Step 2: Define Relationships

Important:

The DORA Report Generation feature is available for customers with solution packaging only.

Use the instructions outlined in the DORA Report Generation Relationship Configuration Reference tablebelow to properly configure the OneTrust application to populate specific tabs when it generates the report.

Note:

As you configure relationships, you can use the View Data Graph button to visualize the relationships you've configured. The button is available in the Related tab of vendors and legal entities.





Note:

  • Relationships must be defined in the order listed in the table below for records to populate the template correctly. Subsequent steps consider and sometimes depend on prior configuration specifications.

  • If you expand the scope of record relations across objects not outlined directly in these instructions, it may result in additional or incorrect records populating the Register of Information template.

  • There are fewer tabs listed in the table below than on the actual EBA template. The tabs the OneTrust report generates populates the tabs most critical to produce a sound EBA template.

DORA Report Generation Relationship Configuration Reference

EBA Template Tab Reference

Record Inclusion Scenario(s)

Required Validation Checks

OneTrust Application Configuration Steps

Notes & Best Practices

b_01.01 T.01.01:

Entity maintaining the register of information

A record will populate in RT.01.01 when all of the following conditions are met:

Legal Entity

The record is a.

Yes

The entity has one of the following attributes set to:

  • Maintainer of the Register of Information (Level 1)

  • Maintainer of the Register of Information at Consolidated Level (Level 2)

  • Maintainer of the Register of Information at the Entity Level (Level 3)

organizational hierarchy selected for the report extraction

The entity exists within the.

Ensure the following fields are populated:

  • Entity Name

  • Identification Code of the Financial Entity

  • Type of identification code (typically LEI)

  • Country of incorporation

If these attributes are missing, the export may show Not Applicable values or incomplete rows.

For records to populate this tab, you need to enable the Maintainer of the Register of Information attribute in legal entity records that maintain the register of information:  

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Click the appropriate Entity Name. The Inventory Details screen appears.

  3. In the DORA Register of Information attributes, hover over the Maintainer of the Register of Information attribute until the Edit Icon appears.

  4.  Click the Edit Icon.

  5. Set the Maintainer of the Register of Information attribute to Yes.

  6. Click Save.

Maintainer of the Register of Information Attributes 

Determine which entities are pulled into report 01.01, based on the organization level and reporting hierarchy.

Maintainer of the Register of Information (Level 1)

:

Pulls an entity into report 01.01. Use only when the entity exists at the top-level (Level 1), regardless of its organizational assignment.

Maintainer of the Register of Information at Consolidated Level (Level 2

):

Pulls an entity into report 01.01 when using a consolidated hierarchy. Use only for entities created at the consolidated level or for any child entities within that consolidation.

Maintainer of the Register of Information at the Entity Level (Level 3)

:

Pulls an entity into report 01.01 from a child level. Use only when reporting from a lower-tier entity (e.g. Group, Consolidated, Child).

b_01.02 RT.01.02: List of entities within the scope of the register of information

A record will populate in RT.01.02 when all of the following conditions are met:

Legal Entity

The record is a.

Type attribute is populated

The entity.

Type is NOT

The entity:

  • Branch

  • Function

Engagement

The entity is related to anusing the relationship type:

Entity → is related to → Engagement

External legal entities linked to engagements may also appear if they participate in ICT service delivery.

Ensure:

  • Entity Type is populated.

  • Entity LEI or identification code exists.

  • Engagement relationships exist.

If the Type field is empty, the entity will not populate in RT.01.02.

For records to populate this tab, you need to ensure that the legal entity record has the Type system attribute populated with a value that is not null, and not set to Branch or Function, then create and define a relationship between the appropriate entity and engagement. All relevant External Legal Entities linked to an engagement will also be captured here. This provides complete cross-entity engagement visibility and supports accurate multi-entity reporting under DORA.

If the Type system attribute in the legal entity record does not meet the specified conditions of not null, and not set to Branch or Function, the tab will not be populated upon exporting the report.

To check the Type system attribute in the legal entity record:

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Click the appropriate Entity Name. The Inventory Details screen appears.

