement allows you to submit unique files to specific regulators instead of sending the single, multi-tabbed export.

For more information, see Step 3: Generate and Export the DORA Report.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

NIST SP 800-53 Updated from Release 5.1.1 to Release 5.2

NIST has issued Release 5.2 of Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, updating the framework to strengthen the security and reliability of software updates and patches. According to NIST, this revision was made in response to Executive Order 14306 and focuses on software and system resiliency by design, developer testing, update deployment and management, and software integrity and validation.

We have updated our NIST SP 800-53 framework on the OneTrust platform from Release 5.1.1 to Release 5.2 to reflect these changes. The update includes newly added controls and control enhancements, revisions to certain existing control requirements, and updates to control guidance section that provide additional implementation examples.

For more information, see Supported Control Frameworks.

India Digital Personal Data Protection Act (DPDPA) 2025 Rules Updated

Framework content has been updated to align with the Digital Data Protection Rules, 2025, issued by India’s Ministry of Electronics and Information Technology (MeitY), which operationalize the Digital Personal Data Protection Act, 2023. The Rules introduce detailed, enforceable requirements across notice and consent, data principal rights, breach notification and consent manager obligations.

Customers can review and accept these updates through the Framework Updates functionality within the Standards & Frameworks library.

Important:

The updated India Digital Personal Data Protection Act (DPDPA) (2025) framework will be available on the OneTrust platform on April 6, 2026.

For more information, see Supported Control Frameworks.

Things to Know

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Third-Party Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.