IT & Security Risk Management Default Attributes

Aggregate Risk Level

How likely is it that this asset could expose personal information?

Single Select

Aggregate Risk Score

Overall risk score associated with asset.

Text

Aggregate Inherent Risk Level

Overall inherent risk level associated with asset.

Single Select

Aggregate Inherent Risk Score

Overall inherent risk score associated with asset.

Text

Aggregate Target Risk Level

Overall target risk level associated with asset.

Single Select

Aggregate Target Risk Score

Overall target risk score associated with asset.

Text

Collection Purpose

The purpose of collecting the data element.

Multi Select

Created By

Name of the user who created the record.

Single Select

Created Date

Date when the record was created.

Date

Data Disposal

Select the method used to destroy or archive data.

Single Select

Data Retention

Enter the length of time that the data is stored.

Text

Data Retention Period

Describe the data retention time limits for erasure/disposal for each of the different data elements processed for the activity.

Text

Description

Enter a brief description of the asset.

Text

External ID

Enter a unique identifier to support integration across applications.

Text

Hosting Location

Required

Select the physical location of the asset.

Single Select

Hosting Provider

Select the provider of the hosting location.

Single Select

Hosting Type

Select whether the asset is hosted locally or on an external cloud.

Single Select

ID

Enter an identifier unique to this type of inventory record.

Text

Internal or 3rd Party

Select the asset's status as internal or third party.

Single Select

Is Parent

Indicates if an Inventory is a parent record.

Single Select

Is Data Disclosed?

Is information disclosed, share with, or accessed by another party for business purposes?

Single Select

Is Data Sold?

Is information sold for monetary or other benefit/value as a part of the process?

Multi Select

Is Global Attribute Configuration Enabled

Indicates if global setting for attribute configuration is enabled.

Single Select

Is Parent

Indicates if the inventory is a parent.

Single Select

IT Owner

Select the individual responsible for the asset.

Single Select

Last Updated By

Name of the user who last updated the record.

Single Select

Last Updated Date

Date when the record was last updated.

Date

Legitimacy

Can you justify the need and relevance of the data?

Text

Managing Organization

Required

Enter the name of the organization that owns the asset.

Text

Master Record

The master inventory business key for a child inventory.

Text

Name

Required

Enter the name of the asset.

Text

Organizational Security Measures

Select all data protection measures active for your organization.

Multi Select

Other Security Measures

Enter a description for any additional security measures not included in the previous attribute.

Text

Security Classification

The security classification of the asset for the business.

Single Select

Status

Select the status of the asset.

Single Select

Storage Format

Select all storage formats in which the asset is stored.

Multi Select

Technical Security Measures

Select all active security measures protecting the asset.

Multi Select

Type

Select the type of asset.

Single Select

Volume of Data Subjects

Select the range of data subjects whose information is stored in the asset.

Single Select

Control Approver

Approver of the control implementation.

Multi Select

Control Owner

Owner of the implemented control.

Single Select

Deadline

The deadline of the control.

Date

Effectiveness

Effectiveness of an implemented control.

Single Select

Implementation ID

The Implementation ID.

Text

Maturity

Maturity of the implemented control.

Single Select

Notes

Notes for an implemented control.

Text

Source

Entity source of an implemented control.

Text

Source Type

Entity source type of an implemented control.

Text

Stage

The current stage of the control.

Single Select

Status

Status of the control.

Single Select

Category

Category of control.

Single Select

100 Character Limit

Control Name

Name of control.

Text

300 Character Limit

Description

Description of control.

Text

Standard/Framework

Framework of control.

Single Select

100 Character Limit

Control ID

ID of the control.

Text

Implementation Guidance

Implementation guidance of the control requirement.

Text

Organization

Organization in which the control has been created.

Single Select

Status

Status of control.

Single Select

Address

Enter the address of the entity.

Text

Aggregate Risk Level

Risk level of the entity.

Single Select

Aggregate Risk Score

Overall risk score associated with legal entity.

Text

Aggregate Inherent Risk Level

Overall inherent risk level associated with legal entity.

Single Select

Aggregate Inherent Risk Score

Overall inherent risk score associated with legal entity.

Text

Aggregate Target Risk Level

Overall target risk level associated with legal entity.

Single Select

Aggregate Target Risk Score

Overall target risk score associated with legal entity.

Text

Contact Details

Enter the name and contact details of the entity.

Text

Created By

Name of the user who created the record.

Single Select

Created Date

Date when the record was created.

