Updating the Managing Organization for Different Objects
Overview
Within OneTrust, objects such as inventories, assessments, and risks are associated with a specific managing organization. As business needs evolve, these objects may need to be reassigned to different organizations. This article outlines how to safely and effectively change the organizational affiliation of various object types. The guidance below applies to products such as Data Mapping, IT & Security Risk Management, and Third-Party Risk Management.
Why change organizational assignments?
Changing the organizational assignment of objects within the OneTrust Platform can help ensure that data remains aligned with current business functions and responsibilities as your business' needs evolve. The following are common use cases for changing organizational assignments:
-
Mergers or acquisitions
-
Department restructuring
-
Asset reallocation
-
Project ownership transitions
Prerequisites
Before making changes, it is essential to confirm that the necessary prerequisites are met to avoid unintended disruptions. The following steps are recommended to help maintain data integrity and ensure a smooth transition process:
-
Review permissions: Ensure you have the necessary admin rights.
-
Check dependencies: Confirm the object is not linked to ongoing workstreams that could be disrupted.
-
Notify stakeholders: Communicate changes to impacted teams.
Updating the Managing Organization for Inventories
The following options are available to update the organization for inventories based on your need:
Changing the managing organization of inventories does not automatically update the managing organization of related assessments or issues. However, if the Managing organization assignment for risks setting within Global Settings is disabled, the organization of risks sourced from the inventory will update automatically. For more information, see Risk, Controls & Evidence Settings.
Option 1: OneTrust User Interface
-
Update the inventory by editing in the attributes pane.
-
Update the inventory by editing the inventory Details screen.
-
Update multiple inventories by utilizing the bulk edit option.
Option 2: Bulk Update Templates
OneTrust offers bulk update templates that can be used to update theorganization or any other inventory attributes by uploading spreadsheets into the OneTrust Platform.
Option 3: OneTrust APIs
Utilize the Update Inventory by ID API to update the organization of an inventory.
-
Update the hostname and parameters within the API path:
https://{hostname}/api/inventory/v2/inventories/{type}/{id}.Parameter
Description
{hostname}Enter the domain of your OneTrust environment. This is the URL that you use to access your instance of the OneTrust Platform, such as app.onetrust.com, app-eu.onetrust.com, etc.
{type}Enter the type of inventory that you are updating. The supported values are
processing-activities,vendors,assets, andentities.{id}Enter the inventory GUID that you are updating. This value can be obtained using the Get List of Inventories API, through an inventory list screen export, or from the URL of an inventory record.
-
Input the
organizationparameter values within the request body. These values can be obtained using the Get List of Organizations API. The example format of the request body is shown below.Parameter
Description
idEnter the unique identifier of the new managing organization.
valueEnter the name of the new managing organization.
JSON{ "organization": { "id": "cafb2d58-04da-4e9f-a733-83b1049bab66", "value" : "US" } } -
Use Postman or a similar tool to update the managing organization of multiple inventories.
Updating the Managing Organization for Assessments
The following options are available to update the organization for assessments based on your need:
This action will impact assessment visibility for users. For more information, see Assessment Visibility Across Organizations.
Option 1: OneTrust User Interface
Update the organization of the assessment by editing the assessment details.
Option 2: OneTrust APIs
Utilize the Reassign Assessment API to update the organization of an assessment.
-
Update the hostname and parameters within the API path:
https://{hostname}/api/assessment/v2/assessments/{assessmentId}/reassign.Parameter
Description
{hostname}Enter the domain of your OneTrust environment. This is the URL that you use to access your instance of the OneTrust Platform, such as app.onetrust.com, app-eu.onetrust.com, etc.
{assessmentId}Enter the unique identifier of the assessment you are updating. This value can be obtained using the Get List of Assessments API.
-
Input the
orgGroupIdparameter value within the request body. This value can be obtained using the Get List of Organizations API. The example format of the request body is shown below.Parameter
Description
orgGroupIdEnter the unique identifier of the new managing organization.
JSON{ "orgGroupId": "cafb2d58-04da-4e9f-a733-83b1049bab66" } -
Use Postman or a similar tool to update the managing organization of multiple assessments.
Updating the Managing Organization for Risks
Prerequisite: Ensure the Managing organization assignment for risks setting within Global Settings is enabled before proceeding. Disable it afterward if you want to restrict users from changing organizations for risks. For more information, see Risk, Controls & Evidence Settings.
The following options are available to update the organization for risks based on your need:
Option 1: OneTrust User Interface
Update the organization of a risk by editing the risk details.
Option 2: Bulk Update Templates
To update risks in bulk, utilize the Update Risks import template to upload a spreadsheet.
-
Enable the Managing organization assignment for risks setting within Global Settings.
-
Download the Update Risks import template from within Global Settings.
-
Remove all columns except for Risk ID, Risk Name, and Organization.
-
Obtain risk GUIDs to populate the spreadsheet. These values can be obtained using the Get List of Risks API, through a Risk Register screen export, or from the URL of a risk record.
Option 3: OneTrust APIs
Utilize the Modify Risk API to to update the organization of a risk.
-
Update the hostname and parameters within the API path:
https://{hostname}/api/risk-v2/v2/risks/{riskId}Parameter
Description
{hostname}Enter the domain of your OneTrust environment. This is the URL that you use to access your instance of the OneTrust Platform, such as app.onetrust.com, app-eu.onetrust.com, etc.
{riskId}Enter the risk GUID of the risk you are updating. This value can be obtained using the Get List of Risks API, through a Risk Register screen export, or from the URL of a risk record.
-
Input the
orgGroupIdparameter value within the request body. This value can be obtained using the Get List of Organizations API. The example format of the request body is shown below.Parameter
Description
orgGroupIdEnter the unique identifier of the new managing organization.
JSON{ "orgGroupId": "3928a65e-a430-4fec-a737-d44828b6cc44" } -
Use Postman or a similar tool to update the managing organization of multiple risks.
Best Practices
The following are best practices to help minimize impact, improve accuracy, and support a smooth transition when updating the managing organization for different objects:
-
Use bulk update tools for large-scale changes.
-
Schedule changes during low-traffic hours.
-
Test changes in a UAT environment first.
Frequently Asked Questions (FAQ)
The following responses are supported solutions to frequently asked questions (FAQ) on updating organizations for different objects. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.
Will changing an object's organization affect reporting?
Yes, reports filtered by organization will reflect the new assignment.
Can I revert a change?
You can repeat the process with the previous organization to revert the update.