Choosing OneTrust to accelerate and centralize GRC operations

ORTEC’s search for a GRC platform was driven by customer demand and the organization’s privacy and security department. It quickly became clear that ORTEC would need to implement some sort of tooling because spreadsheets would not be sufficient to identify overlaps between the two. Recognizing the alignment between their risk management and audit program for ISO 27001 as well as the detailed requirements for privacy regulations like the GDPR, ORTEC was looking for a single technology platform that could bridge the gap between the two initiatives.

ORTEC came across OneTrust when the Privacy, Security, and Governance company acquired DataGuidance, a global regulatory research software that helps build and maintain compliance programs. After talking to the OneTrust GRC team, ORTEC saw the opportunity to minimize overhead and increase efficiency and eventually implemented the technology.

Empowering a global team to support proactive risk management

With 1,500+ employees across the globe, ORTEC implemented OneTrust GRC’s IT and Security Risk Management (ITRM) platform to better engage the first line of business and keep risk data up-to-date while retaining business context.

How does a first line friendly approach work? We outline ORTEC’s ITRM workflow here:

1. ORTEC’s security team nominates a business owner’s (BO) and assigns each one a risk assessment within the OneTrust GRC platform.
2. Each assessment focuses on the domains that are part of the standards, frameworks, or regulations in question.
3. For each domain, the BO helps identify availability, impact, and confidentiality details through a series of business process- oriented questions. Specifically, the BO is presented with a possible risk and has to reply by telling how likely it is that this risk poses a real threat and what impact would it be.
4. Based on these responses, ORTEC’s assessment reviewer receives auto-populated risks and has the responsibility to adjust or flag additional risks where necessary.
5. From there, a risk owner is automatically assigned and mitigating controls and measures are identified.
6. As a result, all activities and documents go into a treatment plan for mitigation and monitoring. Once all risks are addresses, ORTEC can circle back and conduct an annual review of risks and processes.