Creating and Managing Custom Evidence Tasks in your Library

You can manually create custom evidence tasks or link existing tasks to a control. Evidence tasks can be used to continuously collect evidence to prove control implementation.

Custom evidence tasks can be used to supplement out-of-the-box evidence tasks to more granularity define what should be collected to satisfy a control. Like out-of-the-box evidence tasks, custom evidence tasks can be connected to controls across multiple frameworks to support collecting evidence once to help prove compliance across multiple controls.

Note:

You can only add evidence task to a control implementation with an inventory source.

To manually create evidence tasks on the Control Details screen

You can manually add a control implementation by creating a custom evidence task. An evidence task is the specific action or documentation requirement undertaken to demonstrate compliance with a standard or framework control, providing tangible proof that the prescribed measures have been implemented and are effective at a predefined interval (annually, quarterly, monthly, etc.).

Custom evidence tasks may be created in cases where OneTrust does not support the standard or framework needed out-of-the-box.

Important:

When a custom evidence task is linked to multiple controls across different frameworks, it may appear for only one control during initiative creation rather than for all linked controls. This behavior is expected.

When a new control or evidence implementation is created, all current evidence links are applied as expected. However, if the system reuses an existing control implementation, any evidence links added afterward are not applied retroactively. As a result, newly linked evidence tasks appear only in newly created implementations and do not appear in reused existing implementations.

Note:

The evidence task assignee can view the collection guidance and historical collection periods with associated evidence. They can also view any overdue collection requests, upload evidence, and leave comments to the reviewer.

  1. On the Compliance Automation menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the IT & Security Risk Management module.

  2. Click the Implementation ID for the control in which you'd like to manually create an evidence task.

    The Control Details screen appears.

  3. Navigate to the Evidence tasks tab.
  4. Click the Add evidence task button.

    The Add Evidence Task(s) screen appears.

  5. Click the Create New button.

    The Create Evidence Task modal appears.

  6. Choose to Create from Library Evidence Task or Create Custom Evidence Task.

    Creating an evidence task from the library allows you to copy an existing evidence task and update the relevant information to create a new evidence task. Creating a custom evidence task allows you to create a net new custom evidence task that will be linked to the current control.





  7. Click the Save button. Click the Save and Add New button to save the current evidence task and immediately create a new evidence task.
  8. Click the Add button.

To link existing evidence tasks on the Control Details screen

  1. On the Compliance Automation menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the IT & Security Risk Management module.

  2. Click the Implementation ID for the control in which you'd like to manually create an evidence task.

    The Control Details screen appears.

  3. Navigate to the Evidence Tasks tab.
  4. Click the Add Evidence Task button.

    The Add Evidence Task(s) screen appears.

  5. Select existing tasks in the Existing Evidence Tasks field selector.


  6. Click the Add button.

To create library evidence tasks

An evidence task record that can be copied and modified to create a new evidence task that will be associated to a control implementation. Library evidence tasks allow you to bulk create a set of controls and evidence tasks from a standardized grouping.

Tip:

OneTrust recommends creating library evidence tasks prior to creating a compliance initiative.

  1. On the Compliance Automation menu, select Libraries > Evidence Task Library.
    The Evidence Task Library screen appears.
    Note:

    This can also be accessed from the IT & Security Risk Management module.

  2. Click the Create Library Evidence Task button.

    The Create Library Evidence screen appears.

  3. Complete the required fields. See Create Library Evidence Task Screen Reference for more information.
  4. Click the Next button.

    The Associated Controls modal appears.

  5. Click the Add Associated Controls button.

    The Add Controls modal appears.

  6. Select the controls you would like to add to the evidence task.


  7. Click the Add button.
  8. Click the Create button to add the evidence task to the library.

Create Library Evidence Task Screen Reference



Field
Description
Evidence Task Name

Enter a task name.

Collection interval

Select the collection interval for continuous monitoring (quarterly, yearly, one-time, weekly, etc.). This allows automated evidence requests to be sent out to assignees on a set cadence to gather refreshed evidence.

Interval due date

Enter the number of days before or after the end of the collection period that the interval is due.

What to Collect

Enter a brief description of the evidence that needs to be collected.

Collection Guidance

Enter evidence collection guidance on how to collect the evidence.

To edit library evidence tasks

  1. On the Compliance Automation menu, select Libraries > Evidence Task Library.
    The Evidence Task Library screen appears.
    Note:

    This can also be accessed from the IT & Security Risk Management module.

  2. Hover over the row for the task you want to edit until the Context Menu icon will appear.
  3. Click the Context Menu icon.
  4. On the Context menu, select Edit.

    The Library Evidence Task modal appears.

  5. Make changes as needed.
  6. Click the Save button.

To review controls associated with library evidence tasks

  1. On the Library Evidence Task screen, select the Associated Controls tab.


  2. Review the list of controls that can be proved through this library evidence task.

To add associated controls to library evidence tasks

  1. On the Library Evidence Task screen, select the Associated Controls tab.
  2. Click the Add Controls button.
    The Add Controls modal appears.

  3. Select the controls you'd like to add to the library evidence task or create a new custom control to add to the task.
  4. Click the Save button.

To view library evidence task implementations

You can easily view a list of implementations of the evidence task to improve reporting capabilities.

  1. On the Library Evidence Task screen, select the Implementations tab.
  2. Sort and filter this screen to view the related control implementations.

To view library evidence task activity history

  1. On the Library Evidence Task screen, select the Activity tab.
    The activity history appears.

  2. Click the Sort icon to change the order of the activity log (ascending/ descending).
  3. Click the Collapse All button to close the detail view for each item.
    Note:

    The Expand All button appears in place of the Collapse All button when all of the items are collapsed.