Date

Critical Information Infrastructure Operator

Is the entity a Critical Information Infrastructure Operator?

Single Select

Data Protection Officer Contact Details

Enter the contact details of the data protection officer.

Text

Data Protection Officer Name

Enter the name of the data protection officer.

Text

Description

Enter a brief description of the entity.

Text

External ID

Enter a unique identifier to support integration across applications.

Text

ID

Enter an identifier unique to this type of inventory record.

Text

Internal or External

Select the entity's status as internal or external.

Single Select

Is Global Attribute Configuration Enabled

Indicates if global setting for attribute configuration is enabled.

Single Select

Is Parent

Indicates if an Inventory is a parent record.

Single Select

Last Updated By

Name of the user who last updated the record.

Single Select

Last Updated Date

Date when the record was last updated.

Date

Legal Entity Owner

Individual responsible for the legal entity information.

Single Select

Master Record

Master inventory business key for a child inventory.

Text

Name

Required

Enter the name of the entity.

Text

Organization

Required

Select the organization that owns the entity.

Single Select

Primary Operating Location

Required

Select the regional location of the entity.

Single Select

Representative Contact Details

Enter the contact details of the entity's representative.

Text

Representative Name

Enter the name of the entity's representative.

Text

Risk Manager Contact Information

Contact details of the risk manager for the entity.

Text

Risk Manager

Name of the individual who is the risk manager for the entity. This attribute pulls from the OneTrust system list of users.

Single Select

Status

Select the status of the entity.

Single Select

Type

Select the type of entity.

Single Select

Created By

Required

The name of the user who created the issue record.

System

Created Date

Required

The day the issue record was created.

Date and Time

Date Closed

The date in which the issue is closed.

Date and Time

Deadline

The date of the issue deadline.

Date

Description

A brief description of the issue.

Text

ID

Required

The unique issue ID.

Text

Issue Owner

The name of the user(s) who are the issue owners.

System

Name of Issue

Required

The name that describes the issue.

Text

Organization

Required

The organization responsible for the issue.

Single Select

Priority

Required

The priority level of the issue.

Single Select

Stage

Required

The current workflow stage of the issue.

Single Select

Status

The current status of the issue. Options include open and closed.

Single Select

Workflow

Required

The current workflow being used for the issue.

Single Select

Aggregate Risk Level

How likely is it that this asset could expose personal information?

Single Select

Aggregate Risk Score

Overall risk score associated with processing activity.

Text

Aggregate Inherent Risk Level

Overall inherent risk level associated with processing activity.

Single Select

Aggregate Inherent Risk Score

Overall inherent risk score associated with processing activity.

Text

Aggregate Target Risk Level

Overall target risk level associated with processing activity.

Single Select

Aggregate Target Risk Score

Overall target risk score associated with processing activity.

Text

Applicable Standards

The standards applicable to the processing activity.

Multi Select

Automated Decision Making

Existence of automated decision-making, including profiling (if applicable).

Single Select

Business Function

Primary business function that this processing activity supports.

Single Select

Business Process Owner

Select the individual responsible for the business process.

Single Select

Categories of Recipients of Sale of Personal Information of California Residents

Select the categories of recipients to whom the personal information of California residents is sold.

Multi Select

Categories of Recipients of Sale of Personal of Utah Residents

Categories of recipients to whom personal information of Utah residents is sold.

Multi Select

Categories of Recipients of Sale of Personal of Virginia Residents

Categories of recipients to whom personal information of Virginia residents is sold.

Multi Select

Collection Purpose

What is the purpose of collecting this data element?

Multi Select

Consent Attributes

What are the attributes you require for valid consent?

Multi Select

Consent Evidence

Do you retain evidence to demonstrate what each individual has consented to, what they were told, and when and how they consent ?

Single Select

Consent for Minors (15 years)

Parental or guardian consent for minors of 15 years old.

Single Select

Consent Withdrawal

Is withdrawing consent as easy as giving consent?

Single Select

Countries Utilizing Process

Select the country or countries utilizing the processing activity.

Multi Select

Created By

Name of the user who created the record.

Single Select

Created Date

Date when the record was created.

Date

Cross-Border Transfer Assessment

The processing activity requires performing a cross-border data transfer assessment (e.g. TIA, TRA, DTA etc.).

Single Select

Cross-Border Transfer Conditions

Conditions to provide personal information outside of China.

Single Select

Cross Border Transfer Mechanism(s)

Select the mechanism(s) in place for the transfer of personal information out of the European Economic Area (EEA).

