Managing Engagements in Bulk

You can create and update engagement records in bulk using the Create engagements and Update engagements import templates. These templates allow you to bulk create and edit engagement records using a Microsoft Excel spreadsheet that can be imported into the OneTrust .

To create engagements in bulk

  1. On the Third-Party Risk Management menu, select Third-Party Risk Management > Inventory > Engagements.
    The Engagements screen appears.

  2. Click the Context Menu icon and select Bulk create.
    The Import templates screen appears.

  3. Locate the Create engagements tile and click the Download button.


  4. Open the downloaded file in Microsoft Excel.
  5. Enter the engagement data in the spreadsheet.
    See Bulk import template reference for details.
  6. Save the completed file in the .xlsx format before importing it back into OneTrust.

To update engagements in bulk

  1. On the Third-Party Risk Management menu, select Third-Party Risk Management > Inventory > Engagements.
    The Engagements screen appears.

  2. Click the Context Menu icon and select Bulk create.
    The Import templates screen appears.

  3. Locate the Update engagements tile and click the Download button.


  4. Open the downloaded file in Microsoft Excel.
  5. Enter the engagement data in the spreadsheet.
    See Bulk import template reference for details.
  6. Save the completed file in the .xlsx format before importing it back into OneTrust.

To import bulk data

  1. Navigate to Global Settings by clicking the gear icon in the upper right-hand corner. Select Data import > Bulk import.
    The Bulk import screen appears.

  2. Click the Bulk import button.
    The New import modal appears.

    Field
    Description
    Import name

    The name of the engagement.

    Import type

    Select Create engagements or Update engagements depending on the template.

    File

    The edited template file.

  3. Complete the required fields.
  4. Click Submit to finish the process.
    Click Cancel or away from the modal to stop the process.

    Wait a few moments for the platform to process your upload. It will show up on the list and report Completed or Error. If it's the latter, check the edited template file before attempting to upload it again. Errors are caused by empty required fields, or invalid arguments in multiple choice fields.



Bulk import template reference

Important:

All fields are optional unless noted otherwise. The columns with red headers denote required fields, marked bold in the table below. If a required field is left blank, the import will fail. Mandatory fields differ between each template.

If an optional field is left blank, the current data in OneTrust will be overwritten as blank. If an optional column does not need to be updated, remove the column from the update template spreadsheet. The existing data will remain in OneTrust. If only certain data within a column needs to be updated, copy the existing contents of the column from the exported inventory spreadsheet and paste the contents into the update template spreadsheet to prevent the existing content from being overwritten. Then complete any updates to the content, as necessary.

Special characters are not supported for bulk import templates. If you use special characters in this spreadsheet, you will receive an error message.



Field
Description
Engagement ID Required field for Update engagements template

Enter the engagement ID.

Note:

The Engagement ID field requires a GUID value.

To obtain the GUID, navigate to the Engagements screen, select the engagement to update and find the GUID in the URL. The plain number ID shown in the Engagement overview screen will not work.



Engagement Name Required field for Create engagements template

Enter the name of the engagement.

Primary Vendor (GUID) Required field for Create engagements template

Enter the GUID of the related primary vendor.

Organization Required field for Create engagements template

Enter the organization for the engagement.

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Start Date

Enter the start date in yyyy-mm-dd format.

End Date

Enter the end date in yyyy-mm-dd format.

Internal Owner

Enter the email of the internal owner for the engagement.

External Contact

Enter the email of the external contact for the engagement.

Notes

Enter notes associated with the engagement.

Scope

Enter the scope of the engagement.

Are there alternative ICT third-party service providers identified?

Enter the assessment to identify an alternative service provider, for each ICT third-party service provider supporting a critical or important function. The possible options are:

  • Assessment not performed

  • Yes

  • No

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Country of provision of the ICT services

Enter the country of provision of the ICT services using the ISO 3166–1 alpha–2 code.

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Existence of an exit plan

Report the existence of an exit plan from the ICT third-party service provider in relation to the specific ICT service provided. The possible options are:

  • Yes

  • No

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

External Contact Email

Enter the primary contact for the engagement at the third-party organization.

Identification of alternative ICT TPP

Provide additional information about any alternative ICT third-party providers if "Yes" is reported for alternative ICT third-party providers identified.

Impact of discontinuing the ICT services

Provide the impact for the financial entity of discontinuing the ICT services provided by the ICT third-party service provider according to the financial entity’s assessment. The possible options are:

  • Low

  • Medium

  • High

  • Assessment not performed

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Level of reliance on the ICT service supporting the critical or important function

Provide the level of reliance on the ICT service supporting critical or important functions. The possible options are:

  • Not significant

  • Low reliance

  • Material reliance

  • Full reliance

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Location of management of the data (processing)

Enter the country of location of management of the data (processing) using the ISO 3166–1 alpha–2 code.

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Location of the data at rest (storage)

Enter the country of location of management of the data at rest (storage) using the ISO 3166–1 alpha–2 code.

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Notice period for the financial entity making use of the ICT service(s)

Enter the notice period for terminating the contractual arrangement by the financial entity in a business-as-usual case. The value is expressed as the number of calendar days from the receipt of the counterparty of the request to terminate the ICT service.

Notice period for the ICT third-party service provider

Enter the notice period for terminating contractual arrangement by the direct ICT third-party service provider in a business-as-usual case. The value is expressed as the number of calendar days from the receipt of the counterparty of the request to terminate the ICT service.

Possibility of reintegration of the contracted ICT service

Use this field if the ICT service is provided by a third-party provider rather than an intra-group provider. The possible options are:

  • Easy

  • Difficult

  • Highly complex

  • Not applicable

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Reason if the ICT third-party service provider is considered not substitutable or difficult to be substitutable

List the reason why the ICT third-party service provider is considered non-substitutable or difficult to replace. The possible options are:

  • Lack of real alternatives

  • Difficulties in migrating or reintegrating

  • Lack of real alternatives and difficulties in migrating or reintegrating

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Sensitiveness of the data stored by the ICT third-party service provider

Enter the level of sensitiveness of the data stored or processed by the ICT third-party service. The highest level takes precedence in case of multiple selections. The possible options are:

  • Low

  • Medium

  • High

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Storage of data

Indicate whether the ICT service is related to (or foresees) storage of data. The possible options are:

  • Yes

  • No

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Substitutability of the ICT third-party service provider

Provide the results of the financial entity's assessment of the ICT third-party service provider's substitutability in delivering specific ICT services that support a critical or important function. The possible results are:

  • Not substitutable

  • Highly complex substitutability

  • Medium complexity in terms of substitutability

  • Easily substitutable

Use the Options worksheet in the template to reference available values. Codes are listed in the same order as the options.

Type of ICT services

Indicate the type of ICT services referred to in annex III.