Managing Attribute-Based Access Control (ABAC) for Third-Party Management

Overview

In ABAC Phase 1: Foundations, Attribute-Based Access Control (ABAC) for Third-Party Management helps teams provide record-level access to the right users across third-party risk management workflows without granting broad access to the full solution. In Third-Party Management, ABAC is used to support controlled collaboration around specific third parties, engagements, contracts, assessments, and more while preserving least-privilege access and maintaining a clear audit trail.

Use this article to understand how ABAC applies to Third-Party Management records, which objects are impacted, and how assignments can be used to support common third-party risk workflows such as intake, onboarding, reassessment, offboarding, and ethics or compliance due diligence.

How ABAC Works in Third-Party Management

In Third-Party Management, assignments are provisioned as record-level access grants that layer on top of a user's existing role and permissions. Rather than granting users broad access to the entire solution, assignments provide access to specific third parties, engagements, contracts, assets, entities, assessments, risks, issues, or controls.

ABAC enables teams to collaborate around a particular third-party relationship while maintaining control over who can access that record and what actions they can perform. For example:

A Business or Internal Engagement Owner can receive edit access to a specific third-party record during onboarding, review, or remediation.
Legal, Privacy, Procurement, or Security reviewers can receive limited access to a specific third-party, contract, or engagement under review without receiving access to all third-party, contract, and engagement records.
Users can request access directly from a record when they need to participate in an assessment or issue review.

The overall goal is to ensure the right people can access the right records at the right time while maintaining clear ownership, auditability, and least-privilege access, while providing a clear audit trail.

Common Use Cases

Use cases describe the most common business scenarios where ABAC helps teams collaborate on records while maintaining least-privilege access. The examples below highlight how organizations can use ABAC to provide the right users with access to the right records at the right time.


Use Case	How ABAC Helps
Identify, Intake, and Inventory	Use assignments to clarify ownership and participation during third-party intake and inventory activities. Stakeholders can receive access to specific records without requiring broader TPM permissions. Example personas include: Business Owners, Procurement Contributors, and Record Reviewers.
Onboard and Assess	Use assignments to coordinate onboarding activities, information gathering, evidence collection, and assessment reviews for a specific third-party or engagement. Example personas include: Assessment Respondents and Collaborators, Security Reviewers, Business Owners, Evidence Contributors, and Approvers.
Reassess	Use assignments to route reassessment activities to the appropriate stakeholders when third-party information, controls, or risks require review. Example personas include: Third-Party Risk Analysts or Managers, Risk Reviewers, Control Reviewers, Engagement Owners, and Final Approvers.
Terminate and Offboard	Use assignments to coordinate offboarding activities, such as shutdown and documentation, and signoff requirements for a specific third-party relationship. Example personas include: Offboarding Owners, Procurement Reviewers, Legal Reviewers, Security Signoff reviewers, and Business Owners.
Ethics and Compliance Due Diligence	Use assignments to provide limited access when Legal, Compliance, Ethics, or Procurement teams need to evaluate a specific third-party. Example personas include: Due Diligence Owners, Compliance Reviewers, Ethics Reviewers, Legal Reviewers, and Decision Approvers.

Key Workflows Impacted by ABAC

ABAC introduces record-level access controls within existing solution workflows. The following workflows are commonly impacted by ABAC and may change how users access, review, and collaborate on records.


Workflow	How ABAC Changes the Experience
Third-Party Intake & Inventory	Clarifies ownership and participation for specific third-party records without requiring broader TPM access.
Third-Party Onboarding	Enables business users, security teams, and procurement teams to collaborate on a specific third-party or engagement record.
Assessments	Allows stakeholders to participate in assessments, provide evidence, review responses, and approve activities on specific records.
Reassessments	Routes access to designated reviewers and owners when periodic reviews are required.
Risk & Issue Management	Provides targeted access to risks and issues associated with specific third-party relationships.
Offboarding	Supports coordinated record review, documentation, and approvals as third-party relationships are terminated.
Ethics & Compliance Reviews	Allows scoped access for legal, ethics, procurement, and compliance teams reviewing specific third-parties.