Multi Select

Data Accuracy

Steps taken to ensure accuracy of data.

Multi Select

Data Breach Occurrence

Has any data breach ever occurred?

Single Select

Data Minimization

Steps taken to ensure minimization of data.

Multi Select

Data Protection Assessment Criteria (US)

Processing activity elements mapped across the US Privacy Laws requiring a mandatory risk review (Data Protection Assessment).

Multi Select

Data Protection Impact Assessment

Is a data protection impact assessment required and what's its progress?

Multi Select

Data Retention

Enter a brief description of the data retention time limits for the disposal of the different processed data categories for this processing activity.

Text

Data Retention Period

Describe the data retention time limits for erasure/disposal for each of the different data elements processed for this activity.

Text

Data Source

Select all applicable data sources involved in the processing activity.

Multi Select

Data Subject Notice Description

What attributes describe the notice used to inform data subjects of their rights?

Multi Select

Data Subject Rights Ensured

Select the data subject rights you ensure.

Multi Select

Data Subject Rights Exercise

Methods adopted to allow the data subjects to exercise their rights in practice.

Text

Data Subjects Region

Select all regions in which the data subjects reside.

Multi Select

Data Subjects Volume

Select all volumes applicable to the selected types of data subjects.

Multi Select

Derogation or Suitable Safeguards (Art. 49)

Describe the derogations or suitable safeguards pursuant to article 49 of the GDPR.

Text

Description

Enter a brief description of the processing activity.

Text

Destinations

Select all destinations that the data may be sent to.

Multi Select

DPIA WP29 Criteria

Criteria that may trigger a Data Protection Impact Assessment according to WP29 Guidance.

Multi Select

DPO Opinion

Opinion of the DPO.

Text

External ID

Enter a unique identifier to support integration across applications.

Text

ID

Enter an identifier unique to this type of inventory record.

Text

Is Data Disclosed?

Is information disclosed, shared with, or accessed by another party (whether infernal or 3rd party) for a business purpose?

Single Select

Is Data Sold?

Is information sold for monetary or other benefit value as a part of the process?

Single Select

Is Global Attribute Configuration Enabled

Indicates if global setting for attribute configuration is enabled.

Single Select

Is Parent

Indicated if an Inventory is a parent record.

Single Select

Last Updated By

Name of the user who last updated the record.

Single Select

Last Updated Date

Date when the record was last updated.

Date

Legal Basis for Processing

Select all legal bases allowing for the collection of the data for this processing activity.

Multi Select

Legitimacy

Can you justify the need and relevance of the data ?

Text

Legitimate Interest

What are the legitimate interests you are pursuing?

Multi Select

Locations of Parties (Access/Use)

Select all locations of recipients who may access or use the data.

Multi Select

Managing Organization

Required

Select the organization that owns the business process.

Single Select

Master Record

The master inventory business key for a child inventory.

Text

Minimization Controls

What are the minimization controls applied to this data element?

Multi Select

Name

Required

Enter the name of the processing activity.

Text

Organizational Security Measures

Organizational measures to ensure the protection of personal information.

Multi Select

Parties who Access/Use Data

Select all recipients who may have access to the data.

Multi Select

Personal Information Impact Assessment

Criteria that trigger a Personal Information Impact Assessment.

Multi Select

Policy Document

Select the policy document.

Text

Preliminary Authorization for Processing

Is the processing activity subject to prior authorization from the Regulator?

Multi Select

Processing Location

The location where the processing activity takes place.

Multi Select

Purpose Limitation

Select the purpose limitations.

Multi Select

Purpose of Processing

Select all categories of business purposes for processing data.

Multi Select

Sale of Consumer Health Information (Washington)

Confirmation of a selling act in the processing activity.

Single Select

Sale of Consumer Health Information (Washington) OT

Confirmation of a selling act in the processing activity.

Single Select

Sale of Personal Information of California Residents

Select whether the personal information of California residents is sold to third parties.

Single Select

Sale of Personal Information of Minor California Residents

Select whether the personal information of California residents under the age of 16 is sold to third parties.

Single Select

Sale of Personal Information of Utah Residents

Whether personal information of Utah residents is "sold" to third parties.

Single Select

Sale of Personal Information of Virginia Residents

Whether personal information of Virginia residents is "sold" to third parties.

Single Select

Schedule Condition for Processing

Further conditions for processing required by the Data Protection Act 2018, Schedule 1.

Single Select

Security Considerations

Considerations taken into account for choosing security measures.

