{"version":"0.42.0","built_at":"2026-11-01T08:34:43.408Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","product":{"id":"PR-760","name":"OneTrust","vendor":"OneTrust LLC","category":"Privacy, consent, third-party risk and AI governance","description":"A trust and governance suite covering website and app consent, privacy program operations and data subject requests, third-party risk, IT risk and compliance, and the governance of AI systems, on one platform with shared inventories of assets, processes and vendors. Sold as solution packages and add-on products.","website":"https://www.onetrust.com","license_model":"subscription","deployment":["saas"],"aliases":["OneTrust Platform"],"csdm_note":"One Business Application per licensed solution package. The consent banner is embedded in public sites and apps, so record it as a dependency of each customer-facing Application Service; a change to the banner script changes every one of them.","sources":[{"url":"https://www.onetrust.com/solutions/ai-governance/","title":"AI Governance Software | Solutions | OneTrust"},{"url":"https://www.onetrust.com/solutions/privacy-automation/","title":"Privacy Automation | Solutions | OneTrust"},{"url":"https://www.onetrust.com/solutions/third-party-management/","title":"Third-Party Management | Solutions | OneTrust"}],"as_of":"2026-11-01","product_capabilities":[{"id":"PC-760.10","name":"Consent Management Platform","description":"Cookie banners and preference centers configured by region and language, trackers held back until a visitor agrees, and a searchable log of every consent and its changes across web, mobile and connected TV.","business_capability_ids":["BC-460.40.30","BC-140.10.30"],"maturity":"core","confidence":"high","source_url":"https://www.onetrust.com/products/consent-management/","business_capabilities":[{"id":"BC-460.40.30","name":"Preference & Consent Management"},{"id":"BC-140.10.30","name":"Privacy & Data Protection Obligations"}]},{"id":"PC-760.20","name":"Universal Consent & Preference Management","description":"Consent and communication preferences recorded once and honored across channels and systems beyond the website banner.","business_capability_ids":["BC-460.40.30","BC-460.40.20"],"maturity":"strong","confidence":"medium","business_capabilities":[{"id":"BC-460.40.30","name":"Preference & Consent Management"},{"id":"BC-460.40.20","name":"Lifecycle Communication"}]},{"id":"PC-760.30","name":"Privacy Operations","description":"A maintained map of personal data processing and the assets, processes and vendors behind it, AI-assisted privacy and data protection impact assessments, and logging of personal data incidents with a view on whether a regulator must be told.","business_capability_ids":["BC-140.10.30","BC-1270.50.10","BC-1270.50.20","BC-760.30.20"],"maturity":"core","confidence":"high","source_url":"https://www.onetrust.com/solutions/privacy-automation/","business_capabilities":[{"id":"BC-140.10.30","name":"Privacy & Data Protection Obligations"},{"id":"BC-1270.50.10","name":"Privacy Impact Assessment"},{"id":"BC-1270.50.20","name":"Data Flow & Subprocessor Mapping"},{"id":"BC-760.30.20","name":"Security Incident Response"}]},{"id":"PC-760.40","name":"DSAR Automation","description":"Requests from individuals to access, correct or erase their data, handled by workflow, with records found and deleted in connected systems without scanning everything and results returned to the requester over a protected channel.","business_capability_ids":["BC-1270.50.30","BC-140.10.30"],"maturity":"core","confidence":"high","source_url":"https://www.onetrust.com/solutions/privacy-automation/","business_capabilities":[{"id":"BC-1270.50.30","name":"Data Subject Rights Fulfillment"},{"id":"BC-140.10.30","name":"Privacy & Data Protection Obligations"}]},{"id":"PC-760.50","name":"DataGuidance","description":"Research on privacy and related laws by jurisdiction, with an assistant for questions, used to keep obligations