Vendor System Attributes Guide

A vendor inventory is a record of any external, third-party provider of goods or services involved in your data collection processes.

OneTrust features out-of-the-box attributes that you can activate to gather specific information on your organization's vendors. These attributes will display on a vendor record's Inventory Details screen and can be updated manually, via assessment response, using bulk update, or through an API.

Attributes in bold are required when creating a vendor inventory record. Attributes identified as editable can be edited directly on the Inventory Details screen.

The following attributes are available for use with vendor inventory records:


Attribute	Description	Type	Editable
Aggregate Risk Level	How likely is it that this vendor could expose personal information? To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring. Note: This attribute determines what risk level displays for the vendor.	Single-Select	No
Aggregate Risk Score	Overall risk score associated with the vendor. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring. Note: This attribute determines what risk score displays for the vendor.	Text	No
Aggregated Contract Cost	This is the sum of costs for all contracts associated to the specific vendor. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.	Text	No
Aggregated Inherent Risk Level	Overall inherent risk level associated with the vendor. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.	Single-Select	No
Aggregated Inherent Risk Score	Overall inherent risk score associated with the vendor. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.	Text	No
Aggregated Target Risk Level	Overall target risk level associated with the vendor. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.	Single-Select	No
Aggregated Target Risk Score	Overall target risk score associated with the vendor. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.	Text	No
BitSight Domain	Domain from the BitSight platform.	Text	Yes
BitSight Industry	Industry for the vendor from BitSight.	Text	Yes
Business Owner	Name of the internal owner sponsoring the vendor.	Single-Select	Yes
BitSight Rating	Rating for the vendor from BitSight.	Text	Yes
BitSight Rating Date	Date of last Rating from BitSight.	Date	Yes
Classification	How a vendor is classified.	Single-Select	Yes
Confidentiality	How would you characterize the potential effect if this vendor were responsible for the unauthorized disclosure of, or access to, the information shared with them?	Single-Select	No
Created By	Name of the user who created the record.	Single-Select	No
Created Date	Date when the record was created.	Date	No
Critical Business Functions	Does the vendor serve critical business functions (i.e., those functions, which if corrupted or disabled, are likely to result in mission degradation or failure)?	Single-Select	No
Criticality	How critical the vendor is to the business?	Single-Select	Yes
Description	Description of the vend.	Text	Yes
External ID	This field contains a unique identifier for the record from a system outside of OneTrust.	Text	Yes
ID	This field contains a unique identifier for the record of a particular inventory type.	Text	No
Is Master	Indicates if an inventory is a parent/master record.	Single-Select	No
Last Updated By	Name of the user who last updated the record.	Single-Select	No
Last Updated Date	Date when the record was last updated.	Date	No
Master Record	Master inventory record to which the vendor record belongs (if a local version).	Text	No
Name	Name of the vendor.	Text	Yes
Organization	OneTrust organization group that this vendor is related to. Note: This field will affect access control and the ability to view and edit this vendor.	Single-Select	Yes
Personal Data	Will any personal data be shared with the vendor?	Single-Select	No
Primary Vendor Contact	Name of the vendors primary contact. Note: This attribute will pre-populate when an inventory assessment is launched for the vendor.	Single-Select	Yes
Privacy Policy Link	This link will bring you to the vendor privacy policy on their public website.	Text	Yes
Status	Status of the vendor.	Single-Select	No
Type	The type of product or service that the vendor provides.	Single-Select	Yes
Vendor Assessment	Has the vendor been assessed for compliance with applicable legal and contractual requirements?	Single-Select	Yes
Vendor ID	ID of vendor for matching with external systems.	Text	Yes
Vendor Rating	Rating of how this vendor compares to others in the same industry.	Single-Select	Yes
Vendor Region	Area or jurisdiction point in which the vendor is located (i.e. country, continent, etc.).	Single-Select	No
View Vendor in BitSight	This link will bring you to vendor record in the BitSight platform.	Text	Yes
Volume of Data	What is the expected volume of data this vendor will process?	Single-Select	No
Workflow	Name of the workflow followed by the vendor.	Single-Select	No
Workflow Stage	Current stage of the workflow that the vendor is in.	Single-Select	No