Step-by-Step Onboarding Guide: Incident Management
Get up and running with your Incident Management solution
Thank you for choosing the OneTrust Incident Management solution to help manage your privacy, security, and governance program needs.
The solution is designed to be intuitive and easy to configure and this guide will take you through each step one by one.
And if you have questions along the way, or at the end of your implementation, you can reach out to the team who will be happy to help.
OneTrust Incident Management helps organizations manage incidents, automate tasks, and maintain records for improved compliance and notification response. Privacy professionals can build automated workflows embedded with context and attribute values that help their organizations react to incidents and audits according to applicable laws or custom use cases.
Let’s get you started
Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support collateral on the my.onetrust.com online resource platform and this guide will direct you towards all the information you need.
Before you begin
Before you get started with your implementation, complete the following key activities which will help you accelerate your implementation:
-
Assign Key Decision Maker
Assign the main point of contact throughout the module implementation. This individual would be responsible for making configuration/setting decisions for the module. This individual should be able to map existing breach processes into the OneTrust tool and be the driver of the project from within your organization.
-
Gather any existing incident questionnaire templates
If you plan to use any existing templates, start to centralize those questionnaires so you can plan to create these questionnaires within the tool. OneTrust offers a pre-configured incident reporting template available within the gallery. This template can be modified and customized to include specific questions to match your organization.
-
Gather existing incident records
If you plan to import any previously logged incidents into the module register, define incident types that will be recorded and the attributes to be added to the module.
-
Define incident types
Defining incident types plays a crucial part in recording incidents directly into your register via an assessment submission. Incident question types will log the incident automatically into the register.
This is also important for consistent reporting. Incident types will allow you to collect quantitative data on specific incidents, in addition to showing visual reports.
-
Identify key stakeholders and teams that contribute to the incident review process
What is your existing data breach process? Who reviews existing incident records? What OneTrust user permissions should the stakeholders have?
-
Design workflow
Prepare a step-by-step list on how your current data breach process works, including risk workflow. How are incidents and data breaches initially reported? Are they reported by business users or are they reported by a central team?
If reported by business end-users, does your organization use Single Sign On authentication (SSO)? If so, best practice is to add templates into the self- service portal (SSP) and launch questionnaires via SSP. OneTrust will capture an audit trail of business users that have accessed the system. Otherwise, you may bulk import users into the system.
-
Define key reporting outputs
Our reporting capability allows your team to view total incidents, capture summaries and incident types detail. You can also capture risks and custom attribute information using our Reporting module.
Visual reporting is also available to capture high-level visual representation of your incident records.
Incident Management Configuration
You can access all our knowledge base articles at the link here. The steps below direct you to the most relevant way to get started as quickly as possible.
|
Step |
Description |
|---|---|
|
1 |
Attributes The Attribute Manager allows users to create and view active and inactive attributes. You can create custom attributes to further describe the nature of an incident. Edit, activate, deactivate, or translate these options in the Attribute Manager screen. On the Attribute Details screen, you can add custom options to the attribute. These attributes can be added to Incident assessments. Users can also create groups of attributes which appear during incident creation on the Incident Details screen. Adding Attribute Value Options to Incident Attributes Managing Custom Incident Attributes Configuring Incident Attribute Groupings Incident Types Review pre-configured incident types and amend, as necessary. Add any custom incident types to the available list and deactivate any types that are not needed. This will help to ensure consistent reporting based on defined incident types. |
|
2 |
Assessment Reporting You can configure assessment templates to automatically create and update incident records as part of the assessment workflow. There are several reasons why users would want to have an incident assessment:
There are two types of questionnaires you can create: Create your own and Choose from Gallery. Questionnaire Features:
