Step-by-Step Onboarding Guide: Policy Management

1

OneTrust pre-populates the attribute inventories with attributes commonly associated with each type of inventory.

You can add additional attributes to suit your organization's needs, edit the name and description of an attribute. When your custom attribute has been created and added to the Attribute Manager, you will have the opportunity to edit the attribute as needed.

You can also deactivate attributes you no longer wish to use.

Use the below article for further guidance:

Adding, Editing, and Deactivating Enterprise Policy Attributes

2

Using the Policy Management module, you can upload an existing policy, create a new custom policy, or create a new policy using a template in the Policy Gallery.

When you create or import a policy from the Policies menu, you are required to enter the policy name, organization, policy owner, and policy approver.

Once you complete the required fields, you have the option to complete additional fields as needed to add more details to your policy record.

When your policy has been created, you will have the opportunity to make changes and add information on the Policy Details screen. The Policy Details screen gives you the ability to edit policy details, write the policy using the policy builder, add controls, and add related inventories.

You can upload an existing policy, create your policy in the OneTrust Builder or by using Microsoft Word Online if your organization holds a Microsoft Word Online Subscription.

If you would like to upload a .doc or.docx file or utilize Microsoft Word Online, turn on the “Microsoft Word Online Integration” toggle in global settings under the Policy Management Tab.

Use the below articles for further guidance:

Creating a New Custom Policy

Using Microsoft Online to Create a Policy

Using the Enterprise Policy Gallery

Building and Editing a Policy

Deleting a Policy

3

Using the Policy Management module, you can link controls to a policy from your controls library.

When you add controls to the policy, you can select controls from one or multiple standards/frameworks such as FedRAMP, HIPPA, NIST CSF, and ISO 27001. The controls that you add will appear in the Controls tab of the Policy Details screen.

The Policy Details screen also gives you the ability to relate inventories to the policy using the Related tab. When you add a related inventory, you are required to select a specific inventory from the drop-down menu provided.

Use the below article for further guidance:

Managing Controls in the Policy Builder

4

When you create custom standards and procedures from the menu, you are required to enter the name, organization, owner, and approver.

Once you complete the required fields, you have the option to complete additional fields as needed to add more details to your standard or procedure record.

When your standard or procedure has been created, you will have the opportunity to make changes and add information on the Details screen.

The Details screen gives you the ability to edit details, upload or write the standard or procedure, add controls, and add related inventories. You can create your standards and procedures in the OneTrust Builder or by using Microsoft Word Online.

Use the below articles for further guidance:

Creating a Standard

Creating a Procedure

Building and Editing a Standard or Procedure

Configuring and Filtering Document Views

5

You can add and manage controls to individual sections of a standard or procedure to help manage your controls.

All controls that are added to the individual sections will be linked to the standard or control.

You can also add related assets, processing activities, vendors, entities, policies, standards, and procedures to a standard or procedure.

When relating an inventory to a standard or procedure, any controls associated with the record will be added to the inventory and controls associated with the inventory will be added to the standard or procedure.

Use the below articles as guidance:

Managing Controls in the OneTrust Builder

Relating Inventories to a Document

6

Workflows will assist with managing your organization's policies, standards, and procedures by using configured stages to help manage the lifecycle of policies, standards, and procedures with approval steps.

When you create a new workflow, you can choose either a standard workflow or, if you want to build approval stages, you can choose an advanced workflow. The new workflow will include preset stages.

Once you name the workflow, you can configure different stages to be included within the workflow as well as configure stage badge colors, stage names, and stage descriptions.

You can also build advanced workflows to configure approval stages, assign approvers, and automatically launch email notifications when approval is required. You can configure custom approval groups through your attribute manager.

You can set published workflows as the default workflow used for your policies.

Use the below articles as guidance:

Adding and Editing Enterprise Policy Workflows

Using the Workflow and Approval Tab

Approval Workflows FAQ

7

Organizational groups that exist within the application display in a diagram that illustrates the current order and hierarchy.

The organizations within the hierarchy are generally referred to as parent organizations, child organizations, and sibling organizations. When you create a new organization, you will need to give the organization a name, determine where it will appear in the hierarchy by assigning a parent organization, set a default language to use for emails sent from the organization, and select a default approver.

You can then enter any other additional details or go ahead and create the organization.

Users can then be assigned to their relevant organizational level, with the appropriate role.

The organizational hierarchy will be used to assign attestations to specific groups of users. It is important to keep this in mind when defining how to structure the organization in OneTrust.

Use the below articles for guidance:

Managing Organizations

Adding and Editing Users

8

Attestations allow users to acknowledge that they have read a policy.

When you create a new attestation, you are required to enter an Attestation Name, select an existing published document, and enter a deadline for the attestation. You can enter and select additional details as needed.

You can send attestations from published documents in the Enterprise Policy module. Attestations are sent to respondents by organization and can be tracked on the Attestation Details screen.

Respondents can respond to policy attestations using the Self-Service Portal. Once a respondent receives an invitation to attest a document, they will be directed to the portal where they can submit their acknowledgment and view other policies available for them to attest.

Use the below articles for guidance:

Adding, Editing, and Canceling Attestations

Sending Policy Attestations

Responding to Attestations in the Self-Service Portal

Attestations FAQ

9

The Policy Management Dashboard offers a comprehensive view of your organization's policies using visualizations and metrics.

You can build a custom dashboard and widgets with the goal of optimizing the comprehensive view of your policies. The widgets allow users to add Enterprise Policy attribute dashboard filters.

You will use a document PDF report to set the branding of PDF’s exported from your environment.

Use the below articles as guidance:

Using the Policy Management Dashboard

Adding and Configuring Dashboard Widgets

Creating and Configuring Enterprise Default PDF Reports

Complete!

Congratulations on completing your implementation.