Default Third-Party Risk Management Attributes

Address

The primary street address where the third party is located.

Text

Address 2

The secondary street address where the third party is located.

Text

Adverse Media (Organization)

The adverse media associated with an organization.

Score

Adverse Media (Person)

The adverse media associated with a person.

Score

Aggregate Risk Level

The overall risk level associated with vendor.

Single Select

Aggregate Risk Score

The overall risk score associated with vendor.

Text

Aggregate Inherent Risk Level

The overall inherent risk level associated with vendor.

Single Select

Aggregate Inherent Risk Score

The overall inherent risk score associated with vendor.

Text

Aggregate Target Risk Level

The overall target risk level associated with vendor.

Single Select

Aggregate Target Risk Score

The overall target risk score associated with vendor.

Text

AI Use

Tracks and quantifies a vendor's use of AI technology.

Single Select

Alternate First Name

The alternate first name of a person.

Text

Alternate Last Name

The alternate last name of a person.

Text

Alternate Middle Name

The alternate middle name of a person.

Text

Alternative Name

The alternative name of an organization.

Text

Applicable surveillance or security laws

The applicable surveillance and security laws, judgements or other legal frameworks.

Multi Select

BitSight Domain

The domain from the BitSight platform.

Text

BitSight Industry

The industry for the vendor from BitSight.

Text

BitSight Rating

The rating for the vendor from BitSight.

Text

BitSight Rating Date

The date of last Rating from BitSight.

Date

Board Member

Indicates a person that is a board member of a State-Owned Company.

Score

Business Owner

The internal user sponsoring the vendor.

Single Select

City

The city where the third party is located.

Text

Classification

The classification of the vendor.

Single Select

Contact Phone Number

The number where you can contact the third party.

Text

Country/Territory

The Country or Territory where the third party is located.

Single Select

CPI Risk Score

The range displayed contributes to the calculation of the Initial Risk Score.

Score

CPI Score

This score is provided by Transparency International based on various criteria to indicate geographic risk. Countries lacking a CPI Score are marked as N/A.

Text

Created By

The name of the user who created the record.

Single Select

Created Date

The date when the record was created.

Date

Critical Information Infrastructure Operator

Indicates if the vendor is a Critical Information Infrastructure Operator.

Single Select

Criticality

The level of criticality that the vendor is to the business.

Single Select

Data Collected

The data Collected under the EU-U.S. Privacy Shield.

Text

Data Processing Agreement

Indicates if there is a contract governing privacy issues between the two organizations.

Single Select

Date of Birth

The date of birth of a person. Adding the date of birth can improve the accuracy of screening results.

Date

Description

A brief description of the vendor.

Text

Domain

The specific website of a third-party in the Exchange.

Text

DUNS Number

The DUNS number is an identifier provided by Dun&Bradstreet.

Text

Enhanced Country Risk

Vessels that are either flagged or associated with Cuba, Iran, North Korea and Syria.

Score

Entity Type

Identifies whether an entity is a person or organization to associate proper attributes and optimize screening results.

Single Select

Privacy Shield - Covered Entities

Privacy Shield - Covered Entities.

Single Select

EU-US-DPF Notice Link

The privacy shield notice link.

Text

EU-US-DPF Status

The EU-U.S. privacy shield status.

Text

External ID

A unique identifier to support integration across applications.

Text

First Name

First name.

Text

Frequency of transfers

The frequency of transfers.

Text

Gender

The gender of a person. Adding the gender can improve the accuracy of screening results.

Single Select

ID

A unique ID for the vendor.

Text

VendorsIsGlobalAttributeConfigurationEnabled

Indicates if global setting for attribute configuration is enabled.

Single Select

Is Master

Indicates if an Inventory is a master.

Single Select

Last Name

Last name.

Text

Last Updated By

The name of the user who last updated the record.

Single Select

Last Updated Date

The date when the record was last updated.

Date

Location

The location of the vendor.

Single Select

Master Record

The Master Inventory Business Key for a Child Inventory.

Text

Middle Name

Middle name.

Text

Monitoring Enabled

Indicates that the third party is currently monitored by Dow Jones.

Single Select

Name

The name of the vendor.

Text

Next EU-U.S. Certification Date

The next EU-U.S. Certification Date

Date

No Match

No profiles matched the screening criteria.

Score

Organization

The organization responsible for the vendor.

Single Select

Original EU-U.S. Certification Date

The original EU-U.S. Certification Date.

Date

Other Exclusion List

Lists that typically excludes persons or organizations from public sector activities.

Score

Other Official List

Lists compiled by supervisory authorities, regulators and law enforcement agencies. Examples include travel bans, trade restrictions, exclusion lists, and arms embargoes.

Score

Personal Data Disclosure/Access

Indicates if the vendor has access or handles personal data on behalf of the organization.

Single Select

Phone

Contact Phone Number

Numerical - Text

Politically Exposed Person

The senior ranking public officials (both governmental and non-governmental).

Score

Postal Code

The postal code of the vendor.