Once an assessment is submitted, the assigned approver will review the responses regarding the incident and follow up with the resource who submitted the incident. The assigned approver can leave notes and comments, send back for more information, and flag risks. Adding Incidents through an Assessment Adding Incidents using the Self-Service Portal Launching Incident Assessments Webform Reporting The Web Forms screen allows users to build a web form using the web form builder. The web form can be used to generate a link that external users can use to submit incidents to the Incident Register. Users also can copy the web form script to add an incident web form to a preexisting website using an iFrame. Adding your Incident Web Form to an Existing Website Manual Reporting You can also log incidents in the application manually, and use the incident record to manage the workflow, associated assessments, and other related tasks. |
|
3 |
Configuring your workflow for optimal automation is one of the most effective ways to improve response notification times. Workflows & Rules helps organizations create ruled-based automated workflows based on jurisdictional law, geographic location, and severity classification for improved breach investigation and notification. Users also can create condition-based routing rules that automate the assignment of workflows to incidents based on incident details. Workflows Workflows are to be managed manually per incident. Workflows are designed in stages, breaking down internal processes into phases that will be followed in the system. OneTrust has designed workflows aligned with industry standard frameworks to help process a reported incident. ISO/IEC 27035 - Information Incident Management
NIST 800-61 - Process Cyber Incident Breaches
OneTrust default workflow includes the following set of processes:
Principles of data breach workflows should be designed to prepare, identify, assess, respond, and learn from incidents, security events, and vulnerabilities. Workflow Rules You can add rules to your workflow to automatically generate the creation of tasks based on the details of the incident. Conditional logic rules help with the automatic creation and assignment of subtasks across your organization. The rules can also be configured to launch assessments, send notifications, and create subtasks. Routing Rules Depending on the type of security incident, you may configure routing rules to assign a workflow like the ISO/IEC 27035 for a particular assignee or group of users to complete subtasks and assessments. OneTrust supports the creation and management of these rules to provide more control and flexibility to the workflows that you have created in the tool. |
|
4 |
Once an incident has been reported, you can start to process it using the relevant workflow that has been triggered by your routing rules as stated in the previous step. The Incident Details screen provides users with an overview of an incident to help manage the response process. This holistic view of the incident allows organizations to manage an incident through a customizable, systematic workflow that includes stages for evaluation, investigation, remediation, and notification. The incident summary displays breach notification obligations from DataGuidance intelligence and shows upcoming, overdue, and recently completed tasks as well as the overall status of each incident. The Details tab shows relevant metadata about the incident including the type, assignee, and other details. For more information on managing incidents, see the below articles: Adding and Editing Subtasks for Incidents Relating Incidents to other Incidents DINA Assessment You can associate an incident with legal jurisdictions such as countries and states to build a visualization of impacted regions and their applicable local regulations. This allows you to identify the notification requirements of each impacted jurisdiction. The Dynamic Incident Notification Assessment (DINA) is a questionnaire that assesses whether an incident requires an organization to notify the individuals or authorities affected by the incident. The DINA provides context-aware questions that are specifically targeted to the jurisdictions in the scope of the incident. The Incident Management module provides notification guidance for each jurisdiction based on your DINA responses. You can accept action options generated by the DINA to automatically create subtasks for notification response. Risks You can add new risks and link existing risks in your risk register to an incident. This allows users to easily add and view all realized risks after an incident has occurred. |
|
5 |
Reporting and dashboards are the two main ways your team can see specific metrics related to the incident assessments that are sent out. Reporting allows for specific customization while the dashboard capability can meet all your project management needs. The Dashboard offers a comprehensive view of your organization's capacity with visualizations that provide critical metrics about your incidents. You can build custom dashboards with the goal of optimizing your organization's capacity. Using the Incident Management Dashboard You can configure a PDF report through several customization preferences to help you capture the most important aspects of a reported incident. The PDF report will display incident details and metadata. Creating a PDF Incident Report You can export the customized summary report directly from an incident record in the Incident Management module and from the Reports module. For more information on creating a PDF report from the Reports module, see Creating a New Report. For all articles on Reporting and Dashboards, click here. |
|
Complete! |
Congratulations on completing your implementation. |