Managing Control Implementations

What is a control implementation? 

A control implementation is the process of designing and putting into action specific safeguards, procedures, or processes to protect an organization from risks. This involves configuring, customizing, and deploying controls to meet security and regulatory requirements, ensuring they are effectively integrated and documented.

In today’s complex compliance environment, organizations face the challenge of managing a vast number of controls across various frameworks, inventories, and business units. Without the right approach, this can lead to redundant efforts, increased risk of errors, and a fragmented view of your control environment.

How can shared controls help manage control implementations? 

OneTrust’s shared controls functionality is designed to address this challenge, empowering teams to reduce duplication, increase efficiency, and align control management with how organizations operate in the real world.

Historically, applying a control library record to multiple objects in OneTrust has resulted in a new control implementation each time. Over time, this leads to hundreds of duplicate controls for what is, in practice, a single policy or process. Not only is this inefficient, but it also creates complexity in reporting, auditing, and ensuring consistency across compliance efforts. For example, a single organization-wide change management policy might apply to processes, systems, and business entities, but under the traditional setup, it must be documented separately for each one.

With shared controls, you can align multiple inventories to a single control implementation, significantly reducing redundancy and effort. This approach reflects how organizations naturally manage controls, centrally and consistently, yet flexibly enough to address different scopes and entities.

Where can shared controls be leveraged? 

The following areas in OneTrust support shared controls. 

Shared Control Functionality

Description

Control Management

  • Create shared controls via the Implementations tab of the Control Library details screen 

  • Create shared controls using the Inventory Details screen. 

  • Add inventory or risk relationships to shared controls. 

  • Split shared control implementations into individual implementations. 

  • Configure control profile rules to link existing control implementations to inventories based on defined conditions.

Reporting 

  • Create control implementation column reports that include relationships on shared controls. 

Risk Management

  • Create shared controls when creating net new risks via the Risk Register.

Bulk Import 

The following areas in OneTrust do not currently support shared controls. However, support may be considered in the future. 

  • Leverage the inventory hierarchy to add inventories to shared controls. 

  • Public APIs 

  • Assessments 

  • Custom Integrations 

Shared Control Business Logic

This section outlines the business logic that governs shared control implementations. It covers how shared controls operate, how evidence is shared across controls, and the rules for merging and splitting both control implementations and their associated evidence.

Shared control implementations

  • A control implementation can be linked to multiple inventories (assets, entities, vendors, processing activities) or risks.

  • An inventory can only be the primary inventory on a single implementation of a control library record.

  • The primary inventory on a control implementation cannot be changed after it is created. If a different primary inventory is needed on the control implementation, you can create a new, separate control implementation with the correct primary inventory and the original control implementation can be merged into it. 

  • An inventory can be linked to more than one control implementation of the same control library record as a related inventory.

  • An evidence task implementation will inherit the same primary inventory as its linked control implementation. It will also have relationships to all other related inventory records. 

  • You can add or remove related inventories from the control implementation. These changes will be reflected on the associated evidence task implementations. 

Sharing evidence across controls

  • Given a Control Library and Evidence Library relationship, control implementations will share an evidence task implementation if the primary inventory is the same.

  • By default, evidence is shared where possible. Users can choose to create a separate evidence task implementation later, if needed.

  • The shared evidence task will include all related inventories from the control implementations in which it is linked. 

  • Adding or removing related inventories (outside of the primary inventory) on control implementations will flow down to the shared evidence task(s).

  • Inventories cannot be added or removed directly on an evidence task implementation.

Merging and splitting control and evidence implementations

See Merging Control Implementations and Evidence Tasks and Splitting Control Implementations and Evidence Tasks for more information.

  • Implementations of the same Control Library record can be merged into one.

    • The primary inventory of the control implementation will be retained moving forward, along with its attribute values.

    • Linked records (e.g. issues, risks, related inventories, etc.), tasks, and attachments will be copied into the merged control implementation.

    • Assessments, activity logs, workflow stages, and comments will not be merged.

    • The merged control implementations will be removed.