Multi Select

Selling or Sharing Valid Authorization

Confirmation if business collected distinct consents for consumer health data collection and further sharing or selling.

Single Select

Sharing of Consumer Health Information (Washington)

Confirmation of a sharing act in the processing activity.

Single Select

Sharing of Consumer Health Information (Washington) OT

Confirmation of a sharing act in the processing activity.

Single Select

Status

Select the status of the processing activity.

Single Select

Storage Limitation

Select the storage limitation.

Multi Select

Targeted Advertising Exemptions

Processing activities exempted from the Targeted Advertising considering exemptions from State Privacy Laws at United States (US).

Multi Select

Technical Security Measures

Technical measures to ensure the protection of personal information.

Multi Select

Transfer Method (From Sources)

Select all methods of collecting data into the primary storage asset.

Multi Select

Transfer Method (To Destinations)

Select all methods of transferring data from the primary storage asset to an additional destination asset.

Multi Select

Type

Select the type of processing activity.

Single Select

Use Limitation

Steps taken to ensure that data are not further processed in a manner incompatible with those purposes.

Multi Select

Vendor DPA

Is there a data processing agreement in place?

Single Select

Category

The category used from the risk categories.

Multi Select

Children risks

The levels of hierarchy refer to the number of layers within a Risk Taxonomy organized to build a Risk Hierarchy association i.e. Parent-Child risks.

Numerical - Text

Closure note

Notes to describe the reason for closing the risk

Text area

Date closed

Date the risk has been closed.

Date

Date Ccreated

Date when the risk was created.

Date

Deadline

Date by when the risk needs to be reduced

Date

Description

A brief description of the risk.

Text

Hierarchy level

The levels of hierarchy refer to the number of layers within a Risk Taxonomy organized to build a Risk Hierarchy association, e.g. parent-child risks.

Numerical - Single Select

ID

The ID of the risk.

Text

Inherent Risk Impact Level

What is the Impact of the inherent risk?

Single Select

Inherent Risk Probability Level

What is the probability of the inherent risk?

Single Select

Inherent risk rollup score

Overall inherent risk rollup score

Score

Inherent Risk Score

Overall inherent risk score.

Single Select

Last Updated By

Name of the user who last updated the record.

Single Select

Last Updated Date

Date when the record was last updated.

Date

Organization

The organization in which the risk was created.

Single Select

Orphan

Orphans are objects without any parent or child objects associated. Orphans appear because the parent object is deleted or does not exist for some other reason.

Single Select

Parent

To quantify and track common risks impacting enterprise as a whole, use this section to identify Headline/ Top Level Risks. View the name of the parent risk established for the risk recorded into the system.

Text

Reason for closure

The reason for closing the risk record.

Single select

Reminder

How many days before the deadline should a reminder be sent out?

Text

Residual Risk Impact Level

What is the impact of the residual risk?

Single Select

Residual Risk Probability Level

The probability of the residual risk.

Single Select

Residual risk rollup score

The overall residual risk rollup score.

Score

Residual Risk Score

Overall residual risk score.

Single Select

Result

Result of the risk.

Single Select

Risk appetite

Risk appetite is the amount and type of risk that an organization is willing to accept or retain in pursuit of its objectives. It reflects the organization's willingness to take risks to achieve its strategic goals.

Numerical - Single Select

Risk Approver

The user(s) who serve as the final authority in the risk management process, reviewing and approving assessments to ensure risks are properly evaluated and addressed. Risk Approvers work with Risk Managers and Control Owners to align mitigation strategies with organizational goals. Through oversight and collaboration, Risk Approvers uphold the integrity of the risk framework and foster a culture of accountability and resilience. Risk Approvers can:

• Access risks where they are assigned as the Risk Approver

• Access related risk tasks and issues

• Access related risk assessments

• Access to risk reports and dashboards

Multi Select

Risk Manager

The user(s) responsible for managing the risk throughout its lifecycle which includes creating and managing risk templates, assessments, attributes, and workflows. This attribute allows you to capture and display Risk Manager details in the following locations: 

• Key Risk Information on the Risk Details screen

• Activity logs

• Automation rules

• Risk Register export

• Risk Users section on the Risk Details screen

• Template rules

• Workflow rules

• Workflow stage rules

Multi Select

Risk Name

Required

A short risk name that helps to identify and reference risks throughout the organization.

