OneTrust GRC Reviews & Pricing

Key Features

• IT and Security Risk: Incorporate enterprise data to calculate risk scores and set acceptable risk tolerance thresholds. Maintain up-to-date risk libraries and automatically flag potential threats. Continuously monitor risk detection and remediation tasks and external compliance activities. 
  • Data Collection: Create a centralized digital inventory of IT assets, data flows and business processes. Perform automated assessments to collect new risk data and pre-populate relevant fields. Leverage the open API framework to integrate external systems and collaborate on risk data across mapped fields. 
  • Integrations: Use conditional logic-based triggers to automate data exchange across multiple systems. Choose from over 500 integration options. 
  • Control Management: Risk owners can use a built-in control library or create new controls. Automatically link controls to frameworks, standards and best practices through AI. Perform continual self-assessment and business scans to determine control maturity and efficacy. 
  • Risk Quantification: Perform qualitative and quantitative risk assessments with a preconfigured risk matrix. Adjust values and range adequately and document risk exposure. Equip risk assessment technology with risk values to auto-flag issues and anomalies. 
  • Regulation and Policy Framework: The built-in regulatory intelligence platform, Onetrust DataGuidance, automatically provides updates to security and regulatory standards. Access all the leading risk, threat and control libraries and compliance frameworks, including ISO, SOC 2, GDPR, NIST and more. 
  • Workflow: Use preconfigured workflows to designate clear first-line response measures, automate task assignment and analyze control effectiveness. Maintain a transparent documentation procedure for risk processing, exception handling and more. 
  • Performance Tracking: Run reports on KRIs, aggregated risk score, risk timeline history and more. Data lineage mapping tracks the flow of data through critical processes and IT assets. Use an intuitive dashboard to visualize risk appetite, reports and audits, and create heatmaps. 
• Enterprise and Operational Risk: Get visibility into internal and external threats. Categorically organize different operational risks to build a scalable threat response system. Use automation to execute risk remediation action items and run reports to periodically benchmark system performance. 
  • Risk Mapping: Map out relationships between assets, opportunities, risks and threats to determine a risk appetite and tolerance threshold. Prepare a risk methodology in sync with enterprise risk standards. Directly link the centralized risk register to the dashboard. 
  • Scalable Defense: Prepare smart questionnaires to predict and identify risks in real time. Standardize the tracking of KRIs across multiple applications and integrate GRC functions and notifications throughout the system. Streamline task assignments with configurable workflows and role-based functions. 
  • Automation: Stay on top of non-compliance issues with automated control mapping from OneTrust Athena AI. Notify stakeholders about potentially threatening risk scores and automatically trigger risk mitigation responses based on system updates. Perform regular risk assessments to eliminate blind spots. 
  • Risk Reporting: Run reports to measure risk across multiple domains and simulate best and worst-case scenarios for registered potential vulnerabilities. Create unique risk formulations and calculate the potential impact of disasters and disruptions on business operations. 
• Audit Management: Use a centralized configuration management database (CMDB) to standardize data across risk registers and inventory records. Offers guided task workflows to schedule regular internal audits and update risk values. Benchmark performance against industry standards. 
  • Documentation: Provides automated assessments to record granular details of control readiness, internal and external system integrations, deficient controls, risk exposure, and remediation plans. Link internal controls to leading industry standards and attach evidence to support findings and summary explanations. 
  • Control Testing: Test control design, track status, test effectiveness, flag issues and calculate risk based on risk exposure and control status. Adopt a hybrid approach by mapping custom controls to both industry standards and the company’s internal policy. 
  • Execution and Response: Prepare detailed workpapers for execution and documentation of GRC auditing procedures. Outline risk remediation plans to fortify new, existing and modified controls. Use a secure portal for task-related communication and attach evidentiary documents to findings reports. 