  3. On the Details tab, under General Information, scroll to the Type attribute.

  4. Click the Edit icon.

  5. Click in the Select field, then select an attribute. Ensure the field is not null, and not set to Branch or Function.

  6. Click Save.

To relate an entity to an engagement:

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Click the appropriate Entity Name. The Inventory Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. Select is related to.

  7. Click the Target Type dropdown arrow.

  8. Select Engagements.

  9. Click the Target Record dropdown arrow.

  10. Select the appropriate record from the dropdown list.

  11. Click Save.

If an entity does not have a parent entity related to it, then OneTrust populates the LEI of the entity in LEI of the direct parent undertaking of the financial entity value within the report.

Relating additional engagements isn’t necessary for this tab, but does benefit other tabs where all engagements related to an entity are required.

b_01.03 RT.01.03: List of branches

A record will populate in RT.01.03 when:

Type = Branch

An Entity exists with.

parent legal entity

The branch entity is related to ausing:

Branch → is branch of → Entity

Engagement

The branch is related to an.

Ensure:

  • Branch entity Type = Branch.

  • Branch Identification Code is populated.

  • Parent entity relationship exists.

If the branch identification code is empty, the report will populate the value as Not Applicable.

For records to populate this tab, you need to:

  • Create an entity record with the system attribute Type set equal to Branch

  • Set the relationship between the Branch entity record and the entity record it is associated with using the relationship type is a branch of.

  • Set the relationship

To set Branch as a system attribute for Entity records:

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Scroll to the Entity Name where you would like to define a branch.

The Type column will list the system attribute if Type = Branch has already been configured. If you see Branch in this column, you can skip to the next set of configuration steps under To relate the defined branch entities to the entity the branch is part of.

  1. Hover near the end of the row until the Context Menu icon appears.

  2. Click the Context Menu icon.

  3. Click Edit.

  4. Scroll to Type in the General Information details.

  5. Click in the Type box, then select Branch from the dropdown list.

  6. Click Save.

To relate the defined branch entities to the entity the branch is part of: 

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.  

  2. Click the branch Entity Name you would like to relate to an entity. The Inventory Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. Select is branch of.

  7. Click the Target Type dropdown arrow.

  8. Select Entities.

  9. Select the appropriate entity from the Target Record list.

  10. Click Save.

To relate the engagement(s) to the branch entities:

  1. On the Third-Party Risk Management menu, select Engagements. The Engagements screen appears.

  2. Click the Engagement Name you would like to relate to the branch entities. The Engagement Overview screen appears.

  3. Click the More dropdown arrow, then select Related.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. Select is related to.

  7. Click the Target Type dropdown arrow.

  8. Select Entities.

  9. Click the Target Record dropdown arrow.

  10. Select the branch entity record you would like to relate the engagement to.

  11. Click Save.

It’s best practice to create a saved view filter on the entities list page called Branch Entities. After you create the saved view, add a filter to the saved view list screen where Type is set to Branch. After you save the view and list screen filter, you can use it to easily view all branch type entities separate from other entity types.

To learn how to create and add filters to saved views, see Configuring and Filtering Third-Party Risk Management List Screen Views.

b_02.01 RT.02.01: Contractual arrangements – General Information

A record will populate in RT.02.01 when:

Contract record exists

A.

Engagement

The contract is related to an:

Contract → is related to → Engagement

  • The engagement relates to an ICT service provider.

Ensure the following contract attributes are populated:

  • Contractual Arrangement Reference Number

  • Contract Start Date

  • Contract End Date

  • Identification Code of ICT Third-Party Service Provider

For subsequent contractual arrangements, the following field must be populated:

Overarching Contractual Arrangement Reference Number

If this value is empty, the report automatically populates Not Applicable.

For records to populate this tab, set the relationship between the engagement record(s) and the contract record(s) they are associated with using the relationship type is related to.

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. In the Relation Type dropdown menu, then select is related to.

  7. Click the Target Type dropdown menu, then select Engagements.

  8. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  9. Click Save.

Any contract record that is a subsequent or associated agreement must have the Overarching contractual arrangements reference system attribute value populated.

If the Overarching Contractual Arrangement Reference Number attribute value on an contract record is empty, then the corresponding value in the report is automatically set to Not Applicable.

