Adding Risk and Control Categories

You can add and manage the categories available for managing the risks, controls, threats, and vulnerabilities added in the application. Categories can be used to group objects together by impact, importance, and other criteria.

Seeded Risk Categories

The OneTrust Platform provides a set of pre-seeded risk categories that are already available in the system. These categories can be used for risks and business objectives. Leveraging these predefined categories helps ensure consistency across records, saves time during data entry, and supports more accurate reporting and analysis.

Risk Categories

Name

Description

Artificial intelligence

AI risk includes challenges related to AI transparency, ethical considerations, and model reliability. It encompasses concerns about AI bias, security vulnerabilities, regulatory compliance, and the potential for AI-driven disruptions.

Availability

Impact resulting from data not readily accessible for authorized access.

Confidentiality

Impact due to unauthorized data access or disclosure.

Customer

Customer risk refers to the potential for harm to the organization due to misaligned expectations, inadequate support, poor customer experience, or declining satisfaction.

Data life cycle

Data and information risk encompasses challenges in managing data quality, governance, and security. This includes risks from improper data classification, inadequate lifecycle management, and AI-related data integrity issues.

Environmental, Social, and Governance (ESG)

ESG risk includes sustainability challenges, climate-related risks, corporate ethics concerns, and compliance with diversity, equity, and inclusion (DEI) initiatives.

Financial

The danger or possibility that shareholders, investors, or other financial stakeholders will lose money.

Geographic

Risk that arises when exposure is concentrated within certain geographic areas.

Governance

Governance risk encompasses shortcomings in leadership oversight, decision-making processes, and alignment with corporate objectives. It includes gaps in board accountability, ethical considerations, and strategic misalignment.

Integrity

Impact from data modified or tampered with in an unauthorized manner.

Operational

The prospect of loss resulting from inadequate or failed procedures, systems or policies.

Operational resilience

Operational resilience risk focuses on an organization's ability to withstand disruptions, including business continuity threats, disaster recovery challenges, and supply chain weaknesses.

People

People risk encompasses potential threats arising from the internal workforce, including skills gaps, employee turnover, misconduct, insider threats, and compliance issues, which can significantly impact organizational performance and security.

Privacy

Potential loss of control over personal information.

Regulatory/compliance

Regulatory and compliance risk refers to potential non-compliance with evolving local, regional, and global regulations. It includes challenges in keeping up with legal changes, industry standards, and audit requirements.

Regulatory / Compliance

Risk that a change in laws and regulations will materially impact a security, business, sector, or market.

Reputational

The potential for negative publicity, public perception or uncontrollable events to have an adverse impact on a company's reputation.

Security

The impacts to an organization and its stakeholders that could occur due to the threats and vulnerabilities associated with the operation and use of information systems and the environments in which those systems operate.

Strategy

The risk that failed business decisions, or lack thereof, may pose to a company.

Technology and cybersecurity

Technology and cybersecurity risk includes threats such as system outages, cyberattacks, and data breaches. It also encompasses risks stemming from outdated technology, inadequate authentication and access risks, poor change management, ineffective incident response, and insufficient patch management.

Vendor and third-party

Vendor and third-party risk includes potential threats arising from external partnerships, service providers, and supply chains. These risks involve vendor non-compliance with agreements, dependencies on these third parties, cybersecurity vulnerabilities, and operational disruptions due to reliance on critical suppliers.

To add a new category

  1. On the IT & Security Risk Management menu, select Setup > Categories.
    The Categories screen appears.

  2. Click the View button on the type of category you would like to configure.
  3. Click the Add New button.
    The Add Category modal appears.

    Field
    Description
    Name

    Enter a name for the category.

    Description

    Enter a brief description of the category.

  4. Complete the fields.
  5. Click the Add button.

To edit a category

You can edit custom categories. Making changes to a category will also update any objects associated with the category.

Note:

You cannot edit the default categories included in the application.

  1. Navigate to the Categories list screen.
  2. Hover over the row for the category you want to edit until the Context Menu icon appears.
  3. Click the Context Menu icon.
  4. On the Context menu, select Edit Category.

    The Edit Category Details modal appears.

  5. Update the fields, as necessary.
  6. Click the Add button.

To archive a category

You can archive categories to prevent users from selecting them as the category for an object.

  1. Navigate to the Categories list screen.
  2. Hover over the row for the category you want to archive until the Context Menu icon appears.
  3. Click the Context Menu icon.
  4. On the Context menu, select Archive Category. A confirmation dialog appears.
  5. Click the Confirm button.

To translate risk category names and descriptions

You can translate the names and descriptions of your risk categories into any of OneTrust's supported languages.

  1. Navigate to the Categories list screen.
  2. Hover over the row for the category you want to translate until the Context Menu icon appears.
  3. Click the Context Menu icon.
  4. On the Context menu, select Translate Name or Translate Description.

    The Update Term modal appears.

  5. Enter the translated value of the category name or description for each language you want to add.
    Note:

    OneTrust provides default translated values for the default categories in the application. You can customize these to meet your organization's needs.

  6. Click the Save button.