• Third-Party Risk Management: The OneTrust Vendorpedia module provides ad-hoc functionalities for identification, analysis and remediation of third-party risks. Manage the entire vendor lifecycle with assessment templates, automated controls identification and questionnaire builders. Leverage AI-based intelligence to implement risk mitigation workflows. Prepare business continuity plans and perform due diligence on associated third parties. 
  • Risk and Performance Insights: Identify and prioritize third-party vendors with the highest risk exposure. Find vendors that fail to comply with SLAs and underperform. Regularly monitor security, regulatory and vendor landscape for possible breaches and trigger response workflows and notifications. Benchmark performance and record findings for reference during audits. 
  • Vendor Assessments: Verify security certifications information and compliance with industry standards and regulatory frameworks, including SIG, NIST, ISO and more. 
  • Research and Intelligence: Risk owners can use AI-based intelligence and regulatory research to predict performance issues and adapt quickly to regulatory changes. OneTrust Athena AI and OneTrust DataGuidance include access to over 500 purpose-built plugins configured for robotic process automation. 
  • Integration Marketplace: Integrate third-party apps with built-in plugins. 
  • Vendor Response Portal: Provide vendors with a dedicated portal to answer questionnaires and collaborate with representatives. 
• Incident Management: Predict, identify and resolve workplace incidents with tried and tested response measures. Create a response playbook for active reference and notify stakeholders of relevant details. Maintain compliance with appropriate regulatory bodies. 
  • Response Playbook: Record best-practice response strategies with custom workflows in compliance with regulatory requirements. Identify anomalies and violations in data elements. 
  • Incident Scope: Analyze workplace incidents and data breaches to recognize impacted jurisdictions and regulatory bodies. 
  • Business Activities: Create a catalog of workplace incidents with relevant context and business perspective. Identify processes and controls associated with individual incidents. 
  • Notification Guidance: Find violated guidelines, calculate potential fallout on critical operations and notify relevant stakeholders. 
  • Documentation and Execution: Streamline response times with tried and tested templates. Cross-reference several regulatory standards to identify notification requirements, remediation tasks and resolution timelines. Maintain detailed documentation of all processes with an audit trail. 
• Policy Management: Implement a single source of truth for company policies with centralized policy development. Create new documentation or choose from various built-in corporate and security policies. Access automated workflows to review, approve and renew policies. Create tailored roles for stakeholders involved in different phases of the procedure and send automated status updates. 
  • Information Collaboration: Maintain detailed records of revisions, summary updates and archived policies with complete version history through the policy portal. 
  • Compliance Alignment: Sync company policies with business scope, structure hierarchy and risk profile. Link policy performance to control effectiveness. 
  • Policy Adoption: Identify out-of-date, underperforming and expiring policies. Track policy attestations for individuals, stakeholders and business units and analyze them for trends and improvement opportunities. 
• Data Discovery: Use AI to discover and categorize private and non-personal information in compliance with global privacy regulations. 
  • Data Classification: Leverage machine learning to label data with ad-hoc and custom tags. Capture information with deep scans and record both business and technical metadata. 
  • Data Coverage: Discover and classify all data types in cloud, on-premise and legacy systems. Parse unstructured file shares, SaaS apps, Big Data storage and structured databases in any format, including CSV, text, PDF, Zip and images. Supports data discovery at scale and in-built OCR capabilities. 
  • Data Protection: Protect at-risk data with policy controls, encryption, masking and access controls. Map out privacy regulations, such as GDPR, CCPA and LGPD. Create comprehensive data inventories and record all processing activities. During a data breach, automatically create article 30 records, notify relevant authorities, enforce retention policies and link necessary consent records. 
  • AI-Based Entity Resolution: Discover relationships between unrelated data and link personal data to the associated individual. Create identity graphs, view confidence levels of proposed matches and correct false positives. 
  • Automated Privacy Rights: AI-based privacy rights request workflows automate the discovery and detection of confidential information. Use the dashboard to add exceptions, redact certain sections and run subject-facing data reports. 

Suite Support