Additionally, child or subsequent contracts can tag the overarching contract's arrangement reference number value for the attribute Overarching Contractual Arrangement Reference Number. This provides hierarchical visibility of contract structures by allowing users to trace overarching contractual relationships.

b_02.02 RT.02.02: Contractual arrangements – Specific information

A record will populate in RT.02.02 when:

  • A Function entity exists.

  • The function entity has:

Type = Function

Legal Entity

The function is related to a:

Function → is function of → Entity

Engagement

The function is related to an.

Contract

The engagement is related to a.

Ensure:

  • Function Identifier is populated.

  • Engagement Country of Provision of ICT Services is populated.

  • Data storage and processing location fields are populated where applicable.

If location fields are empty, the export automatically populates Not Applicable.

If multiple countries are selected for service provision, the export will generate one row per country.

To populate this tab, you need to:

  • Create an Entity record that has the system attribute Type equal to Function, then set a relationship between the Function entity record and entity record it is associated with using the relationship type is a function of.

  • Set a relationship between the engagement record and the function entity record they are associated with using the relationship type is related to.

  • Set a relationship between the engagement record and the contract record they are associated with using the relationship type is related to.

To create an Entity record that has the system attribute Type equal to Function, then set a relationship between the Function entity record and entity record it is associated with:

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Click Add New. The Add Legal Entity modal appears.

  3. Enter the Entity Name for the new function entity.

  4. Select the appropriate Organization from the dropdown list.

  5. Select the appropriate Primary Operating Location from the dropdown list.

  6. Click in the Type field, then select Functions from the dropdown list.

  7. Click Save.

  8. Navigate to the Legal Entities screen.

  9. On the Legal Entities screen, click the new function Entity Name. The Inventory Details screen appears.

  10. Click the Related tab.

  11. Click the Create New button. The Create Relationship modal appears.

  12. Click the Relationship Type dropdown arrow. Select is function of.

  13. Click the Target Type dropdown arrow. Select Entity.

  14. Click the Target Record dropdown arrow. Select the appropriate record from the dropdown list.

  15. Click Save.

To set a relationship between the engagement record and the function entity record they are associated with

  1. On the Third-Party Risk Management menu, select Engagements. The Engagements screen appears.

  2. Click the Engagement Name you would like to relate to function entities. The Engagement Overview screen appears

  3. Click the More dropdown arrow, then select Related from the dropdown list.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. Select Is related to.

  7. Click the Target Type dropdown arrow.

  8. Select Entities.

  9. Click the Target Record dropdown arrow.

  10. Select the function entity record you would like to relate the engagement to.

  11. Click Save.

To set a relationship between the engagement record and the contract record they are associated with

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. In the Relation Type dropdown menu, then select is related to.

  7. Click the Target Type dropdown menu, then select Engagements.

  8. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  9. Click Save.

It’s best practice to create a saved view filter on the entities list page called Function Entities. After you create the saved view, add a filter to the saved view list screen where Type is set to Function. After you save the view and list screen filter, you can use it to easily view all function type entities separate from other entity types.

For more information about saved views, see Configuring and Filtering Third-Party Risk Management List Screen Views.

If the Country of Provision of the ICT Services, Location of the data at rest (storage) or Location of management of the data (processing) attributes fields are empty, the values in the report is automatically set to Not Applicable.

If multiple countries are selected in the Country of Provision of ICT Services field on the Engagement record, the export will generate one RT.02.02 row per country.

All other values in the row will remain identical.

Example:

Country of Provision = Germany, France, Italy

Produces: 3 rows in RT.02.02

Note:

Functions associated with branch entities may appear under the parent legal entity in RT.02.02 during export generation. This occurs because the Register of Information template reports functions at the legal entity level.

b_02.03 RT.02.03: List of intra-group contractual arrangements

A record will populate in RT.02.03 when:

  • A Contract record exists.

  • The contract attribute:

Is this an intragroup arrangement?

is set to Yes.

Engagement

The contract is related to an.

Ensure:

  • Intragroup arrangement flag is set to Yes.

  • Contract reference number exists.

