OneTrust GRC Reviews

I use OneTrust specifically for incident management. For my company, I helped to create the incident management program that we currently use, particularly with gathering the information and sending out assessments to different vendors to collect information for further research and discovery. 

I also use the platform for processing privacy requests that our company receives. OneTrust is just one of the platforms we use, and we receive privacy requests through multiple channels, such as email and occasionally, phone calls. 

However, any kind of request we receive is still filtered through OneTrust using their platform to track the request and process it all the way through from the initial notification to the end when it's finally processed. We send out notifications and collect information, all done through OneTrust.

OneTrust has streamlined the process of sending notifications to clients, consumers, and stakeholders. It allows tracking of all information within the platform itself, so there is no need to go outside of OneTrust to gather or find information.

I used OneTrust GRC for a holistic view of our compliance program, automation of everything from policy creation, edits, reviews, annual acknowledgment by staff, third-party risk management program, reporting deliverables, metrics, and incident management. We also had an anonymous reporting hotline.

OneTrust GRC helped us achieve IPO status at several different organizations because of the visibility it provides in our compliance program. 

It also contributed significantly to successfully achieving our SOC 2 Type 2 during the first iteration.

One of the most beneficial features of the product has been its cloud-based IT and vendor risk management tools, along with built-in templates for GDPR and ISO compliance. These tools streamline risk assessments across jurisdictions, which is crucial for multinational operations.

They could enhance the product's functionalities like audit management and ensure consistency across modules. 

It was used to manage IT and control risks, specifically around network infrastructure and particular assets.

As a solution for IT risks, it is a very good product. I think it's structured in a way that makes it good to track IT-specific risks and controls.

On the privacy front, we used the solution to meet many GDPR requirements, like maintaining a record of processing. We used the OneTrust data processing component or module to keep all the processing activity records. On the GRC front, we used the risk management and audit modules to manage risk assessments and IT audits within the organization.

OneTrust GRC is a SaaS (software as a service) platform. As an implementer, you don't need to do many technical configurations. Instead, you do the functional configurations, like setting up the rulesets to ensure they adapt to the rules within the organization. The solution was quite valuable because it included almost all the worldwide privacy regulations, such as GDPR and CCPA. You can configure the functional rules against the entity or country where the client may be located.

The organization I worked with operated in 35 African countries, with an office in France. So, GDPR was relevant, and these 35 countries where they have data protection laws were also relevant. The most valuable feature of the solution is that it already has visibility about all the data protection regulations or other cybersecurity regulations related to several countries.

I primarily use OneTrust GRC for GRC, which involves vendor management aspects. It helps ascertain levels of compliance concerning vendors.

OneTrust GRC simplifies the deployment of our policies, making them easy to achieve. It has also made policies deploy with ease, aligning with intended organizational goals.

We use the solution for internal governance risk, compliance projects, and tracking internal risk management projects.

Clients might have to adhere to federal regulations for US health organizations and US government organizations and follow ISO 27001 standards. Additionally, compliance requirements vary for UK cyber issues and European automobile standards. Despite the controls remaining the same across different standards, duplicate requests to the business may arise when addressing each compliance perspective. To streamline this process, the GRC tool enables mapping to consolidate requests, reducing redundancy. Furthermore, workflows are automated based on inputs from stakeholders. Responses are analyzed to flag risks for review, and follow-up actions are automated based on review comments, eliminating the need for manual email correspondence.

We are using OneTrust to implement data privacy within our organization.

We have data from Jira regarding addiction related to Europe as well as California. Additionally, we have data related to the Indian Data Protection Bill. Therefore, GDPR compliance is highly beneficial. The CPA also benefits from this. Data subjects are granted specific rights, known as DSR, making DSI crucial. With OneTrust, communication with data subjects is streamlined, allowing them to make requests, which we then process and fulfill using Alpha OneTrust. If a supervisory authority requests documentation from our company, we prepare Article 30 documents.