Updating the Managing Organization for Different Objects

Overview

Within OneTrust, objects such as inventories, assessments, and risks are associated with a specific managing organization. As business needs evolve, these objects may need to be reassigned to different organizations. This article outlines how to safely and effectively change the organizational affiliation of various object types. The guidance below applies to products such as Data Mapping, IT & Security Risk Management, and Third-Party Risk Management.

Why change organizational assignments?

Changing the organizational assignment of objects within the OneTrust Platform can help ensure that data remains aligned with current business functions and responsibilities as your business' needs evolve. The following are common use cases for changing organizational assignments:

  • Mergers or acquisitions

  • Department restructuring

  • Asset reallocation

  • Project ownership transitions

Prerequisites

Before making changes, it is essential to confirm that the necessary prerequisites are met to avoid unintended disruptions. The following steps are recommended to help maintain data integrity and ensure a smooth transition process:

  1. Review permissions: Ensure you have the necessary admin rights.

  2. Check dependencies: Confirm the object is not linked to ongoing workstreams that could be disrupted.

  3. Notify stakeholders: Communicate changes to impacted teams.

Updating the Managing Organization for Inventories

The following options are available to update the organization for inventories based on your need:

Note:

Changing the managing organization of inventories does not automatically update the managing organization of related assessments or issues. However, if the Managing organization assignment for risks setting within Global Settings is disabled, the organization of risks sourced from the inventory will update automatically. For more information, see Risk, Controls & Evidence Settings.

Option 3: OneTrust APIs

Utilize the Update Inventory by ID API to update the organization of an inventory.

  1. Update the hostname and parameters within the API path: https://{hostname}/api/inventory/v2/inventories/{type}/{id}.

    Parameter

    Description

    {hostname}

    Enter the domain of your OneTrust environment. This is the URL that you use to access your instance of the OneTrust Platform, such as app.onetrust.com, app-eu.onetrust.com, etc.

    {type}

    Enter the type of inventory that you are updating. The supported values are processing-activities, vendors, assets, and entities.

    {id}

    Enter the inventory GUID that you are updating. This value can be obtained using the Get List of Inventories API, through an inventory list screen export, or from the URL of an inventory record.

  2. Input the organization parameter values within the request body. These values can be obtained using the Get List of Organizations API. The example format of the request body is shown below.

    Parameter

    Description

    id

    Enter the unique identifier of the new managing organization.

    value

    Enter the name of the new managing organization.

    JSON
    {
    "organization": {
     "id": "cafb2d58-04da-4e9f-a733-83b1049bab66",
     "value" : "US"
     }
    }
  3. Use Postman or a similar tool to update the managing organization of multiple inventories.

Updating the Managing Organization for Assessments

The following options are available to update the organization for assessments based on your need:

Attention:

This action will impact assessment visibility for users. For more information, see Assessment Visibility Across Organizations.

Option 2: OneTrust APIs

Utilize the Reassign Assessment API to update the organization of an assessment.

  1. Update the hostname and parameters within the API path: https://{hostname}/api/assessment/v2/assessments/{assessmentId}/reassign.

    Parameter

    Description

    {hostname}

    Enter the domain of your OneTrust environment. This is the URL that you use to access your instance of the OneTrust Platform, such as app.onetrust.com, app-eu.onetrust.com, etc.

    {assessmentId}

    Enter the unique identifier of the assessment you are updating. This value can be obtained using the Get List of Assessments API.

  2. Input the orgGroupId parameter value within the request body. This value can be obtained using the Get List of Organizations API. The example format of the request body is shown below.

    Parameter

    Description

    orgGroupId

    Enter the unique identifier of the new managing organization.

    JSON
    {
    "orgGroupId": "cafb2d58-04da-4e9f-a733-83b1049bab66"
    }
  3. Use Postman or a similar tool to update the managing organization of multiple assessments.

Updating the Managing Organization for Risks

Prerequisite: Ensure the Managing organization assignment for risks setting within Global Settings is enabled before proceeding. Disable it afterward if you want to restrict users from changing organizations for risks. For more information, see Risk, Controls & Evidence Settings.

The following options are available to update the organization for risks based on your need:

Option 2: Bulk Update Templates

To update risks in bulk, utilize the Update Risks import template to upload a spreadsheet.

  1. Enable the Managing organization assignment for risks setting within Global Settings.

  2. Download the Update Risks import template from Data import > Import templates within Global Settings.

  3. Remove all columns except for Risk ID, Risk Name, and Organization.

  4. Obtain risk GUIDs to populate the spreadsheet. These values can be obtained using the Get List of Risks API, through a Risk Register screen export, or from the URL of a risk record.

Option 3: OneTrust APIs

Utilize the Modify Risk API to to update the organization of a risk.

  1. Update the hostname and parameters within the API path: https://{hostname}/api/risk-v2/v2/risks/{riskId}

    Parameter

    Description

    {hostname}

    Enter the domain of your OneTrust environment. This is the URL that you use to access your instance of the OneTrust Platform, such as app.onetrust.com, app-eu.onetrust.com, etc.

    {riskId}

    Enter the risk GUID of the risk you are updating. This value can be obtained using the Get List of Risks API, through a Risk Register screen export, or from the URL of a risk record.

  2. Input the orgGroupId parameter value within the request body. This value can be obtained using the Get List of Organizations API. The example format of the request body is shown below.

    Parameter

    Description

    orgGroupId

    Enter the unique identifier of the new managing organization.

    JSON
    {
    "orgGroupId": "3928a65e-a430-4fec-a737-d44828b6cc44"
    }
  3. Use Postman or a similar tool to update the managing organization of multiple risks.

Best Practices

The following are best practices to help minimize impact, improve accuracy, and support a smooth transition when updating the managing organization for different objects:

  • Use bulk update tools for large-scale changes.

  • Schedule changes during low-traffic hours.

  • Test changes in a UAT environment first.

Frequently Asked Questions (FAQ)

The following responses are supported solutions to frequently asked questions (FAQ) on updating organizations for different objects. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.

Will changing an object's organization affect reporting?

Yes, reports filtered by organization will reflect the new assignment.

Can I revert a change?

You can repeat the process with the previous organization to revert the update.