  • Contract is related to an engagement.

If the intragroup flag is not set to Yes, the record will not appear in RT.02.03.

To populate this tab, set the relationship between the engagement record and the contract record they are associated with using the relationship type is related to.

  1. On the Third-Party Risk Management menu, select Contracts.

  2. The Contracts screen appears.

  3. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears

  4. Scroll to the Is this an intragroup arrangement? DORA system contract attribute. Make sure it is set to Yes.

If not, hover in the attribute space until the Edit icon appears. Click Edit, then click in the attribute field. Select Yes from the dropdown menu, then click Save.

  1. Click the Related tab.

  2. Click the Create New button. The Create Relationship modal appears.

  3. Click the Relationship Type dropdown arrow.

  4. In the Relation Type dropdown menu, then select is related to.

  5. Click the Target Type dropdown menu, then select Engagements.

  6. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  7. Click Save.

Need more info added on intragroup arrangement and virtual vendors etc..

b_03.01 RT.03.01: Entities signing the Contractual arrangements for receiving ICT service(s) or on behalf of the entities making use of the ICT service(s)

A record will populate in RT.03.01 when:

Contract exists

A.

Legal Entity is related to the contract

A:

Entity → is related to → Contract

Engagement

The contract is related to an.

Ensure:

  • Entity identification code is populated.

  • Contract reference number exists.

  • Entity is the signatory of the contract.

Incorrect relationships may cause the wrong entity to appear as the contract signer.

For records to populate on this tab, set the relationship between the contract record and the entity record they are associated with using the relationship type is related to.

To relate the contract to the legal entity that is signing the contract:

  1. On the Third-Party Risk Management menu, select Entities.

  2. Click the appropriate Entity Name.

  3. The Inventory Details screen appears.

  4. Click the Related tab.

  5. Click the Create New button. The Create Relationship modal appears.

  6. Click the Relationship Type dropdown arrow.

  7. Select is related to.

  8. Click the Target Type dropdown arrow.

  9. Select Contracts.

  10. Click the Target Record dropdown arrow.

  11. Select the appropriate record from the dropdown list.

  12. Click Save.

To relate the contract to an engagement:

  1. On the Third-Party Risk Management menu, select Contracts.

  2. The Contracts screen appears.

  3. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  4. Click the Related tab.

  5. Click the Create New button. The Create Relationship modal appears.

  6. Click the Relationship Type dropdown arrow.

  7. In the Relation Type dropdown menu, then select is related to.

  8. Click the Target Type dropdown menu, then select Engagements.

  9. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  10. Click Save.

Contracts appear in RT.03.01 only when they are linked to an ICT engagement that is owned within the organizational scope from which the Register of Information export is generated.

If a contract is linked to an engagement outside that reporting structure, it is excluded from RT.03.01, even when an in-scope legal entity makes use of the ICT service. This is because operational responsibility for RT.03.01 is inferred through ownership of the ICT engagement.

b_03.02 RT.03.02: ICT third-party service providers signing the Contractual arrangements for providing ICT service(s)

A record will populate in RT.03.02 when:

Vendor exists

Arepresenting the ICT service provider.

Engagement

The vendor is related to an.

Contract

The engagement is related to a.

Ensure the vendor has the following attributes populated:

  • Identification Code of ICT Third-Party Service Provider

  • Type of Identification Code (typically LEI)

If these fields are missing, the vendor may not populate correctly in the report.

For records to populate on this tab, set the relationship between the engagement record and the contract record they are associated with using the relationship type is related to.

To relate the appropriate contract to an engagement:

  1. On the Third-Party Risk Management menu, select Contracts.

  2. The Contracts screen appears.

  3. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  4. Click the Related tab.

  5. Click the Create New button. The Create Relationship modal appears.

  6. Click the Relationship Type dropdown arrow.

  7. In the Relation Type dropdown menu, then select is related to.

  8. Click the Target Type dropdown menu, then select Engagements.

  9. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  10. Click Save.

Before you set up the relation between the contract and engagement, it's best practice to complete the following pre-step:

  1. On the Third-Party Risk Management menu, select Vendors.

  2. Click a vendor record that represents an entity as a third-party service provider for another entity. The Vendor Details screen appears.

