Implementing Standards and Frameworks for Risk Management

Note:

The Seeded Risk Content feature is under Public Preview. Please contact OneTrust Support to request early access.

You can create and manage standards and frameworks that apply to your organization. This article will guide you through adding, creating, and managing standards and frameworks. For a list of frameworks supported by OneTrust, see Supported Control Frameworks.

To add available standards and frameworks

You can review available standards and frameworks and select which records you'd like to add to your library in order to edit or remove controls.

  1. On the IT & Security Risk Management menu, select Libraries > Standards and frameworks.
    The My Standards and Frameworks tab of the Standards and frameworks screen appears.
    Note:

    This tab displays the standards and frameworks that apply to your organization. These items have been added to your Control library.



  2. Select the Available Standards and Frameworks tab.
  3. Review and click the checkbox next to the standards and frameworks you would like to add to your library. Each option will display the number of business objectives, risks, controls, and evidence tasks related to the framework.

    Note:

    You can use the search bar to easily locate standards and frameworks. Click the Preview link to view the standard or framework details.

  4. Click the Add Standard or framework button.
    Note:

    Business objectives will not be imported for non-TRC customers.

    The Add standard or framework modal appears. Any new business objectives, risks , controls, and evidence tasks related to the framework will become part of your library. Once added to your library, you can edit or remove these controls.

  5. Click the Add standard or framework button.

To create custom standards and frameworks

You can create a custom standard or framework that can be added to your library in order to edit or remove controls.

  1. On the IT & Security Risk Management menu, select Libraries > Standards and frameworks.

    The Standards and frameworks screen appears.

  2. Click the Create standard or framework button.

    The Create custom standard or framework pane appears.

  3. Click the Download template button to download the custom standard or framework template and populate with custom content.
    Note:

    The template includes instructions on the Instructions tab that provides an outline of the information that should be added to the spreadsheet.

  4. Complete the fields on the Create custom standard or framework pane.

    Field / Button
    Description
    Import name

    Enter a name for the new standard or framework import.

    Import description

    Enter a brief description of the import template.

    Add file

    Click the Add file button and select the file where you have populated the template with your custom content.

  5. Click the Import button.
    Note:

    OneTrust has built-in error handling that will display an error message on the Create custom standard or framework pane when there's a problem.

To manage standards and frameworks

To edit custom standard and framework details

  1. On the My standards and frameworks tab, click the Context Menu icon for the custom standard or framework tile in which you'd like to edit.
  2. On the Context menu, select Edit details.

    The Edit details modal appears.

  3. Edit the name and description fields as needed.
  4. Click the Save button.

To import business objectives and risks for existing standards and frameworks

You can import business objectives and risks for the standards and frameworks that are already in your library by navigating to the Available standards and frameworks tab.

Tip:

For example, if your library has 30 controls listed for a framework on the My standards and frameworks tab, and the selected framework has 31 controls listed on the Available standards and frameworks tab, the import will add the one new control.

Note:




In this example, the current library has zero business objectives and risks for the NIST CSF v2.0 framework. The Available standards and frameworks tab shows 19 business objectives and 41 risks for this framework. The import adds all available business objectives and risks from the framework as well as controls and evidence tasks that are not currently in the library.

  1. On the Available standards and frameworks tab, click the checkbox next to the standards and frameworks you would like to import business objectives and risks.

    Note:

    You can use the search bar to easily locate standards or frameworks. Click the Preview link to view the business objectives and risks linked to the record.

  2. Click the Add Standard or framework button.

    The Add standard or framework modal appears. Any business objectives, risks , controls, and evidence tasks related to the framework that are not already in your library will be added.

  3. Click the Add standard or framework button.

To update frameworks

The icon will appear next to the framework tile name when it has an update available.

  1. On the My standards and frameworks tab, click the Context Menu icon for the custom standard or framework tile in which you'd like to update.
  2. On the Context menu, select Update framework.
    The Framework updates screen appears.

  3. Click the Review link in the Action column to view the latest framework updates.

  4. Click the check box next to I understand that applying this update will overwrite any custom changes to proceed.
  5. Click the Apply updates button.

To view controls in library

  1. On the My standards and frameworks tab, click the Context Menu icon for the custom standard or framework tile in which you'd like to view controls.
  2. On the Context menu, select View controls in library.

    The Control library list screen appears.

  3. View the controls related to the standard or framework.

To delete standards and frameworks

  1. On the My standards and frameworks tab, click the Context Menu icon for the custom standard or framework tile in which you'd like to be removed.
  2. On the Context menu, select Delete custom standard or framework.
    The Delete custom standard or framework modal appears.

  3. Check the box next to I understand this action is irreversible.
  4. Click the Delete custom standard or framework button. This standard or framework will be removed from the My standards and frameworks tab on the Standards and frameworks screen.

Business Objective and Risk Import Behavior FAQs

Do all frameworks include risks and business objectives?

All frameworks except for legacy frameworks include risks and business objectives. Legacy frameworks do not include risks, business objectives, and evidence tasks.

If a framework is already imported into an account, will risks and business objectives be automatically added?

No. Users must update the framework to import risks and business objectives. This helps to prevent the creation of duplicate records that may not be needed.

Does the framework import include mappings between controls and risks?

Yes. The framework import includes mappings between controls and risks.

When an initiative is created, are risks automatically added to the Risk Register along with control implementations?

No. Risks are not added to the Risk Register during the control implementation.