Using Data Policy Templates

When creating data policies for your governance program, you can leverage our seeded policy templates designed for specific detection use cases. These policy templates come configured with conditional logic in order to detect violations based on common approved terms, tags, shared access, and more. OneTrust has also listed which global standards and frameworks are associated with the collection purposes. Plus, we have provided suggested severity levels to help your organization prioritize.

For information on creating custom data policies, see Creating & Managing Data Policies.

Available Policy Templates

Template Name

Description

Severity

Associated Standards/Frameworks

Included Conditions

Login credentials in plain text

Identify login credentials as passwords cannot be stored in clear text format anywhere (data sources, email, files, messages, etc.).

Critical

FFIEC (updated May 2017)

  • Approved Terms > Equals To Any Of:

    • Username

    • Account Password

Unencrypted credit card numbers

Identify any sensitive authentication/account information as account information cannot be stored after the transaction has taken place.

Critical

PCI DSS 4.0

  • Approved Terms > Equals To Any Of:

    • Credit Card

    • Credit History

    • Credit Card CVV

Restricted data with open access

Identify restricted documents that are shared or with open access.

High

  • PCI DSS 4.0

  • NIS2 (mapped to ISO 27001:2022)

  • ISO 27001:2022

  • ISO 27018:2019

  • Tags > Equals To Any Of: Restricted

    AND

  • Shared Access > Equals To Any Of:

    • Shared - Internal

    • Shared - External

    • Open Access

    • Shared

Sensitive data publicly accessible

Identify any sensitive information that has open/shared access.

High

  • US State Privacy Legislation Framework

  • Australian Privacy Principles (2014)

  • California Consumer Privacy Act (as ammended by CPRA 2023)

  • Approved Terms > Equals To Any Of: First Name, Last Name, Email Address, Full Name, Address, Drivers License, Phone Number, Passport Number, IP Address, Individual Taxpayer Identification Number, National Identification Number, Value Added Tax Number

    OR

  • Tags > Equals To Any Of: Sensitive Personal Data

  • Shared Access > Equals To Any Of: Shared - External, Open Access

Unencrypted financial data

Encryption needs to be applied for all financial data to ensure it is secure.

High

  • PCI DSS 4.0

  • FFIEC (updated May 2017)

  • Approved Terms > Equals To Any Of: Account Number, Account Balance, Account History, Account Password, Bank Account Information, Bank Statements, Debit Card Number

Legal Contracts - Retention

Certain legal contracts may have a prescribed retention period, based on an applicable statute, framework, or company policy. At the end of the applicable retention period, the data should be deleted from all systems. This template is built to identify legal contracts that are created more than 7 years ago. Please update the data policy condition value to match your retention schedule.

Medium

  • SOC 2

  • ISO 27001:2022

  • California Consumer Privacy Act (as amended by CPRA 2023)

  • GDPR Privacy (2018)

  • Tags > Equals To Any Of: Legal Contract

    AND

  • Last Modified Date > More Than: 7 years

Recruiting documents - Retention

Recruiting documents like resumes may have a prescribed retention period, based on an applicable statute, framework, or company policy. At the end of the applicable retention period, the data should be deleted from all systems. This template is built to identify resumes that are created more than 3 years ago. Please update the data policy condition value to match your retention schedule.

Medium

  • CCPA Compliance (2018)

  • SOC 2

  • GDPR Privacy (2018)

  • Tags > Equals To Any Of: Resume

    AND

  • Created Date > More Than: 3 years

To create data policies from templates

  1. On the Data Catalog menu, select Policy Manager > Templates.

    The Templates screen appears.

  2. Each policy template will include the use case as the title, a detailed description of what data type it intends to identify, and the framework(s) that OneTrust has associated with the template. Policy templates with multiple associated frameworks will be indicated with +(number of templates).

    Data Policies - Templates screen
  3. Click on a template to open the side pane to review at a glance what conditions are configured for this policy.

    The side pane to review what conditions are configured for the policy
  4. Locate your desired template and click Use Template.

    The Create Data Policy screen appears.


    Use template button on the data policy tile
  5. Some of the policy fields will be pre-populated, like name, description, and severity. You can update these at your discretion.
  6. Required: You will need to assign an existing user or user group as the data policy owner.
  7. The template will include conditions to support the given use case, which you can modify at your discretion. Use the Add Condition Block button to add more conditions and configure additional logic before this policy will be applied.

    Data policy condition block
  8. The Standards and Frameworks section will highlight which guidelines OneTrust has associated with this policy. Click Manage to add more frameworks to complement any additional conditions you may have configured.

    Standards and frameworks section
  9. Click the Add Custom Data Policy button.

    Create custom data policy
  10. Your data policy will be created, and you will be navigated to its Data Policy Details screen to review and manage violations, tasks, and scan jobs.

    Data policy details screen