  • Evidence task implementations can be merged within the merge control implementation flow.

    • The primary inventory of the linked control implementation being merged will dictate which evidence task implementations will be retains and merged into.

    • The attribute values of the merged evidence task will remain (e.g. assignee).

    • Evidence collected on each evidence implementation will be copied into the merged evidence task.

    • Some evidence tasks cannot be merged if they are shared across multiple control from different frameworks. In this case separate evidence task implementations will remain.

  • Evidence implementations can be merged or split later within a separate merge evidence implementation flow.

    • Keep evidence task implementations merged on a shared control to collect evidence centrally for the shared control. For example, a privacy policy applies to all regional entities and just needs to be collected once.

    • Split evidence task implementations on a shared control to collect evidence separately for each inventory on the shared control. For example, each asset-application owner is responsible for collecting proof of password configuration.

  • A shared control implementation can be split into individual implementations of the control, one for each inventory on the shared control implementation. Evidence will be split into separate implementations and linked to its respective control implementation record.

    • Attachments / evidence collected on the original control implementation will not be copied to each separate implementation.

    • The attribute values (e.g. assignee) of the split control (and evidence) could be optionally copied into the separate implementations.

Creating Controls in the Control Library

This section outlines two approaches for creating controls using the control library: shared controls and separate control implementations. Follow the steps outlined in the sections below to create controls using each approach.

To create shared controls using the Control Library

Follow the steps outlined below to create shared controls on specific control library records. These controls are implemented once and mapped across one or more inventories. 

  1. On the IT & Security Risk Management menu, select Libraries > Control Library.
    The Control library screen appears.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

  2. Open the control in which you want to add a shared control.
    The Control Library Details screen appears.
    Note:

    To bulk create shared control implementations using the Control Library, you can select one or more controls on the Control library list screen and click the Create implementation icon. The Create control implementation modal appears and you can proceed with step 4 below. 

    Leveraging this flow allows you to bulk create shared (or separate) control implementations for each library control selected. The same primary inventory and related inventories will be used for each implementation created for each library control. 

  3. Select the Implementations tab to view any active implementations for the control. 
  4. Click the Create Implementation button.
    The Create Control Implementation modal appears.

  5. Select Shared control implementation that includes all inventories selected. 
  6. Click the Next button.
    The Select primary inventory step appears.

  7. Choose the primary record that will be the source of the control. You can use the search field to search for an inventory by name or ID. 
  8. Click the Next button.
    The Add related inventory step appears.

  9. Choose one or more related inventories to the implementation in order to share details and evidence. This step is optional, you can proceed without adding related inventories.
    Note:

    When a user logs into a sub-organization and creates a new control implementation from the control library, the inventories visible are limited to their organization and below. The user will be unable to create and manage controls on parent or sibling records.

  10. Click the Next button.
    The Add Details step appears.

    Field
    Description
    Control Owner(s)

    Select the control owner(s) responsible for the implementation.

    Control Approver(s)

    Select the control approver(s) responsible for approving the implementation.

    Deadline

    Enter the date by which the control must be addressed.

    Maturity

    Select the maturity of the control. 

    Effectiveness

    Select the effectiveness of the control. 

    Notes 

    Enter any notes or things to know that will be added to the implementation details. 

    Show More Details 

    Expand this drop-down to add custom attribute details. 

  11. Complete the fields as needed to create the implementation. The details added here will be used as the attribute values on the implementation during creation. 
  12. Click the Create implementation button to create the control implementation and navigate to the Implementations tab of the Control Library Details screen. 
    Note:

    You can click the Implementation ID link to navigate to the implementation on the Control Details screen. Related controls and evidence tasks will be added to the corresponding tabs. 

To create separate control implementations using the Control Library

Follow the steps outlined below to create separate control implementations for each inventory selected. Separate control implementations are individual control records created for each framework or requirement, even when the control activities are similar. Use separate implementations when different frameworks require unique evidence, language, or ownership, or when the control is applied differently across business units. 