  3. Scroll to the DORA vendor details, and make sure the identification code for Identification code of ICT third-party service provider is populated, and the Type of code to identify the ICT third-party service provider to identify third-party service provider uses the LEI of the entity.

The corresponding Type of code to identify the ICT third-party service provider will always be LEI.

b_03.03 RT.03.03: Entities signing the Contractual arrangements for providing ICT service(s) to other entity within the scope of consolidation.

A record will populate in RT.03.03 when:

  • A Contract exists.

  • The contract attribute:

Is this contract an intragroup arrangement?

is set to Yes.

  • The contract is related to an Engagement.

  • The vendor represents an entity within the consolidation scope.

Ensure:

  • Intragroup flag is set to Yes.

  • Vendor identification code exists.

  • Contract relationship to engagement exists.

For records to populate this tab, you need to relate the appropriate contract to an engagement.

To relate the appropriate contract to an engagement:

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. In the Relation Type dropdown menu, then select is related to.

  7. Click the Target Type dropdown menu, then select Engagements.

  8. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  9. Click Save.

Before you relate the contract to engagement, it's best practice to complete the following pre-steps:

Is this contract an intragroup arrangement?Yes

For relevant contracts, verify that the  contract attribute is set to .

Identification code of the third-party service providerType of code to identify the ICT third-party service provider

For the entities created a third-parties , make sure the value for  is populated, and the  is populated.

To check the Is this contract an intragroup arrangement contract attribute:

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Select the appropriate contract record. The Contract Details screen appears.

  3. Scroll to the DORA Register of Information details.

  4. Make sure the Is this contract an intragroup arrangement? attribute is set to Yes. If so, you can stop here and move to the next section of instructions. If you need to edit the attribute, continue.

  5. To edit the attribute, hover over the attribute until the edit icon appears.

  6. Click the Edit icon.

  7. Click in the Is this contract an intragroup arrangement? attribute field.

  8. Select Yes from the dropdown menu.

  9. Click Save.

To check Vendor Detail attributes:

  1. On the Third-Party Risk Management menu, select Vendors.

  2. Click a vendor record name that represents an entity as a third-party service provider for another entity. The Vendor Details screen appears.

  3. Scroll to the DORA Register of Information vendor details, and make sure the identification code for Identification code of ICT third-party service provider is populated.

  4. Make sure the Type of code to identify the ICT third-party service provider is labeled as a virtual third-party.

b_04.01 RT.04.01: Entities making use of the ICT services

A entity will only populate in RT.04.01 when the Engagement it is related to has an associated contract.

Ensure:

  • Entity identification codes exist.

  • Branch identification code exists where applicable.

  • Engagement relationships exist.

Function entities should not populate this tab.

For records to populate on this tab,set the relationship between the engagement record and the contract record they are associated with using the relationship type is related to, and engagements to relevant branch entity records and non branch (except functions) entity records with the relationship type is related to.

To set the relationship between the engagement record and the contract record they are associated with:

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. In the Relation Type dropdown menu, then select is related to.

  7. Click the Target Type dropdown menu, then select Engagements.

  8. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  9. Click Save.

To relate engagements to relevant branch entity records and non branch (except functions) entity records:

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Click the Entity Name you would like to relate to the contract. The Inventory Details screen appears

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow. Select is related to.

  6. Click the Target Type dropdown arrow. Select Contracts.

  7. Click the Target Record dropdown arrow. Select the contract record you would like to relate the legal entity to.

  8. Click Save.

A record will populate in RT.04.01 – Entities Making Use of ICT Services when the following conditions are met:

Legal Entity or Branch

Aexists.

Engagement

The entity is related to an.

Contract

The engagement is related to a.

ICT service arrangement

The contract represents an.

Entities related to engagements without contracts may not appear in this tab.

If the Identification code of the branch field is empty, the value in the report is automatically set to Not Applicable.

Contracts should typically be related to Engagement records, while Legal Entities and Branches should be related to the Engagement rather than directly to the Contract.

This relationship structure ensures that the Register of Information export can correctly determine which entities make use of the ICT services associated with the contractual arrangement.