Text

Risk Owner

The user(s) responsible for identifying, assessing, and managing risks. Risk Owners collaborate with Risk Managers and Control Owners to implement effective controls and conduct regular assessments. By fostering a culture of risk awareness and accountability, Risk Owners support the organization’s risk management framework and strategic objectives. Risk Owners can:

• Access risks where they are assigned as the Risk Owner

• Access related risk tasks and issues

• Access related risk assessments

• Access to risk reports and dashboards

Multi Select

Risk Template

The risk template used from Risk Library.

Text

Risk tolerance

The risk tolerance is the acceptable level of variation an organization is willing to tolerate in the achievement of its objectives. It quantifies the amount of risk an organization is willing to accept or retain.

Numerical - Single Select

Source

Source of the risk.

Text

Stage

Stage of the risk.

Single Select

Target Risk Impact Level

What is the impact of the target risk?

Single Select

Target Risk Probability Level

What is the probability of the target risk?

Single Select

Target Risk Score

Overall target risk score.

Single Select

Threat

The threat used from the Threat Library.

Single Select

Treatment

What needs to be done to reduce the risk?

Text

Treatment Plan

Plan to treat the risk.

Text

Treatment Status

Status of the risk treatment.

Single Select

Type

The type of risk.

Text

Vulnerability

The vulnerability used from Vulnerability Library.

Multi Select

Category

Category of the threat.

Single Select

100 Character Limit

Description

Description of threat.

Text

Framework

Framework of threat.

Single Select

100 Character Limit

ID

ID of the threat.

Text

Organization

Organization in which the threat has been created.

Single Select

Status

Status of threat.

Single Select

Threat Name

The name of the threat.

Text

Address

Primary street address where the third party is located.

Text

Address 2

Secondary street address where the third party is located.

Text

Adverse Media (Organization)

Adverse Media associated with an organization.

Score - Standard

Adverse Media (Person)

Adverse Media associated with a person.

Score - Standard

Aggregate Risk Level

Overall risk level associated with vendor.

Single Select

Aggregate Risk Score

Overall risk score associated with vendor.

Text

Aggregate Inherent Risk Level

Overall inherent risk level associated with vendor.

Single Select

Aggregate Inherent Risk Score

Overall inherent risk score associated with vendor.

Text

Aggregate Target Risk Level

Overall target risk level associated with vendor.

Single Select

Aggregate Target Risk Score

Overall target risk score associated with vendor.

Text

Alternate First Name

An alternate first name for an individual.

Text

Alternate Middle Name

An alternate middle name for an individual.

Text

Alternate Name

An alternative name for the organization. Note that information in this field is informational only and does not get submitted for screening.

Text

Applicable Surveillance or Security Laws

Applicable surveillance and security laws, judgements or other legal frameworks.

Multi Select

BitSight Domain

Domain from the BitSight platform.

Text

BitSight Industry

Industry for the vendor from BitSight.

Text

BitSight Rating

Rating for the vendor from BitSight.

Text

BitSight Rating Date

Date of last rating from BitSight.

Date

Board Member

Indicates a person that is a board member of a State-Owned Company.

Score - Standard

Business Owner

Name of the internal owner sponsoring the vendor.

Single Select

City

The city where the third party is located.

Text

Classification

How a vendor is classified.

Single Select

Contact Phone Number

The primary contact phone number.

Text

Country

The Country or Territory where the third party is located.

Single Select

CPI Risk Score

The range displayed contributes to the calculation of the Initial Risk Score.

Score - Standard

CPI Score

This score is provided by Transparency International based on various criteria to indicate geographic risk. Countries lacking a CPI Score are marked as N/A.

Text

Created By

Name of the user who created the record.

Single Select

Created Date

Date when the record was created.

Date

Critical Information Infrastructure Operator

Is the vendor a Critical Information Infrastructure Operator?

Single Select

Criticality

How critical the vendor is to the business?

Single Select

Data Collected

Data Collected under the EU-U.S. Privacy Shield.

Text

Data Processing Agreement

The contract governing privacy issues between two organizations.

Single Select

Date of Birth

The date of birth of the individual used to improve the accuracy of screening results.

Date

Description

Description of the vendor.

Text

DUNS Number

The DUNS number is an identifier provided by Dun & Bradstreet.

Text

Enhanced Country Risk

Vessels that are either flagged or associated with Cuba, Iran, North Korea and Syria.

Score - Standard

Entity Type

Identifies whether an entity is a person or organization to associate proper attributes and optimize screening results.

Single Select

EU-US-DPF Covered Entities

The EU-US-DPF Covered Entities.

