Third-Party Risk Management - March 13, 2026 - 202603.1.0

New Public Preview Features

Separated Files Export for DORA ROI Report

Generate the register of information (ROI) report as a compressed file containing separate .csv files for each tab of the report. This enhancement allows you to submit unique files to specific regulators instead of sending the single, multi-tabbed export.

For more information, see Step 3: Generate and Export the DORA Report.

Fixed

  • Resolved an issue where values for the Type of Contractual Arrangement attribute, regardless of language choice, were not populated on the Contracts list screen and not included in the export despite being present in the Contract details.

  • Resolved an issue that caused PDF reports with large layouts to fail when they were triggered from workflows.

  • Resolved an issue that prevented expected results from appearing when applying the Engagement Aggregate Inherent and Aggregate Risk Level filters on the Engagements list screen.

Standard / Control Framework Changes

New ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard that defines requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is intended for organizations that process personally identifiable information (PII) in the role of PII controller and/or PII processor, helping formalize privacy governance, accountability, and privacy risk management across the PII lifecycle.

The 2025 edition modernizes the standard and positions ISO/IEC 27701 as a standalone, certifiable privacy management system standard, making it suitable for organizations that want an auditable privacy program whether or not they already operate an ISO/IEC 27001-based information security management system.

We’ve made implementing ISO/IEC 27701:2025 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of ISO/IEC 27701:2025.

Important:

The ISO/IEC 27701:2025 framework will be available on the OneTrust Platform effective March 23, 2026.

For more information, see Supported Control Frameworks.

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

The DORA tab 07.01 now includes all engagements related to a critical or important function entity, regardless of the material or full value on the engagement's reliance attribute.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.