Managing Risks in Bulk

You can create and update risk records in bulk using the Create Risks and Update Risks import templates. These templates allow you to bulk create and edit risk records for inventory items using a Microsoft Excel spreadsheet that can be imported into OneTrust.

To complete a bulk import template

  1. Click the Gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Data Import > Import Templates.
    The Import Templates screen appears.
    Note:

    You can also access this screen by clicking the Context Menu button on the Risk Register screen.

  3. Click the Download button on the Create Risks or the Update Risks tile to download the bulk import template.
  4. Open the document in Microsoft Excel.
  5. Update the fields for the downloaded template as needed. For more information, see Bulk Import Template Fields.
  6. Save the template to your computer.

Bulk Import Template Fields

Attention:

Special characters are not supported for bulk import templates. If you use special characters in this spreadsheet, you will receive the Error creating risk message.

The templates will list the active and custom attribute fields that the user can edit. The Options tab displays all single-select and multi-choice attribute options.

Note:

All fields are optional unless noted otherwise. If a required field is left blank, the import will fail. If an optional field is left blank, the current data in OneTrust will be overwritten as blank.

If an optional column does not need to be updated, remove the column from the update template spreadsheet. The existing data will remain in OneTrust.

If only certain data within a column needs to be updated, copy the existing contents of the column from the exported inventory spreadsheet and paste the contents into the update template spreadsheet to prevent the existing content from being overwritten. Then complete any updates to the content, as necessary.

Create Risks Import Template



Field
Description
Inventory ID

Enter the inventory ID of the asset, processing activity, entity, or vendor.

Note:

The Inventory ID field requires GUID values. For more information, see To locate GUIDS.

Inventory Type

Select the type of inventory that corresponds to your inventory ID.

Note:

Inventory Type field options can be found on the Options tab.

Risk Name

Enter a name for the risk.

Description

Enter a description of the risk.

Organization Required

Select the organization responsible for the risk.

Note:

Organization field options can be found on the inventory export.

Category

Select the associated category the risk falls under.

Note:

Category field options can be found on the Options tab.

Threat

Select the threat for the risk.

Note:

The Threat field requires GUID values. For more information, see To locate GUIDS.

Vulnerability

Select the vulnerability for the risk.

Note:

The Vulnerability field requires GUID values. For more information, see To locate GUIDS.

Treatment Plan

Enter a plan to control, mitigate, and/or resolve the risk.

Treatment

Enter the treatment for the risk.

Risk Approver

Enter the email address of the person responsible for approving the risk.

Note:

You can separate multiple risk approvers by using a | symbol. For example, cleclair@ghughes.com|cgreen@ghughes.com.

Risk Owner

Enter the email address of the person responsible for remediating the risk.

Note:

You can separate multiple risk owners by using a | symbol. For example, cleclair@ghughes.com|cgreen@ghughes.com.

Deadline

Enter the date by when the risk must be resolved.

Note:

The Deadline column must be formatted as YYYY-MM-DDThh:mm:ss.000Z. For example, 2020-12-01T12:00:00.000Z.

You cannot enter dates in the past.

Reminder

Enter the number of days before a deadline that a reminder is sent.

Related

Enter the name and GUID ID of the related inventory record. Relationships can only be added, not removed when using the bulk import template.

Note:

The Related field requires GUID values. For more information, see To locate GUIDS. The GUID values must be placed after the inventory type name. For example:

  • ASSETS:87e5ad2d-de89-4725-b347-80519288eae8

  • PROCESSING_ACTIVITIES:450e11e2-aada-402c-a6af-45e3c5c2334f

  • VENDORS:26df5294-a096-479f-8fb0-06361782a4e6

  • ENTITIES:9240707d-8c57-443e-9aa5-2b5cdc0bceff

  • ENGAGEMENTS:b11325b3-d910-48bc-b08d-8feb54fb1334

To associate multiple inventories of the same type, separate the UUIDs with commas. For example, ASSETS:77743cf0-6870-4c67-a8ab-42a9226e6e70,74ec8565-4936-45dc-b3a7-74489bcf8a7d

To associate different inventory types, separate each inventory type and UUID combination with a pipe (|). For example, ASSETS:77743cf0-6870-4c67-a8ab-42a9226e6e70|VENDORS:fbf77708-b344-4f68-b49e-c876725f4de2

Control IDs

Add a control IDs to your risk.

Note:

The Control IDs field requires GUID values. For more information, see To locate GUIDS.

You can separate multiple controls by using a | symbol.

Workflow| Stage

Enter the workflow name and stage in which the risk will be entered.

Note:

If workflow data is added to the import template, workflow rules will not be triggered. If workflow data is not added to the import template, attribute updates will be used as part of the workflow rules.

The Workflow|Stage can be found on the Options tab.

Treatment Status

Select the treatment status of the risk.

Note:

The treatment status can be found on the Options tab.

Monitoring Result

Select the monitoring result of the risk.

Note:

The monitoring result can be found on the Options tab.

Comments

Enter comments relevant to the risk record.

Inherent Impact Level

Select the inherent impact level.

Note:

This field only appears if you choose the matrix setting for risk configuration.

Inherent Impact Level field options can be found on the Options tab.

Inherent Probability Level

Select the inherent probability level.

Note:

This field only appears if you choose the matrix setting for risk configuration.

Inherent Probability Level field options can be found on the Options tab.

Update Risk Import Template



Important:

Risks that are currently in a closed state, whether closed using the default workflow or a custom workflow, can be updated using the Update Risks import template. This allows for easier maintenance and ensures your risk records remain accurate and up to date.

Field
Description
Risk ID Required

Enter the Risk ID of the risk.

Note:

The Risk ID field requires risk GUID values. For more information, see To locate GUIDS.