Text

EU-US-DPF Notice Link

The EU-US-DPF Notice Link.

Text

EU-US-DPF Status

The EU-U.S. Privacy Shield Status.

Single Select

External ID

This field contains a unique identifier for the record from a system outside of OneTrust.

Text

First Name

The first name.

Text

Frequency of Transfer

The frequency of transfers.

Text

Gender

Gender can improve the accuracy of screening results.

Single Select

ID

This field contains a unique identifier for the record of a particular inventory type.

Text

Is Global Attribute Configuration Enabled

Indicates if global setting for attribute configuration is enabled.

Single Select

Is Parent

Indicates if an Inventory is a parent record.

Single Select

Last Name

The last name.

Text

Last Updated By

Name of the user who last updated the record

Single Select

Last Updated Date

Date when the record was last updated.

Date

Location

Country where the vendor is headquartered.

Single Select

Master Record

Master inventory business key for a child inventory.

Text

Middle Name

The middle name.

Text

Monitoring Enabled

Indicates that the third party is currently monitored by Dow Jones.

Single Select

Name

Name of the vendor.

Text

Next EU-U.S. Certification Date

The next EU-U.S. Certification Date.

Date

No Match

No profiles matched the screening criteria.

Score - Standard

Organization

OneTrust Organization Group

Single Select

Original EU-U.S. Certification Date

The original EU-U.S. Certification Date.

Date

Other Exclusion List

Lists typically excluding persons or organizations from public sector activities.

Score - Standard

Other Official List

Lists compiled by supervisory authorities, regulators and law enforcement agencies. Examples include travel bans, trade restrictions, exclusion lists, and arms embargoes.

Score - Standard

Personal Data Disclosure / Access

Will any personal data be shared with the vendor?

Single Select

Phone

The contact phone number.

Numerical - Text

Politically Exposed Person

Senior ranking public officials (both governmental and non-governmental).

Score - Standard

Postal Code

The postal code.

Text

Primary Vendor Contact

Name of the vendor's primary contact.

Single Select

Processing Activity Locations

Where does this vendor process personal data?

Multi Select

Product/Service

The specific product or service that the vendor provides.

Text

Purpose of Data Collection

The purpose of the data collection.

Text

Relative or Close Associate

Persons identified as a Relative or Close Associate of a PEP.

Score - Standard

Sanctions

A person or organization that is subject to comprehensive or targeted restrictive measures.

Score-Standard

Sanctions Control (Ownership)

Indicates an organization either owned or controlled by sanctioned persons or organizations listed on an OFAC or EU sanctions program.

Score - Standard

Screening Completed Date

Date and time (UTC) the most current screening was completed.

Date

Security Measures

Security measures applied to the transfers of information.

Single Select

State/Province/District

State/province/district where the third party is located.

Text

State-Owned Company

Any corporate structure where a government body owns 1% or more, holds majority voting control, and/or has the power to appoint a majority of the members of the organization's administrative, managerial or supervisory bodies.

Score - Standard

Status

Status of Vendor

Single Select

Subprocessors or Subcontractors Locations

Location of the subprocessors and subcontractors.

Multi Select

Swiss-US DPF Status

The Swiss-U.S. Data Privacy Framework Status.

Single Select

Third Party Type

Identifies whether the third party is a person or organization.

Single Select

Transfer Assessment Result

Transfers to this vendor have been deemed safe or unsafe based on your data transfer assessments.

Single Select

Type

The type of product or service that the vendor provides.

Single Select

UK-US DPF Extension Status

The UK-U.S. Data Privacy Framework Extension Status.

Single Select

Vendor Assessment

Has the vendor been assessed for compliance with applicable legal and contractual requirements?

Single Select

Vendor Contact

The privacy shield vendor contact.

Text

Vendor ID

ID of vendor for matching with external systems.

Text

Vendor Rating

Vendor Score

Single Select

Vendor Workflow

The vendor workflow.

Single Select

Vendor Workflow Stage

The vendor workflow stage.

Single Select

View Vendor in BitSight

This link will bring you to vendor record in the BitSight platform.

Text

Category

Category of the vulnerability.

Single Select

100 Character Limit

Description

Description of vulnerability.

Text

Framework

Framework of vulnerability.

Single Select

100 Character Limit

ID

ID of the vulnerability.

Text

Organization

Organization in which the vulnerability has been created.

Single Select

Status

Status of vulnerability.

Single Select

Vulnerability Name

The name of the vulnerability.

Text