Text

Primary Vendor Contact

The email address of the primary vendor contact, or the contact from a list of internal users.

Single Select

Privacy Policy Link

The link to the vendor privacy policy.

Text

Processing Activity Locations

Where the vendor processes personal data.

Multi Select

Product/Service

The specific product or service that the vendor provides.

Text

Purpose of Data Collection

Purpose of Data Collection.

Text

Relative or Close Associate

Persons identified as a Relative or Close Associate of a PEP.

Score

Sanctions

A person or organization that is subject to comprehensive or targeted restrictive measures.

Score

Sanctions Control (Ownership)

Indicates an organization either owned or controlled by sanctioned persons or organizations listed on an OFAC or EU sanctions program.

Score

Screening Completed Date

The date (UTC) the most current screening was completed.

Date

Security measures

The security measures applied to the transfers of information.

Single Select

State/Province/District

The state/province/district where the third party is located.

Text

State-Owned Company

Any corporate structure where a government body owns 1% or more, holds  majority voting control, and/or has the power to appoint a majority of the members of the organization''s administrative, managerial or supervisory bodies.

Score

Status

The status of the vendor.

Single Select

Subprocessors or subcontractors locations

The location of the subprocessors and subcontractors.

Multi Select

VendorsSwissUsDpfStatus

The Swiss-U.S. Data Privacy Framework Status.

Single Select

Third Party Type

The role of the third party in the business relationship.

Single Select

Transfer Assessment Result

The transfers to this vendor that have been deemed safe or unsafe based on data transfer assessments.

Single Select

Type

The type of product or service that the vendor provides.

Single Select

VendorsUkUSDpfExtensionStatus

The UK-U.S. Data Privacy Framework Extension Status.

Single Select

Vendor Assessment

Indicates if the vendor has been assessed for compliance with applicable legal and contractual requirements.

Single Select

Vendor Contact

The privacy shield vendor contact.

Text

Vendor ID

A unique identifier to support integration across applications.

Text

Vendor Rating

The rating of the vendor.

Single Select

Workflow

The vendor workflow type.

Single Select

Vendor Workflow Stage

The vendor workflow stage.

Single Select

View Vendor in BitSight

A link that brings you to the vendor record in the BitSight platform.

Text

Engagement Aggregate Risk Level

The overall risk level associated with the engagement.

Single Select

Engagement Aggregate Risk Score

The overall risk score associated with the engagement.

Text

Engagement Aggregated Inherent Risk Level

The overall inherent risk level associated with the engagement.

Single Select

Engagement Aggregated Inherent Risk Score

The overall inherent risk score associated with the engagement.

Text

Engagement Aggregated Target Risk Level

The overall target risk level associated with the engagement.

Single Select

Engagement Aggregated Target Risk Score

The overall target risk score associated with the engagement.

Text

Are there alternative ICT third-party service providers identified?

One of the options in the corresponding dropdown list shall be used. In principle, for each ICT third-party service provider supporting a critical or important function, the assessment to identify an alternative service provider shall be performed.

Single Select

Country of provision of the ICT services

Identify the country of provision of the ICT services using the ISO 3166–1 alpha–2 code.

Single Select

Created By

The user who created the record.

Single Select

Created Date

The date when the record was created.

Date

Engagement End Date

The engagement End Date.

Date

Existence of an exit plan

Use this column to report the existence of an exit plan from the ICT third-party service provider in relation to the specific ICT service provided.

Single Select

Engagement External Contact

The engagement external contact name.

Text

Engagement External Contact Email

The engagement external contact email.

User/Text

ID

A unique identifier of a particular engagement record.

Text

Identification of alternative ICT TPP

If "Yes" is reported for alternative ICT third-party providers identified, additional information could be provided in this column.

Text

Impact of discontinuing the ICT services

Use this column to provide the impact for the financial entity of discontinuing the ICT services provided by the ICT third-party service provider according to the financial entity’s assessment.

Single Select

Engagement Internal Owner

The engagement Internal Owner.

Single Select

Last Updated Date

The date when the record was last updated.

Date

Level of reliance on the ICT service supporting the critical or important function

One of the options in the corresponding dropdown list shall be used.

Single Select

Location of management of the data (processing)

Identify the country of location of management of the data (processing) using the ISO 3166–1 alpha–2 code.

Single Select

Location of the data at rest (storage)

Identify the country of location of the data at rest (storage) using the ISO 3166–1 alpha–2 code.

Single Select

Engagement Name

The engagement Name.

Text

Engagement Notes

The engagement Notes.

Text

Engagement Organization

The engagement Organization.

Single Select

Possibility of reintegration of the contracted ICT service

One of the options in the corresponding dropdown list shall be used. In case the ICT service is provided by an ICT third-party service provider that is not an ICT intra-group service provider

Single Select

Reason if the ICT third-party service provider is considered not substitutable or difficult to be substitutable

One of the options in the corresponding dropdown list shall be used.

Single Select

Engagement Scope

The engagement Scope.

