OneTrust GRC & Security Assurance Cloud vs. Osano

OneTrust provides a repeatable and defined process for vendor assessments but should be adapted to your organization. OneTrust functions well for a centralized document repository. The pricing of modules and what modules are required for workflows to function fully should be better defined. Automated assessments can wind up in spam filters and should be communicated outside of the platform prior to sending to the vendor.

Incentivized

Osano is great for a full suite of websites to manage. Agencies and companies with many websites to attend to are a good match for Osano's capabilities. Websites that run a lot of cookies and scripts (aka anything WordPress) are good candidates for this service. It is also useful for managing user data, although I do not leverage that feature in my own use.

Incentivized

• Module wise implementation.
• Very reasonable price structure.
• Easy and speedy to implement.
• Product roadmap.

• Improves the product regularly
• Easy to manage the cookies and scripts
• "Blocklist" feature is handy for spamy scripts still lurking on old sites.

Incentivized

• Documentation chasing for assessments is not as automated or hands-off as demos made it seem.
• Getting custom risk matrix set up required professional onboarding.
• Platform is less than intuitive.
• Pricing is module dependent and demos do not highlight which module is included in which workflow.

Incentivized

• [I] would like to have more details on what the scripts/cookies are for (it isn't always clear).
• The step-by-step process of classifying scripts and saving vs. publishing is clunky and unclear.
• Some [of the] naming conventions aren't intuitive - compliance mode, strict, passive, etc.

Incentivized

During the assessment, we found that OneTrust is easier to use, set up, and administer. it has a quick ROI and value for business. The OneTrust product support and roadmap are far more competitive in comparison to TrustArc. OneTrust is specialized in GRC including Data Privacy and Cookie compliance, where Archer is good in Enterprise Risk management.

I haven't used any other products like Osano before.

Incentivized

• More uniform vendor assessments.
• Defensible numeric metrics reflecting risk.
• Centralized document repository for audit proofs.

Incentivized

• + [We] haven't had any compliance issues.
• - When adding new scripts to the website, I (me, specifically) need to remember that I'll need to classify them before the scripts will work. [It is] not streamlined for other people on my team.
• + [There are] generally little-to-no issues, which is good.

Incentivized