Policy Management Overview

Introduction to Policy Management

Policy management is critical to establishing the appropriate guidelines and culture across your organization. However, if you manage policies manually across decentralized tools like emails, documents, and shared folders – you understand that it’s a process filled with inefficiencies.

Utilize OneTrust GRC Policy Management to store, develop, and maintain your policies through their lifecycle. Start by centralizing your library of policies, procedures, and standards. Then, bring in all your policy collaborators and stakeholders into a single solution, manage review and approval with robust workflows, and engage the right people at the right time with attestation campaigns. Lastly, gain visibility into your data with reports and dashboards.

Policy Management is part of the GRC & Security Assurance cloud with OneTrust. To learn more, see the Policy Management knowledge base.

Note:

For a demo on Policy Management, watch the video here.

Module Benefits:

  • Collaborate across stakeholders in a centralized policy library

  • Manage policy attestations

  • Track policy exceptions

  • Put policy maintenance on auto-pilot

  • Gain visibility with reports and dashboards

Problems Solved by Policy Management:

Centralize Your Policies

: Create a single source of truth, where you develop and maintain policies, procedures and standards. Link policies to controls, standards, procedures, assets, vendors and processing activities to simplify management, establish context and increase visibility

Build a Policy Development Workflow

: Reflect your unique processes including terminology, phases, and mandatory reviewers, with capture time-stamped evidence of review and approval with a comprehensive audit log

Manage Policy Attestations

: Run more effective and efficient attestation campaigns with a centralized portal and localization features to view applicable policies. Follow up with unattested individuals based on their attestation status

Put Policy Maintenance on Auto-Pilot

: Set a policy expiration date and kick off the review cycle on a cyclical basis with workflow rules

Gain Visibility with Reports and Dashboards

: Save time reporting on attestation status, compliance coverage and exceptions, and deliver a detailed audit trail of versions and changes over time.

Typical Users

Admins or key users of Policy Management would report to or have the following titles:

  • General Counsel or Legal

  • Privacy Program Manager

  • Chief Information Officer

  • Chief Compliance Officer or Compliance Manager

  • Chief Data Officer or Data Protection Officer

  • Chief Privacy Officer

  • Human Resources

Policy Management Module Terminology

Note:

For a full list of terms and definitions related to Policy Management, read the article here.

Policy Management Terminology

Terminology Context/Definition

Standards

An objective and quantifiable expectation that formally establishes requirements regarding a process, action, or configuration within an organization.

Procedures

A living document that describes a process and updates based on changes to the organization, technology, and staffing.

Attestations

An attestation launched from a published document allows users to acknowledge that they have read a document.

Exceptions

Users can request exceptions for policies, procedures, or standards using the Policy module to help track the entire lifecycle of an exception. The exception captures the rationale, comments, and evidence to support the acceptance or rejection of a document upon request.

Framework Examples

OneTrust Policy Management provides a solution that can help organizations fulfill the requirements to comply with many frameworks and certifications. Below is a list of some of the popular privacy and legal frameworks that this module can help with.

Framework

Framework Description

SOC 2

SOC 2, published by the American Institute of Certified Public Accountants (AICPA), is a reporting framework designed to help companies assess their policies and controls. It uses the AICPA’s Trust Services Criteria (TSC) to check systems for security, privacy, confidentiality, availability, and processing integrity. Reports are done by independent AICPA-licensed auditors and come in two types: Type I describes the organization's system and if it meets the relevant trust principles, and Type II details the operational efficiency of these systems over time. SOC 2 is by far the most requested InfoSec framework and audit process in the US, signifying that an organization can be trusted to secure its customers and sensitive data.

To obtain SOC 2 compliance, organizations need to implement security controls to maintain key security policies and manage their attestations, which Policy Management provides a solution for.

Note:

To learn more about the SOC2 Framework, read our blog post here.

ISO 27001

ISO 27001 is a flexible standard, allowing organizations or service providers to determine the scope of its information security management system (ISMS). The ISMS encompasses all the applications, systems, processes, and people your organization needs to protect. ISO 27001 remains one of the most popular global security standards.

Note:

To learn more about the ISO 27001 Framework, read our blog post here.

Relationship in OneTrust Platform

Policy Management can integrate with other OneTrust modules to enable enhanced features:

IT & Security Risk Management (ITRM)

Can link standards, policies, and procedures to existing control libraries