Getting Started: ITRM Implementation Checklist

Define which attributes your organization wants to capture in an inventory

These attributes can be reported in the inventory report.

Setup your inventory attributes

OneTrust pre-populates attributes commonly associated with your inventory. You can create new attributes to suit your organization's needs and deactivate existing attributes.

Import existing inventories from your organization into OneTrust

When your inventory attributes are setup, the import template that OneTrust generates will have these attributes defined. Map the inventory details to the attributes created in OneTrust and import your existing inventories.

Configure Risk Scoring

Set up risk scoring using the standard or matrix scale to help score risks. This allows you to configure standard or formula attributes to help with custom scoring.

Define the risk workflow

Use workflows to track risks from the time they are identified to the time they are closed. Risk workflows are defined by:

• Risk attributes

• Risk categories

• Risk scoring heatmap

• Risk aggregation logic

Configure threat and vulnerability control libraries

Create a depository of threats and vulnerabilities that can be assigned to risks. To configure:

• Setup applicable frameworks

• Build custom threat and vulnerability controls

• Apply integration into risk workflow

Define the templates in which you want to assess your inventories

There are several options available for launching assessments for inventory records.

• Build any existing templates from your organization.

• Reference the IT & Security Risk Management template gallery for pre-built templates.

• Customize and build the questions and responses in your template.

Build automation rules to trigger the next step in your process

Create and configure inventory rules to automatically launch assessments and send emails based on specified conditions.

Setup risk rules

Use risk rules to automatically trigger a specific action based on responses to the assessments

Assessment trigger

Define which templates are available for self-service and configure the self-service portal.

Define the approval workflow

There are several options for adding workflow approvers.

• Single Approver

• Multiple Approvers

• Approver per Template

Create IT & Security Risk Management dashboards

The IT & Security Risk Management dashboard provides an overview of your asset, processing activity, entity, and vendor risks. The dashboard also displays risk levels and stages.

Define the required reports for inventories

Create a new configurable report to display information about inventory records.

• Configure the inventory PDF report.

• Use granular Excel reports.

  • Categories required

  • Filters applied

Build risk reporting inventory

Create and configure a risk inventory.

• Categories required

• Filters applied

Create risk dashboards

The risk dashboard provides an overview of risk counts, stages, levels, and risks by organization.

Create rules for re-assessing inventories

Build rules that are assigned to risks to assist with the monitoring process that involves recurring risk assessments based on a set cadence.