Risk Name

Enter the name of the risk.

Description

Enter a description of the risk.

Category

Select the associated category the risk falls under.

Note:

Category field options can be found on the Options tab.

Threat

Select the threat for the risk.

Note:

The Threat field requires GUID values. For more information, see To locate GUIDS.

Vulnerability

Select the vulnerability for the risk.

Note:

The Vulnerability field requires GUID values. For more information, see To locate GUIDS.

Treatment Plan

Enter a plan to control, mitigate, and/or resolve the risk.

Treatment

Enter the treatment for the risk.

Risk Approver

Enter the email address of the person responsible for approving the risk.

Risk Owner

Enter the email address of the person responsible for remediating the risk.

Deadline

Enter the date by when the risk must be resolved.

Note:

The Deadline column must be formatted as YYYY-MM-DDThh:mm:ss.000Z. For example, 2024-12-01T12:00:00.000Z.

You cannot enter dates in the past.

Reminder

Enter the number of days before a deadline that a reminder is sent.

Related

Enter the GUID ID of the related inventory record. Relationships can only be added, not removed when using the bulk import template.

Note:

The Related field requires GUID values. For more information, see To locate GUIDS. The GUID values must be placed after the inventory type name. For example:

  • ASSETS:87e5ad2d-de89-4725-b347-80519288eae8

  • PROCESSING_ACTIVITIES:450e11e2-aada-402c-a6af-45e3c5c2334f

  • VENDORS:26df5294-a096-479f-8fb0-06361782a4e6

  • ENTITIES:9240707d-8c57-443e-9aa5-2b5cdc0bceff

To associate multiple inventories of the same type, separate the UUIDs with commas. For example, ASSETS:77743cf0-6870-4c67-a8ab-42a9226e6e70,74ec8565-4936-45dc-b3a7-74489bcf8a7d

To associate different inventory types, separate each inventory type and UUID combination with a pipe (|). For example, ASSETS:77743cf0-6870-4c67-a8ab-42a9226e6e70|VENDORS:fbf77708-b344-4f68-b49e-c876725f4de2

Control IDs

Add a control library IDs to your risk.

Note:

This field accepts only Control library ID GUID values. If you enter an Implementation control ID GUID, the system will return an Invalid Control ID Value error. For more information, see To locate GUIDS.

You can separate multiple controls by using a | symbol.

Workflow|Stage

Enter the workflow name and stage in which the risk will be entered.

Note:

If workflow data is added to the import template, workflow rules will not be triggered. If workflow data is not added to the import template, attribute updates will be used as part of the workflow rules.

The Workflow|Stage can be found on the Options tab.

Treatment Status

Select the treatment status of the risk.

Note:

The treatment status can be found on the Options tab.

Monitoring Result

Select the monitoring result of the risk.

Note:

The monitoring result can be found on the Options tab.

Comments

Enter comments relevant to the risk record.

Inherent Risk Level

Select the inherent risk level.

Note:

This field only appears if you choose the matrix setting for risk configuration.

Inherent Risk Level field options can be found on the Options tab.

Inherent Probability Level

Select the inherent probability level.

Note:

This field only appears if you choose the matrix setting for risk configuration.

Residual Risk Level field options can be found on the Options tab.

Target Risk Level

Select the target risk level.

Note:

This field only appears if you choose the matrix setting for risk configuration.

Target Risk Level field options can be found on the Options tab.

To import a completed bulk import template

  1. On the Import Template screen, click the New Import button.

    The New Import modal appears.

  2. Complete the fields. For more information, see New Import Modal Screen Reference.
  3. Click the Submit button.
  4. To view the status and result of your bulk import, select Data Import > Bulk Import on the Global Settings menu.
    Note:

    If there was an error with the upload, click the error link in the Result column to download a report indicating the errors.

New Import Modal Screen Reference



Field
Description
Import Name

Enter a name for the import.

Import Description

Enter a brief description of the import.

Import Type

Select Create Risks or Update Risks.

File

Click the Upload File button to select the field you want to import.

To locate GUIDS

GUIDS are unique identifiers required when creating and updating risk records in bulk using the import templates. The type of GUID you need depends on the record you need to include on the import template.

GUID Type

Uses

Inventory

Inventory GUIDS are required for the following fields when using the Create Risks bulk import template:

  • Inventory ID

  • Related

Inventory GUIDS are required for the following fields when using the Update Risks bulk import template:

  • Related

Control ID

Control ID GUIDS are required for the following fields when using the Create Risks and Update Risks bulk import templates:

  • Control IDs

Risk

Risk GUIDS are required for the following fields when using the Update Risks bulk import template:

  • Risk ID

Threat

Threat GUIDS are required for the following fields when using the Create Risks and Update Risks bulk import templates:

  • Threat

Vulnerability

Vulnerability GUIDS are required for the following fields when using the Create Risks and Update Risks bulk import templates:

  • Vulnerability
  1. Navigate to one of the following list screens that includes the record in which you'd like to locate GUIDS:

    • Inventory list screens (Assets, Processing Activities, Entities, or Vendors)

    • Controls Library list screen

    • Risk Register screen

    • Threat Library list screen

    • Vulnerability Library list screen

  2. Click the Export button.
    The Export Inventory modal appears.
    Note:

    For the Controls Library, Threat Library, and Vulnerability Library screens, you must click the Context Menu icon and then select Export.



  3. Select the type of export.
  4. Click the Export button to download the inventory.
  5. Click the Task icon and select the export description to open the file in Microsoft Excel.
  6. Copy the GUID for the record in which you'd like to include in the bulk import template. This will be located in the first column.
  7. Paste the GUID into the related field of the bulk import template.