Connecting to BitSight

BitSight is a security ratings service that rates the security effectiveness of vendors across an array of categories. A summarized Rating is used to generalize the security of a vendor.

OneTrust customers can pull in the rating information from BitSight and populate the data into the vendor inventory records in OneTrust. This action is completed using a turnkey integration plugin from the OneTrust Integration Marketplace.

This article contains the following main sections:

Before You Connect to BitSight

Before you connect to BitSight, review the Prerequisites and Important Notes .

Prerequisites

  • You must have an active BitSight account to access data from BitSight.

  • You must have access to your BitSight APIKey for OneTrust to make API calls to BitSight.

Important Notes

  • All vendors will be created in OneTrust at the Organization Level that the user activates the BitSight integration from.

    Example: If I activate the workflow in the ROOT org, all vendors created from the connection will be in the ROOT org.

  • All existing BitSight customers will need access to export their portfolio from BitSight if they already have vendors in OneTrust and need to connect them.

Getting Started

To start connecting to BitSight, obtaining your company's API key, then choose the appropriate integration method.

Obtaining your Company's API Key

Important:

You will need your company's API Key to enter OneTrust Credentials in successive steps.

  1. Log into the BitSight Portal.

  2. Click the Gear icon and select Account.



  3. Scroll down to the API Token section.

  4. Copy your company's API Key.



Choosing the Appropriate Integration Method

There are two ways to integrate OneTrust vendor inventories with BitSight ratings information:

New OneTrust Tenant: Importing and Updating BitSight Vendors

Use the instructions below to import vendors and their BitSight data to a configurable workflow space.

Before you Begin

If you have already created vendors in the OneTrust vendor inventory, before you begin, you need to use the Bulk Update action to assign a BitSight GUID to a vendor's External ID field.

Important:

If you begin the process without adding Bitsight GUIDs to existing vendors, the process results in errors or duplicate vendors.

To prepare your existing vendor inventory import, leave this section and follow the instructions in Existing OneTrust Tenant: Updating Vendors in Bulk to Connect with BitSight.

If you do not have vendors created in your OneTrust vendor inventory, follow the steps below.

  1. On the Integrations Module menu, select Credentials. The Credentials screen appears.

  2. Click the Add New button. The Add Credential modal appears.

  3. Choose BitSight in the Select System field selector and click the Next button.



  4. Complete the required fields as shown in the Add Credential Screen Reference.

  5. Click the Save button.

  6. Select Gallery. The Integrations Gallery screen appears.

  7. Select the BitSight tile. The Gallery Details screen appears.



  8. Click the Add button on the VRM: Vendor Data Discovery tile. The Add Workflow Name modal appears.



  9. Enter a workflow name.

  10. Select the credential you created.

  11. Enter an address for notification emails.

  12. Click the Create button.

    The Workflow Builder screen appears, and contains a pre-configured workflow you can modify.

    Note:

    The workflow is not yet active. Follow the steps below to test, modify, and activate the workflow.

  13. Click the Context Menu button.



  14. Select Test Workflow. The Test Workflow screen appears.



  15. Click the Run Test button and ensure you receive a "200 OK" message.

    Note:

    If you do not receive a "200 OK" message, ensure there are no vendors in your inventory and that your credentials are correct. If this does not resolve the issue, contact a support representative.

  16. Click the Close button.

  17. Click the Activate button. A confirmation modal appears.



  18. Click the Ok button.

    Note:

    This workflow will be available on the Connections page in the Integrations module.

  19. On the Vendor Management menu, select Vendors. Your vendors now appear.

Add Credential Screen Reference



Field
Description
Credential Name

Enter a unique credential name.

Description

Enter a brief description of the credential.

Connector Type

Select HTTP from the selection field.

Auth Type

Choose Basic from the selection field.

Protocol

Choose HTTP from the selection field.

Hostname

Enter the URL api.bitsighttech.com.

Test URL

Enter https://api.bitsighttech.com.

Enter Default Headers to include

Leave these selections blank.

Username

Enter your BitSight API Key.

Password

Leave this field blank.

mTLS enabled

Enable this setting if you would like to use mutual TLS authentication to secure all connections using this credential. If selected, include the Client Certificate, Private Key, and Private Key Passphrase.

Server Certificate Chain

Optional field where you can include a server certificate or certificate chain in PEM format.

Existing OneTrust Tenant: Updating Vendors in Bulk to Connect with BitSight

Follow these steps if you are already using OneTrust Third-Party Risk Management and have vendors in your inventory.

  1. On the Vendor Management menu, select Attribute Manager. The Attribute Manager screen appears.



  2. Click the View button on the Vendor Attributes tile.

  3. Ensure the following attributes are active:

    • BitSight Rating

    • BitSight Category

    • BitSight Rating Date

    • BitSight Domain

    • View Vendor in BitSight

    • External ID

  4. On the Third-Party Risk Management screen, select Vendors.

  5. Optionally, complete the Optional Configuration: Creating a Custom View without Filters steps.

  6. Click the Export button. The Export Inventory modal appears.

  7. Select Export All.



  8. Click the Export button.

  9. Select the Notifications icon . The Alert Center screen appears.

  10. Select the Description to open the Excel file that was downloaded to your computer.

  11. Update the External ID field with the GUID from your BitSight export using the To export your BitSight portfolio GUIDS steps.