Recommended structure:

Entity or Branch
↓
Engagement
↓
Contract

Relating contracts directly to branches may result in incomplete or inconsistent population of RT.04.01.

If a single contract is linked to multiple engagements with multiple related Legal Entities, OneTrust applies deduplication logic and retains one unique row for the valid record combination. However, if some related Legal Entities are missing required DORA attributes such as LEI or other entity details, the export may still show an additional row with blank values for those incomplete records. To avoid this, make sure all related Legal Entities in scope have the required DORA attributes populated before generating the report.

b_05.01 RT.05.01: ICT third-party service provider

A record will populate in RT.05.01 when:

  • A Vendor or Nth Party exists.

  • The vendor is linked to an Engagement.

  • The engagement has:

Type of ICT Services ≠ Null

Ensure the following fields are populated:

  • Identification Code of ICT Third-Party Service Provider

  • Type of Identification Code

  • Vendor Name

  • Country of incorporation

The field:

Total Annual Expense or Estimated Cost

is automatically calculated based on:

  • contract expense values

  • vendor-level expense attribute

If a vendor has a parent undertaking, the parent may also appear in the export when a parent-child vendor relationship exists.

For records to populate on this tab, only third and nth parties tied to engagements with the Type of ICT Services field set to any non null value will be considered.

The Total annual expense or estimated cost of the ICT third-party service provider (Vendor) field dynamically calculates based on the details supplied for Legal Entity performing the extraction. This allows organizations to report on the costs associated with ICT service providers in the value chain as an indicator of the material dependency on a service provider or value chain.

Additionally, reporting of Parent Undertaking of each vendor is supported here. This improves transparency of corporate ownership structures and supports regulatory reporting requirements for DORA by allowing users to identify and report on the parent organization of any ICT third-party service provider.

In order to populate the register with the parent vendor of another vendor, a relationship should be set as either is a parent of or is a child of correctly. Then as part of the export, a row will be added for parent vendor if a value is reported in LEI of parent undertaking attribute.

To make sure the Type of ICT services system attribute is active in appropriate Engagement records:

  1. On the Third-Party Risk Management menu, click Engagements. The Engagements screen appears.

  2. Click the Engagement Name where you would like to check the Type of ICT services attribute. The Engagement Overview screen appears.

  3. Scroll to the DORA Register of Information attributes. Locate the Type of ICT services attribute. Make sure the value is populated.

  4. To edit the attribute, hover over the attribute area until the Edit icon appears.

  5. Click the Edit icon.

  6. Enter a value for the attribute.

  7. Click Save.

b_05.02 RT.05.02: ICT service supply chains

A record will populate in RT.05.02 when:

Third Party or Nth Party exists

A.

Engagement

The party is linked to an.

Type of ICT Services populated

The engagement has.

Contract

The engagement is related to a.

Ensure:

  • Nth party record contains:

    • Name

    • Country

    • Relationship to ICT service provider

  • Supply chain rank is defined.

Rank translation in export:

3rd Party → Rank 1
4th Party → Rank 2

  • If The record is a Third Party (i.e. rank=1) then the field Identification Code of the ICT Third Party Service Provider and Type of Code fields will show as null/blank in the report.

To populate this tab, you need to:

  • Ensure third party and nth party records are tied to engagement record(s) which have Type of ICT Services field set to any non null value.

  • The relationship should be set between the engagement record(s) and the contract record(s) they are associated to with the relationship type is related to.

  • The nth parties record(s) are created on the engagement(s) records they are associated to.

To add Nth parties to engagements:

  1. On the Third-Party Risk Management menu, select Engagements. The Engagements screen appears.

  2. Click the engagement Name with ICT services where you would like to add an Nth party. The Engagement Overview screen appears.

  3. Click the Nth Parties tab, then click the Add Nth Party button. The Add Nth Party modal appears.

  4. Enter the nth party Name and country.

  5. Click Show More Details.

  6. Complete the fields as necessary.

  7. Click Save.

To relate the appropriate contract to an engagement:

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Click the Contract Name you would like to relate to an engagement with ICT services. The Contract Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. In the Relation Type dropdown menu, then select is related to.