current.","business_capability_ids":["BC-140.10.20"],"maturity":"strong","confidence":"high","source_url":"https://www.onetrust.com/solutions/privacy-automation/","business_capabilities":[{"id":"BC-140.10.20","name":"Regulatory Change Monitoring"}]},{"id":"PC-760.60","name":"Third-Party Risk Management","description":"Intake screening and tiering of third parties, assessments across security, privacy, ethics and compliance with AI help on evidence, and monitoring of security ratings, breaches and adverse news between reviews.","business_capability_ids":["BC-640.40.10","BC-640.40.20","BC-760.60.10"],"maturity":"core","confidence":"high","source_url":"https://www.onetrust.com/solutions/third-party-management/","business_capabilities":[{"id":"BC-640.40.10","name":"Supplier Risk Tiering"},{"id":"BC-640.40.20","name":"Continuous Risk Monitoring"},{"id":"BC-760.60.10","name":"Supplier Security Assessment"}]},{"id":"PC-760.70","name":"Third-Party Due Diligence","description":"Screens new third parties against risk and compliance databases at intake so that low-risk ones can be approved without a full assessment.","business_capability_ids":["BC-640.10.10","BC-140.10.40"],"maturity":"partial","confidence":"medium","source_url":"https://www.onetrust.com/solutions/third-party-management/","business_capabilities":[{"id":"BC-640.10.10","name":"Supplier Qualification"},{"id":"BC-140.10.40","name":"Trade & Sanctions Obligations"}]},{"id":"PC-760.80","name":"IT Risk Management","description":"An IT asset inventory tied to risk assessments, with scoring and roll-up of technology and security risks.","business_capability_ids":["BC-760.10.20","BC-710.50.30"],"maturity":"strong","confidence":"high","source_url":"https://www.onetrust.com/solutions/tech-risk-and-compliance/","business_capabilities":[{"id":"BC-760.10.20","name":"Security Risk Assessment"},{"id":"BC-710.50.30","name":"Technology Risk Reporting"}]},{"id":"PC-760.90","name":"Compliance Automation","description":"A control library over a large set of prebuilt frameworks, evidence collected once through connectors and reused across them, and a portal where staff read and attest to policies.","business_capability_ids":["BC-1270.10.10","BC-1270.10.20","BC-140.40.20","BC-140.20.30","BC-760.10.30"],"maturity":"strong","confidence":"medium","source_url":"https://www.onetrust.com/solutions/tech-risk-and-compliance/","business_capabilities":[{"id":"BC-1270.10.10","name":"Control Framework Management"},{"id":"BC-1270.10.20","name":"Continuous Evidence Collection"},{"id":"BC-140.40.20","name":"Compliance Testing"},{"id":"BC-140.20.30","name":"Attestation & Certification"},{"id":"BC-760.10.30","name":"Security Control Testing"}]},{"id":"PC-760.95","name":"AI Governance","description":"One record of each AI system and its parts, including models, agents, datasets and suppliers, with an owner and lifecycle stage, risk tiers set by the same rules whether the AI was built or bought, and prebuilt assessments for the main AI laws and standards.","business_capability_ids":["BC-770.10.50","BC-770.10.30","BC-770.10.20","BC-140.10.10"],"maturity":"strong","confidence":"high","source_url":"https://www.onetrust.com/solutions/ai-governance/","business_capabilities":[{"id":"BC-770.10.50","name":"AI System Inventory"},{"id":"BC-770.10.30","name":"AI Risk & Model Review"},{"id":"BC-770.10.20","name":"Responsible AI Policy"},{"id":"BC-140.10.10","name":"Obligation Inventory"}]},{"id":"PC-760.97","name":"Guardrail Enforcement and Guardian Agents","description":"Policies carried out at the point where AI runs to stop or mask sensitive content and hold agents to their allowed actions and MCP use, with agents that watch other agents in production.","business_capability_ids":["BC-760.50.50","BC-770.50.50","BC-770.30.40"],"maturity":"emerging","confidence":"high","source_url":"https://www.onetrust.com/solutions/ai-governance/","business_capabilities":[{"id":"BC-760.50.50","name":"AI Runtime Protection"},{"id":"BC-770.50.50","name":"Model & Tool Access Brokering"},{"id":"BC-770.30.40","name":"Output Evaluation & Guardrails"}]}],"page_url":"https://catalog.mikereams.com/products/PR-760"}}