    Note:

    You will need to export your Portfolio from BitSight, including the GUID for each company in order to do this manual mapping.

  12. Update the External ID field for every vendor from your BitSight portfolio that matches your current OneTrust vendor inventory.

    Note:

    If you have vendors in your BitSight inventory that do not exist in OneTrust, OneTrust will create this vendor once we activate the BitSight workflow in later stages.

  13. Save the file.

  14. On the Import Templates screen, click the New Import button. The New Import modal appears.

  15. Complete the required fields as shown in the New Import Screen Reference.

  16. Click the Submit button.

  17. Follow steps 2 - 17 of New OneTrust Tenant: Importing and Updating BitSight Vendors.

To export your BitSight portfolio GUIDS

  1. Log into the BitSight Portal.

  2. On the Portfolio menu, select All Companies.



  3. Select Reports > Portfolio Ratings.

  4. Click the Add button.

  5. Choose the Select All option or individually select which companies you wish to connect to OneTrust.



  6. Click the Done button. The Portfolio Ratings screen appears.



  7. Click the Export button.

  8. Use the Excel file to locate the Company ID field map it to the External ID field from the OneTrust Excel export for each company.

    Note:

    This Excel file will be used to import and update OneTrust.



New Import Screen Reference



Field
Description
Import Name

Enter an import name.

Import Description

Enter a brief description of the import.

Import Type

Select Update Vendors from the selection field.

File

Upload the Excel file you saved to the computer.

Optional Configurations

Grouping BitSight Attributes

Note:

This optional configuration can be completed by new and existing OneTrust tenants.

  1. On the Vendor Management menu, select Attribute Manager. The Attribute Manager screen appears.



  2. Click the View button on the Vendor Attributes tile.

  3. Select the Groups tab.

  4. Scroll down and click the Add Group button. The Add Group modal appears.



  5. Enter a group name.

  6. Click the Save button.

  7. Click the up-arrow icon to position this group to where you want it.



  8. Click the Manage Attributes button in the BitSight Rating group. The Manage Attributes modal appears.

  9. Select the following attributes in the Available Attributes column.

    • BitSight Rating

    • BitSight Category

    • BitSight Rating Date

    • BitSight Domain

    • View Vendor in BitSight

    • External ID

  10. Click the Save button.

  11. On the Third-Party Risk Management screen, select Vendors.

  12. Click into a vendor to view grouped attributes.



Creating a Custom View without Filters

  1. On the Vendor Management menu, select Vendors. The Vendor Inventory screen appears.



  2. Select the Column Editor icon. The Column Selector modal appears.



  3. Remove all non-required fields from the Visible Fields column.

  4. Add the following fields to the Visible Fields column in the order below, from top to bottom.

    • Name

    • Organization

    • Type

    • BitSight Rating

    • BitSight Category

    • BitSight Rating Date

    • BitSight Domain

    • View Vendor in BitSight

    • External ID

  5. Click the Apply button.

  6. Select the OneTrust Default View in the top left and click the Save As button.



  7. Enter a view name.



  8. Click the Create View button.

Field Mapping

BitSight Endpoint: https://api.bitsighttech.com/ratings/v1/portfolio

OneTrust Attribute Name

BitSight Field

Vendor Name

Companies.Name

BitSight Rating

Companies.rating

BitSight Category

Companies.industry

BitSight Rating Date

Companies.rating_date

View Vendor in BitSight

Companies.display_url

BitSight Domain

Companies.primary_domain

External ID

Companies.guide

FAQ

Can BitSight attributes be updated:

Automatically via the Third-Party Risk Exchange:

No, BitSight attributes are not able to be updated through the Exchange. So vendors linked to the Exchange do not have BitSight fields populated automatically. These attributes must be updated manually or via integration.

Automatically via Dow Jones Integration with Third-Party Due Diligence

BitSight data requires a customer to have a subscription directly with BitSight to ingest their data. There is an integration workflow that needs to be added and activated utilizing the credentials the customer would be provided by BitSight (see Choosing the Appropriate Integration Method ).

BitSight and Dow Jones are completely separate organizations.  The BitSight attributes reside within third-party attributes, so a customer with Third-Party Due Diligence only could still integrate BitSight data.

Updated via a Separate Integration:

Yes, BitSight attributes can be updated through our out-of-the-box integration if you have an active BitSight subscription.

While manual updates are possible, they are not the only option. If the BitSight integration is inactive or not configured, customers can manually populate the fields.

Can Customers Edit Fields When Integration Is Enabled?

Yes, even when the BitSight integration is active, customers can still manually edit or update the attributes—assuming they have the necessary permissions. The fields are not locked by the integration.