Text

Sensitiveness of the data stored by the ICT third-party service provider

Identify the level of sensitiveness of the data stored or processed by the ICT third-party service provider using one of the options in the corresponding dropdown list. The most sensitive data take precedence: e.g. if both "Medium" and "High" apply, then "High" shall be selected.

Single Select

Engagement Start Date

The engagement Start Date.

Date

Storage of data

The ICT service related to (or foresees) storage of data

Single Select

Status

The status of Engagement.

Single Select

Engagement Type

The engagement Type.

Single Select

Type of ICT services

One of the types of ICT services referred to in Annex III

Single Select

Updated By

The user who last updated the record.

Single Select

Engagement Vendor

The vendor.

Single Select

Engagement Workflow

The engagement Workflow.

Single Select

Engagement Workflow Stage

The engagement Workflow Stage.

Single Select

Contract Approved Date

The date the contract was approved.

Date

Contract Approvers

The contract approvers/signers.

Text

Contract Name

The contract name.

Text

Contract Owner

The contract owner.

Single Select

Contract URL

The web location for a contract document.

Text

Contract Cost

The contract cost.

Text

Contract Currency

The contract currency.

Text

Contract Agreement Created Date

The date the contract was created.

Date

Contract Expiration Date

The contract expiration date.

Date

Contract Note

Contract notes.

Text

Contract Organization

The contract organization description.

Single Select

Contract Status

The contract agreement status.

Single Select

Contract Type

The contract type.

Single Select

Contract Vendor Contact

The vendor contact.

Text

Contact Phone

The phone number of the contact.

Text

Data Collected

The data collected under the EU-U.S. Privacy Shield.

Text

EU-U.S. Privacy Shield Status

The status of the EU-U.S. Privacy Shield.

Single Select

Next EU-U.S. Certification Date

The next EU-U.S. certification date.

Date

Original EU-U.S. Certification Date

The original EU-U.S. certification date.

Date

Privacy Shield - Covered Entities

The privacy shield covered entity.

Text

Privacy Shield Notice Link

The link to the privacy shield notice.

Text

Purpose of Data Collection

The purpose behind collecting the data.

Text

Vendor Contact

The primary privacy shield vendor contact.

Text

Aggregate Risk Level

Indicates the likeliness that the asset could expose personal information.

Single Select

Aggregate Risk Score

The overall risk score associated with asset.

Text

Aggregate Inherent Risk Level

The overall inherent risk level associated with Asset.

Single Select

Aggregate Inherent Risk Score

The overall inherent risk score associated with Asset.

Text

Aggregate Target Risk Level

The overall target risk level associated with Asset.

Single Select

Aggregate Target Risk Score

The overall target risk score associated with Asset.

Text

Collection Purpose

Describes the purpose of collecting the data element.

Multi Select

Created By

The name of user who created the record.

Single Select

Criticality

Describes how critical the asset is to the business.

Single Select

Created Date

The date when the record was created

Date

Data Disposal

Indicates if the data is destroyed or archived.

Single Select

Data Retention

The data retention time period.

Text

Data Retention Period

Describes the data retention time limits for erasure/disposal for each of the different data elements processed for this activity.

Text

Description

A brief description of the asset.

Text

External ID

Contains a unique identifier for the record from a system outside of OneTrust.

Text

Hosting Location

The physical or hosting location of the asset.

Single Select

Hosting Provider

The name of the hosting provider.

Single Select

Hosting Type

Indicates if the Asset is hosted on-premises or externally on a cloud.

Single Select

ID

Contains a unique identifier for the record of a particular inventory type.

Text

Internal or 3rd Party

Indicates if the asset is an internal or 3rd party asset.

Single Select

Is Data Disclosed?

Indicates if information is disclosed, shared with, or accessed by another party (whether internal or 3rd party) for a business purpose.

Single Select

Is Data Sold?

Indicates if information is sold for monetary or other benefit/value as a part of the process.

Multi Select

Is Global Attribute Configuration Enabled

Indicates if global setting for attribute configuration is enabled.

Single Select

Is Master

Indicates if an Inventory is a master.

Single Select

IT Owner

The technical individual responsible for the Asset.

Single Select

Last Updated By

The user who last updated the record.

Single Select

Last Updated Date

The date when the record was last updated.

Date

Legitimacy

Describes the need and relevance of the data.

Text

Managing Organization

The organization that owns the asset.

Single Select

Master Record

The master Inventory Business Key for a Child Inventory.

Text

Minimization Controls

Shows the minimization controls applied to the data element.

Multi Select

Name

The name of the asset.

Text

Organizational Security Measures

The organizational security measures in place to protect personal data.

Multi Select

Other Security Measures

The description of any additional security measures in place to protect personal data.

Text

Security Classification

The security classification of the asset for the business.

Single Select

Status

The status of the asset.

Single Select

Storage Format

Indicates the storage format type used to store personal data in the asset.

Multi Select

Technical Security Measures

The technical security measures in place to protect personal data.

Multi Select

Type

The type of asset.

Single Select

Volume of Data Subjects

The volume of Data Subjects stored in the asset.

Single Select