  1. On the IT & Security Risk Management menu, select Libraries > Control Library.
    The Control library screen appears.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

  2. Open the control in which you want to add a shared control.
    The Control Library Details screen appears.
    Note:

    To bulk create separate control implementations using the Control Library, you can select one or more controls on the Control library list screen and click the Create implementation icon. The Create control implementation modal appears and you can proceed with step 4 below. 

    Leveraging this flow allows you to bulk create shared (or separate) control implementations for each library control selected. The same primary inventory and related inventories will be used for each implementation created for each library control.

  3. Select the Implementations tab to view any active implementations for the control. 
  4. Click the Create Implementation button.
    The Create Control Implementation modal appears.

  5. Select Separate implementations for each inventory selected. 
  6. Click the Next button.
    The Select inventories screen appears.

  7. Select one or more inventories. A separate control implementation will be created for each inventory selected. 
    Note:

    When a user logs into a sub-organization and creates a new control implementation from the control library, the inventories visible are limited to their organization and below. The user will be unable to create and manage controls on parent or sibling records.

  8. Click the Create implementation button to the control implementations and navigate to the Implementations tab of the Control Library Details screen. 
    Note:

    Click the Implementation ID link to navigate to the implementation on the Control Details screen. Related controls and evidence tasks will be added to the corresponding tabs. 

Creating Controls in Inventory Records

This section outlines how to add controls directly within an inventory record using different methods. You’ll learn how to add multiple shared controls at once, add a single shared control, and link an existing control implementation to an inventory. Each method supports different use cases depending on how controls are managed across frameworks.

To add multiple shared controls to an inventory record 

  1. On the IT & Security Risk Management menu, select an inventory type.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

    The corresponding inventory list screen appears.

  2. Create a new record or open an existing record to access the Inventory Details screen. 
  3. Select the Controls tab.
  4. Click the Add Controls button.
    The Add library controls step appears.

  5. Select one or more controls that will be implemented on this inventory or click the Create library control button to create a custom control. You can use the search field to search for an inventory by name or ID.
    Note:

    If you select only one control, you will be asked if you prefer to select an existing control implementation or create a new control implementation. 

  6. Click the Next button.
    The Add control implementations step appears.

    Field
    Description
    Control Owner(s)

    Select the control owner(s) responsible for the implementation.

    Control Approver(s)

    Select the control approver(s) responsible for approving the implementation.

    Deadline

    Enter the date by which the control must be addressed.

    Maturity

    Select the maturity of the control. 

    Effectiveness

    Select the effectiveness of the control. 

    Notes 

    Enter any notes or things to know that will be added to the implementation details. 

    Show More Details 

    Expand this drop-down to add custom attribute details. 

  7. Complete the fields as needed, this step is optional. The details added here will be used as the attribute values on the implementation based on the control library records selected. 
  8. Scroll down to the Add related inventory section. 


  9. Select one or more related inventories to create a shared control implementation based on the control library records selected. This step is optional. 
    Note:

    When a user logs into a sub-organization and creates a new control implementation from the control library, the inventories visible are limited to their organization and below. The user will be unable to create and manage controls on parent or sibling records.

  10. Click the Next button.

    The Review step appears.

  11. Review the control details to view all objects impacted by the new relationships. 
  12. Click the Add Implementations button to create the control implementation and navigate to the Controls tab of the Inventory Details screen.
    Note:

    Click the Implementation ID link to navigate to the implementation on the Control Details screen to view inherited to evidence tasks.

To add a single shared control to an inventory record 

  1. On the IT & Security Risk Management menu, select an inventory type.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

    The corresponding inventory list screen appears.

  2. Create a new record or open an existing record to access the Inventory Details screen. 
  3. Select the Controls tab.
  4. Click the Add Controls button.
    The Add library controls step appears.

  5. Select a single control that will be implemented on this inventory or click the Create library control button to create a custom control. You can use the search field to search for an inventory by name or ID. 
  6. Click the Next button.
    The Choose controls approach step appears.

  7. Choose Select existing control implementations. This option will present you with a list of existing implementations of the library control selected in the earlier step. You can review the implementations, who they're assigned to, and what other inventories are related to them. 
  8. Click the Next button.

