OneTrust GRC Reviews

I use OneTrust specifically for incident management. For my company, I helped to create the incident management program that we currently use, particularly with gathering the information and sending out assessments to different vendors to collect information for further research and discovery. 

I also use the platform for processing privacy requests that our company receives. OneTrust is just one of the platforms we use, and we receive privacy requests through multiple channels, such as email and occasionally, phone calls. 

However, any kind of request we receive is still filtered through OneTrust using their platform to track the request and process it all the way through from the initial notification to the end when it's finally processed. We send out notifications and collect information, all done through OneTrust.

OneTrust has streamlined the process of sending notifications to clients, consumers, and stakeholders. It allows tracking of all information within the platform itself, so there is no need to go outside of OneTrust to gather or find information.

I used OneTrust GRC for a holistic view of our compliance program, automation of everything from policy creation, edits, reviews, annual acknowledgment by staff, third-party risk management program, reporting deliverables, metrics, and incident management. We also had an anonymous reporting hotline.

OneTrust GRC helped us achieve IPO status at several different organizations because of the visibility it provides in our compliance program. 

It also contributed significantly to successfully achieving our SOC 2 Type 2 during the first iteration.

One of the most beneficial features of the product has been its cloud-based IT and vendor risk management tools, along with built-in templates for GDPR and ISO compliance. These tools streamline risk assessments across jurisdictions, which is crucial for multinational operations.

They could enhance the product's functionalities like audit management and ensure consistency across modules. 

On the privacy front, we used the solution to meet many GDPR requirements, like maintaining a record of processing. We used the OneTrust data processing component or module to keep all the processing activity records. On the GRC front, we used the risk management and audit modules to manage risk assessments and IT audits within the organization.

OneTrust GRC is a SaaS (software as a service) platform. As an implementer, you don't need to do many technical configurations. Instead, you do the functional configurations, like setting up the rulesets to ensure they adapt to the rules within the organization. The solution was quite valuable because it included almost all the worldwide privacy regulations, such as GDPR and CCPA. You can configure the functional rules against the entity or country where the client may be located.

The organization I worked with operated in 35 African countries, with an office in France. So, GDPR was relevant, and these 35 countries where they have data protection laws were also relevant. The most valuable feature of the solution is that it already has visibility about all the data protection regulations or other cybersecurity regulations related to several countries.

I primarily use OneTrust GRC for GRC, which involves vendor management aspects. It helps ascertain levels of compliance concerning vendors.

OneTrust GRC simplifies the deployment of our policies, making them easy to achieve. It has also made policies deploy with ease, aligning with intended organizational goals.

It was used to manage IT and control risks, specifically around network infrastructure and particular assets.

As a solution for IT risks, it is a very good product. I think it's structured in a way that makes it good to track IT-specific risks and controls.

Initially, we used the product to ensure our company in Brazil followed the recent data protection guidelines. Brazil has data protection laws very similar to GDPR in Europe. We focus on managing data usage and management policies.

The product helps us streamline audit and incident management processes. There's also a focus on third-party risk management.

We use OneTrust GRC to evaluate internal and external projects for risk.

It does help in the automation of our privacy impact assessments.