Item: OneTrust Tech Risk & Compliance
Rating: 7
Author: Verified User

Overall Satisfaction with OneTrust GRC & Security Assurance Cloud

Use Cases and Deployment Scope

We utilize OneTrust for 3rd party risk management and to dictate the frequency of review. Using a risk matrix new vendors brought into the platform are assigned a risk level based on data sensitivity and the inherent risk of the vendor. We then use OneTrust to automate information gathering and to schedule reassessments based on risk category.

Pros and Cons

Pros

Centralized repository for documentation of vendor risk.
Allows for customizable risk metrics to define inherent risk.
Repeatable, defined process for vendor assessments.

Cons

Documentation chasing for assessments is not as automated or hands-off as demos made it seem.
Getting custom risk matrix set up required professional onboarding.
Platform is less than intuitive.
Pricing is module dependent and demos do not highlight which module is included in which workflow.

Most Important Features

Centralized document repository.
Repeatable processes.
Easily defensible logic for risk based decisions.

Return on Investment

More uniform vendor assessments.
Defensible numeric metrics reflecting risk.
Centralized document repository for audit proofs.

Alternatives Considered

BitSight Security Ratings and SecurityScorecard

OneTrust is more focused on providing an assessment platform than a vendor risk monitoring platform. This difference is why we chose OneTrust. For some, this will be a failure of the product. However, if you take the time to define risk for your organization based on the sensitivity of the data and the inherent risks of a vendor based on infrastructure you will create a unique and understandable metric for risk according to your organization. This adaptability is the strongest feature of OneTrust.

Key Insights

Do you think OneTrust Tech Risk & Compliance delivers good value for the price?

Yes

Are you happy with OneTrust Tech Risk & Compliance's feature set?

Yes

Did OneTrust Tech Risk & Compliance live up to sales and marketing promises?

Did implementation of OneTrust Tech Risk & Compliance go as expected?

Would you buy OneTrust Tech Risk & Compliance again?

Yes

Other Software Used

Recorded Future, Splunk Enterprise Security (ES), Microsoft Defender for Endpoint

Likelihood to Recommend

OneTrust provides a repeatable and defined process for vendor assessments but should be adapted to your organization. OneTrust functions well for a centralized document repository. The pricing of modules and what modules are required for workflows to function fully should be better defined. Automated assessments can wind up in spam filters and should be communicated outside of the platform prior to sending to the vendor.

Comments

Please log in to join the conversation

A trusty platform if you provide the logic