    The Add control implementations step appears.

  9. Select the existing control implementation(s) you would like to link a single control.

    The Select control implementations section only appears if you select the Select existing control implementations option.

  10. Click the Next button.

    The Review control details step appears.

  11. Review the control details to view all objects impacted by the new relationships.
  12. Click the Add Implementations button to create the control implementation and navigate to the Controls tab of the Inventory Details screen. and inherited to evidence tasks. 
    Note:

    Click the Implementation ID link to navigate to the implementation on the Control Details screen. 

To add an existing control implementation to an inventory

  1. On the IT & Security Risk Management menu, select an inventory type.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

    The corresponding inventory list screen appears.

  2. Create a new record or open an existing record to access the Inventory Details screen. 
  3. Select the Controls tab.
  4. Click the Add Controls button.
    The Add library controls step appears.

  5. Select a single control that will be implemented on this inventory or click the Create library control button to create a custom control. You can use the search field to search for an inventory by name or ID. 
  6. Click the Next button.

    The Choose controls approach step appears.

  7. Choose Create a new control implementation. 
  8. Click the Next button.

    The Add control implementations step appears.

  9. Complete the Control implementation details section. This step is optional and only appears if you select the Create a new control implementation option. 


  10. Select one or more related inventories to create a share control implementation. This step is optional and only appears if you select the Create a new control implementation option. 


  11. Click the Next button.

    The Review control details step appears.

  12. Review the control details to view all objects impacted by the new relationships.
  13. Click the Add Implementations button to create the control implementation and navigate to the Controls tab of the Inventory Details screen and inherited to evidence tasks. 
    Note:

    Click the Implementation ID link to navigate to the implementation on the Control Details screen. 

Managing Shared Controls

To add related relationships to shared controls 

  1. On the IT & Security Risk Management menu, select Libraries > Control Library.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

    The Control library screen appears.

  2. Open the control in which you want to add a relationship to the shared control implementation.

    The Control Library Details screen appears.

  3. Select the Implementations tab to view any active implementations for the control. 
  4. Click the Implementation ID link to open the Control Details screen. 
  5. Select the Inventories tab. 
  6. Click the Add Relationship button.
    The Create Relationship pane appears.

    Field
    Description
    Relationship Type

    Select the relationship type. 

    Target Object Type

    Select the type of object you are relating to the control implementation.

    Target Object Record

    Select the specific object you are relating to the control. 

  7. Select the relationship type, target object type, and target object record. 
  8. Click the Save button. This can be done in bulk. For more information, see Managing Control Implementations in Bulk. 

To add existing risks to shared controls 

  1. On the IT & Security Risk Management menu, select Libraries > Control Library.
    Note:

    Shared Controls Access

    Currently, you can access the Shared Controls feature from IT & Security Risk Management and Compliance Automation.

    The Control library screen appears.

  2. Open the control in which you want to add a relationship to the shared control implementation.

    The Control Library Details screen appears.

  3. Select the Implementations tab to view any active implementations for the control. 
  4. Click the Implementation ID link to open the Control Details screen. 
  5. Select the Risks tab. 
  6. Click the Add Relationship button.
    The Create Relationship pane appears.

    Field
    Description
    Relationship Type

    Select the relationship type. 

    Target Object Type

    Select Risks.

    Target Object Record

    Select the specific risk you are relating to the control. 

  7. Select the relationship type, target object type, and target object record. 
  8. Click the Save button. This can be done in bulk. For more information, see Managing Control Implementations in Bulk. 

Use Cases

Test Once, Comply Many

Meet multiple compliance requirements with a single control to reduce duplicate efforts.

Cross-Inventory Application

Apply one control across multiple assets, processes, or business units without recreating the control. 

Streamlined Evidence Gathering

Centralize evidence for faster audits and assessments. 

Dynamic Scope Management

Easily adjust the scope of a control as your business needs evolve. 

Simplified Reporting

Get a unified view of control coverage without sifting through redundant records.