Third-Party Management-Specific Considerations

Third-Party Management frequently requires collaboration across multiple business functions, including third-party managers, TPM analysts, contract owners, risk owners, procurement teams, legal reviewers, security reviewers, business stakeholders, and external third-party contacts. ABAC helps facilitate this collaboration without expanding module-wide access.
Access rights to Third Parties, Engagements, Contracts, Assessments, Risks, Issues, Documents, Related Personal Data, Related Inventories, and Third-Party Exchange records are impacted by ABAC.
Third-Party Management customers are encouraged to explore ABAC-enabled reporting and evaluate how record-level access controls affect reporting experiences across vendors, engagements, assessments, risks, and controls. Because many commonly used Third-Party Management objects are included in the current reporting scope, organizations are well positioned to assess how ABAC can help align report visibility with operational access controls. For more information about supported reporting experiences, report visibility behavior, and current limitations, see Reporting Considerations for Attribute-Based Access Control (ABAC).

Supported Objects, Attributes & System Assignments

This section provides a reference for the objects that support ABAC within this solution and the system assignments that can be used to grant record-level access. Supported objects and assignments can be found by navigating to the Assignments screen in Global Settings. For more information, see Managing Assignments with Attribute-Based Access Control (ABAC).

Supported Objects

The following objects support ABAC within Third-Party Management and can be configured using supported ABAC capabilities: Assets, Assessments, Contracts, Engagements, Entities, Issues, Risks, Third-parties.

Note:

Enhanced due diligence and screening results are not currently supported. For more information, see Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC).

Supported Attributes

The following attributes support assignment-based access and can be used to automatically grant record-level permissions based on ownership, responsibility, participation, or other user relationships. Attributes are organized by object and divided into standard and advanced attribute categories.


Object	Standard	Advanced
Assets	Created By, Created Date, Hosting Location, IT Owner, Last Updated By, Last Updated Date, Managing Organization, Name, Status, Type	All system and custom attributes.
Assessments	Comments, Deadline, Description, Name, Organization.Template, RecordAdmin, Reminder, Respondents, Send Email to, Tags, Workflow	Approval Stage, Approver, Assessment Delete Status, Assessment Result, Creator, Date Completed, Date Created, Date Deleted, Date Submitted, Deleted By, ID, Inherent Risk Level, Inherent Risk Score, Open Info Request Count, Open Issue Count, Open Risk Count, Pending Reviews, Residual Risk Level, Residual Risk Score, Stage, Target Risk Level, Target Risk Score, Template Version, Updated Date
Contracts	Contract Name, Contract Owner, Date Created, Date Created, Expiration Date, Organization, Status, Type, Vendor Contracts	Annual expense or estimated cost of the contractual arrangement for the past year, Approved Date, Approvers/Signers, Contract URL, Contractual arrangement linked to the contractual arrangement referred in RT.02.03.0010, Contractual arrangement reference number, Cost, Country of the governing law of the contractual arrangement, Currency, Currency of the amount reported for annual expense or estimated cost of contractual arrangement for the past year, Date of the last audit on the ICT third-party service provider, End date of the contractual arrangement, Is this contract an Intragroup Arrangement?, Notes, Overarching contractual arrangement reference number, Reason of the termination or ending of the contractual arrangement, Start date of the contractual arrangement, Type of contractual arrangement
Engagements	Name, End Date, External Contact Email, External Contact Name, Internal Owner, Organization, Start Date, Vendor	Aggregate Risk Score, Aggregated Inherent Risk Score, Aggregated Target Risk Score, Are there alternative ICT third-party service providers identified?, Country of provision of the ICT services, Created By, Created Date, Existence of an exit plan, ID, Identification of alternative ICT TPP, Impact of discontinuing the ICT services, Last Updated Date, Level of reliance on the ICT service supporting the critical or important function, Location of management of the data (processing), Location of the data at rest (storage), Notes, Notice period for the financial entity making use of the ICT service(s), Notice period for the ICT third-party service provider, Possibility of reintegration of the contracted ICT service, Reason if the ICT third-party service provider is considered not substitutable or difficult to be substitutable, Scope, Sensitiveness of the data stored by the ICT third-party service provider, Status, Storage of data, Substitutability of the ICT third-party service provider, Type, Type of ICT services, Updated By, Workflow, Workflow Stage
Entities	Created By, Created Date, Last Updated By, Last Updated Date, Legal Entity Owner, Name, Organization, Primary Operating Location, Status, Type	All system and custom attributes.
Issues	Description, ID, Name, Organization, Owners, Priority, Source ID, Source Type, Status, Type	Action plan, Approvers, Category, Closed by, Closure note, Created By, Created Date, Data closed, Deadline, Reason for closure
Risks	Children Risks, Closure Note, Hierarchy Level, Migration Status, Orphan, Parent, Reason for Closure, Reminder, Risk Appetite, Risk Template, Risk Tolerance, Threat, Vulnerability	Category, Date Closed, Date Created, Deadline, Description, ID, Inherent Risk Impact Level, Inherent Risk Level, Inherent Risk Probability Level, Inherent Risk Rollup Level, Inherent Risk Rollup Score, Inherent Risk Score, Last Updated By, Last Updated Date, Organization, Residual Risk Impact Level, Residual Risk Level, Residual Risk Probability Level, Residual Risk Rollup Level, Residual Risk Rollup Score, Residual Risk Score, Result, Risk Approver, Risk Domain, Risk Manager, Risk Name, Risk Owner, Source, Stage, Target Risk Impact Level, Target Risk Level, Target Risk Probability Level, Target Risk Score, Treatment, Treatment Plan, Treatment Status, Type, Workflow
Vendors	Business Owner, Created By, Created Date, Last Updated By, Last Updated Date, Name, Organization, Primary Vendor Contact, Status, Type, Vendor Workflow, Vendor Workflow Stage	All system and custom attributes.