  7. Click the Target Type dropdown menu, then select Engagements.

  8. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  9. Click Save.

To make sure the Type of ICT services system attribute is active in appropriate Engagement records:

  1. On the Third-Party Risk Management menu, click Engagements. The Engagements screen appears.

  2. Click the Engagement Name where you would like to check the Type of ICT services attribute. The Engagement Overview screen appears.

  3. Scroll to the DORA Register of Information attributes. Locate the Type of ICT services attribute. Make sure the value is populated.

  4. To edit the attribute, hover over the attribute area until the Edit icon appears.

  5. Click the Edit icon.

  6. Enter a value for the attribute.

  7. Click Save.

As part of the report, OneTrust will translate the output of rank to meet the specified Register of Information requirement. For example:

  • If the 3rd party and OneTrust Rank =3 the DORA report rank value =1  

  • If the 4th party and OneTrust Rank =4, the DORA report rank value = 2

b_06.01 RT.06.01: Functions identification

A record will populate in RT.06.01 when:

  • A Function entity exists.

  • The entity has:

Type = Function

Legal Entity

The function is related to a.

Engagement

The function is related to an.

Ensure:

  • Function Identifier exists.

  • Function criticality assessment attributes are populated.

To populate this tab, create an Entity record that has the system attribute Type equal to Function and set the relationship between the engagement record and the function entity record they are associated with using the relationship type is related to.

  1. On the Third-Party Risk Management menu, select Entities. The Legal Entities screen appears.

  2. Click Add New. The Add Legal Entity modal appears.

  3. Enter the Entity Name for the new function entity.

  4. Select the appropriate Organization from the dropdown list.

  5. Select the appropriate Primary Operating Location from the dropdown list.

  6. Click in the Type field, then select Functions from the dropdown list.

  7. Click Save.

  8. On the Legal Entities screen, click the new function Entity Name. The Inventory Details screen appears.

  9. Click the Related tab.

  10. Click the Create New button. The Create Relationship modal appears.

  11. Click the Relationship Type dropdown arrow. Select is function of.

  12. Click the Target Type dropdown arrow. Select Entity.

  13. Click the Target Record dropdown arrow.

  14. Select the appropriate record from the dropdown list.

  15. Click Save.

It’s best practice to create a saved view filter on the entities list page called Function Entities. After you create the saved view, add a filter to the saved view list screen where Type is set to Function. After you save the view and list screen filter, you can use it to easily view all function type entities separate from other entity types.

For more information about saved views, see Configuring and Filtering Third-Party Risk Management List Screen Views.

b_07.01

RT.07.01: Assessment of the ICT services

A record will populate in RT.07.01 – Assessment of ICT Services when the following conditions are met:

  1. A Function entity exists.

  2. The Function entity has:

Criticality or importance assessment = Yes

  1. The Function entity is related to an Engagement.

  2. The Engagement is related to a Contract.

  3. The Engagement has Type of ICT Services populated.

The Level of Reliance field is no longer used as a filtering condition for this tab.

All engagements supporting critical or important functions should be included regardless of reliance level.

To ensure records populate correctly:

  • Function entity must have Type = Function

  • Function must have Criticality or importance assessment = Yes

  • Engagement must be related to:

    • the Function entity

    • a Contract

  • Engagement must have Type of ICT Services populated

  • Vendor must exist for the contract.

For records to populate this tab, the relationship should be set between the engagement record and the contract record they are associated with using the relationship type is related to.

  1. On the Third-Party Risk Management menu, select Contracts. The Contracts screen appears.

  2. Click the Contract Name you would like to relate to an engagement. The Contract Details screen appears.

  3. Click the Related tab.

  4. Click the Create New button. The Create Relationship modal appears.

  5. Click the Relationship Type dropdown arrow.

  6. In the Relation Type dropdown menu, select is related to.

  7. Click the Target Type dropdown menu, then select Engagements.

  8. Click in the Target Record field, then select the appropriate engagement record to relate to the contract.

  9. Click Save.

All engagements supporting a critical or important function will be included in RT.07.01. The Level of reliance on the ICT service attribute is no longer used as a filter condition for this tab.