Adding Incident Workflow Rules

You can add rules to your workflow to automatically generate the creation of tasks based on the details of the incident.

About Incident Workflow Rules

Conditional logic rules help with the automatic creation and assignment of subtasks across your organization. The rules can also be configured to launch assessments, send notifications, and create subtasks. Depending on the type of security incident, you may configure routing rules to assign a workflow like the ISO/IEC 27035 for a particular assignee or group of users to complete subtasks and assessments. OneTrust supports the creation and management of these rules to provide more control and flexibility to the workflows that you have created in the tool.

To add a workflow rule

  1. On the Incident Management menu, select Setup > Workflows & Rules.

    The Workflows screen appears.

  2. Click on the name of the workflow you want to edit.

    The Workflow details screen appears.

  3. Go to the Stage rules tab.
  4. Select the workflow stage in which you'd like to add a new rule.
  5. Click the Create rule button.

    The Workflow rule customizer appears.

  6. Complete the fields. For more information, see Workflow Rule Types.
  7. Click the Save button.

Workflow Rule Types

Create Task

You can configure workflow rules to automatically add tasks to an incident workflow to help define and assign tasks within your organization.


Create Task workflow rule configuration screen

Field

Description

Rule Name

Enter a name for the rule.

Conditions

Select Any or All.

If you select any, the rule will be triggered if any of the criteria are met.

If you select all, the rule will only be triggered if all of the criteria are met.

Condition Block
Condition

Select which incident condition triggers the rule.

Operator

Select the relationship that must be met between the field and value.

Value

Select which field value triggers the rule.

Actions

Select Create Task.

Name

Enter the name of the task that should be created by the rule.

Description

Enter a description of the task that should be created by the rule.

Mark Task as Required

Enable this setting to require this task to be completed prior to advancing to the final stage of the incident workflow.

Assignee

Select the assignee for the task. You can select from system users or user-type attributes which include reporter and assignee.

Note:

A task can only have one assignee. If there are multiple users assigned to a user-type attribute, this field will be left empty. Warnings will display to notify you of these actions.

If a saved rule contains a user-type attribute that has been deactivated, the action will not be executed. The User type attribute option appears only when the object has at least one available single-select user attribute.

Task Collaborators

Select the users or user groups that are responsible for helping the assignee complete the task.

Priority

Select the priority level of this task.

Deadline

Select a relative date after task creation or a specific date for the task deadline.

Launch Assessment

You can configure workflow rules to automatically launch assessments when the specified conditions are met.


Launch Assessment workflow rule configuration screen

Field

Description

Rule Name

Enter a name for the rule.

Conditions

Select Any or All.

If you select any, the rule will be triggered if any of the criteria are met.

If you select all, the rule will only be triggered if all of the criteria are met.

Condition Block
Condition

Select which incident condition triggers the rule.

Operator

Select the relationship that must be met between the field and value.

Value

Select which field value triggers the rule.

Actions

Select Launch Assessment.

Name

Enter the name of the assessment launched by the rule.

Template

Select the assessment template launched by the rule.

Respondent

Select the respondent(s) for the assessment. You can select from user groups, system users, or multiple user-type attributes which include reporter and assignee.

Note:

If you select multiple user-type attributes, the warning modal shown in the screenshot still applies, but is not displayed.

If a saved rule contains a user-type attribute that has been deactivated, the action will not be executed. For example, an assessment will not launch with deactivated attributes added to the rule.

Send Notification

You can configure workflow rules to automatically send a notification with the provided message to a specified recipient(s).

Send Notification workflow rule configuration screen

Field

Description

Rule Name

Enter a name for the rule.

Conditions

Select Any or All.

If you select any, the rule will be triggered if any of the criteria are met.

If you select all, the rule will only be triggered if all of the criteria are met.

Condition Block
Condition

Select which incident condition triggers the rule.

Operator

Select the relationship that must be met between the field and value.

Value

Select which field value triggers the rule.

Actions

Select Send Notification.

Recipient(s)

Select the recipient(s) of the notification. You can select from system users, user groups, or multiple user-type attributes which include reporter and assignee.

Note:

If you select multiple user-type attributes, the warning modal shown in the screenshot still applies, but is not displayed.

If a saved rule contains a user-type attribute that has been deactivated, the action will not be executed. For example, an assessment will not launch with deactivated attributes added to the rule.

Subject
Enter the subject of the notification email.
Note:

You can configure system attributes as dynamic variables in the subject field by clicking the Add Variable icon.


Add Variable icon in the Subject field

Variable

Description

Date Reported

Select this dynamic variable to automatically populate the date the incident was reported.

Deadline Date

Select this dynamic variable to automatically populate the deadline date of the incident.

Incident ID

Select this dynamic variable to automatically populate the ID of the incident.

Incident Name

Select this dynamic variable to automatically populate the name of the incident.

Incident Description

Select this dynamic variable to automatically populate the description of the incident.

Managing Organization

Select this dynamic variable to automatically populate the incident's managing organization.

Body

Enter the body of the notification email.

Note:

You can configure system attributes as dynamic variables in the body field by clicking the Add Variable icon.


Add Variable icon in the Body field

Variable

Description

Date Reported

Select this dynamic variable to automatically populate the date the incident was reported.

Deadline Date

Select this dynamic variable to automatically populate the deadline date of the incident.

Incident Description

Select this dynamic variable to automatically populate the description of the incident.

Incident ID

Select this dynamic variable to automatically populate the ID of the incident.

Incident Name

Select this dynamic variable to automatically populate the name of the incident.

Incident ID Hyperlink

Select this dynamic variable to automatically populate the incident ID as a hyperlink that navigates to the incident details.

Incident Name Hyperlink

Select this dynamic variable to automatically populate the incident name as a hyperlink that navigates to the incident details.

Managing Organization

Select this dynamic variable to automatically populate the incident's managing organization.