System Assignments

The following system assignments are available out of the box and can be used to grant access based on common ownership, collaboration, review, approval, and access-management responsibilities.


System Assignment	Assignment Description	Access Options	Applicable Object
Assessment approver	Allows user to approve/reject a assessment	User attributes	Assessments
Assessment creator	Creator of the assessment	User attributes	Assessments
Assessment respondent	Allows user to respond to the assessments	User attributes	Assessments
Business owner	Permits user to edit, delete, and reassign a record.	User attributes	Vendors
Collaborator	Allows the user to view the assessment and leave a comment on it.	Sharing	Assessments
Editor	Allows the user to edit and view a record.	Sharing	Assets, Contracts, Engagements, Entities, Issues, Risks, Vendors
Exception approver	An exception approver reviews risk exceptions, recommends remediation actions, and approves exception requests.	Workflow	Risks
Internal owner	Permits user to edit, delete, and reassign a record.	User attributes	Engagements
Issue approver	Reviews the resolution before closure, verifies it meets acceptance criteria, and approves or rejects the outcome.	User attributes	Issues
Issue owner	Responsible for managing the issue from logging through resolution and ensuring corrective actions are tracked, documented, and completed on time.	User attributes	Issues
Legal entity owner	Permits user to edit, delete, and reassign a record.	User attributes	Entities
Owner	Permits user to view and reassign a record.	User attributes	Contracts
Record admin	Allows the user to edit, delete, and reassign a record. For more information, see Managing Record Admins & Ownership with Attribute-Based Access Control (ABAC).	Sharing	Assets, Assessments, Contracts, Engagements, Entities, Issues, Risks, Vendors
Risk approver	A risk approver reviews risks identified in an assessment to flag risks, propose remediation steps, and approve treatment plans.	User attributes	Risks
Risk manager	A risk manager oversees all risk identification, evaluation, treatment, and monitoring within the risk management process.	User attributes	Risks
Risk owner	A risk owner manages a specific risk, implements treatment plans, and ensures that necessary actions are taken to mitigate the risk.	User attributes	Assessments, Risks
Stage approver	A stage approver reviews identified risks, flags key concerns, suggests remediation steps, and approves the risk treatment plan.	Workflow	Risks
Technical owner	Permits the user to edit, delete, and reassign a record.	User attributes	Assets
Viewer	Allows the user to view a record.	Sharing	Assets, Assessments, Contracts, Engagements, Entities, Issues, Risks, Vendors

Additional Resources

For a complete list of ABAC resources, see the Attribute-Based Access Control (ABAC) User Guide, which includes foundational concepts, implementation guidance, and procedural configuration articles.

To learn how ABAC is implemented across other OneTrust solutions, explore the following solution-specific articles:

Settings & Administration