04 — Product · PR-760
OneTrust
A trust and governance suite covering website and app consent, privacy program operations and data subject requests, third-party risk, IT risk and compliance, and the governance of AI systems, on one platform with shared inventories of assets, processes and vendors. Sold as solution packages and add-on products.
// FIG. 04 · Capability coverage
Each tile is an L1; the bar is how many of this product's capabilities realize something beneath it. Our judgment, not a vendor claim.
Direct & Govern
Finance
People & Workplace
Customer & Market
Products & Services
Operations & Supply
Technology & Data
Resilience & Responsibility
Industry L1s
- Plant Operations0
- Production Planning & Scheduling0
- Manufacturing Quality & Compliance0
- Industrial Engineering & Continuous Improvement0
- Plant & Process Safety0
- Dealer & Distributor Network0
- Aftermarket & Service Parts0
- Platform Engineering0
- Software Product Release0
- Site Reliability0
- Developer Experience & API Ecosystem0
- Subscription & Tenant Operations0
- Product Analytics & Experimentation0
- Trust & Compliance Assurance5
- Open Source & Community0
- Merchandising & Assortment0
- Store Operations0
- E-commerce & Omnichannel0
- Category & Trade Promotion0
- Loss Prevention0
- Consumer Insights0
- Store Network & Real Estate0
- Returns & Reverse Logistics0
- Network Planning & Engineering0
- Network Build & Field Operations0
- Network Operations & Assurance0
- Subscriber Order & Activation0
- Usage Charging & Subscriber Billing0
- Content & Programming0
- Advertising Sales & Operations0
- Communications Regulatory Obligations0
- Network Planning & Investment0
- Network Construction & Field Work0
- Network Operations & Control0
- Generation & Treatment Operations0
- Metering & Meter Data0
- Utility Customer Service & Billing0
- Energy Supply, Markets & Flexibility0
- Utility Regulation & Resilience0
- Transmission System Operations0
- Water & Wastewater Networks0
- Deposits & Accounts0
- Lending & Credit0
- Payments & Cards0
- Insurance Products & Policy0
- Insurance Claims0
- Wealth & Investment Management0
- Financial Crime0
- Prudential Risk & Regulatory Reporting0
- Patient Access0
- Clinical Care Delivery0
- Clinical Support Services0
- Revenue Cycle0
- Quality & Patient Safety0
- Population Health0
- Health Plan Operations0
- Health Information0
- Post-Acute & Home-Based Care0
The product at the base, its capabilities in the middle (taller = more mature), and the L1s they land under on top (taller = more of them). Our judgment, not a vendor claim.
- Top · Lands under
- L1Compliance · 8
- L2AI & Automation · 5
- L3Cybersecurity · 5
- L4Trust & Compliance Assurance · 5
- L5Customer Experience & Loyalty · 3
- L6Supplier & Contract Management · 3
- L7IT Strategy & Governance · 1
- Middle · Product capabilities
- P1Consent Management Platform · core
- P2Universal Consent & Preference Management · strong
- P3Privacy Operations · core
- P4DSAR Automation · core
- P5DataGuidance · strong
- P6Third-Party Risk Management · core
- P7Third-Party Due Diligence · partial
- +4 more in Plan
- Base · Product
- OneTrust · OneTrust LLC
Product capabilities · 11
How to read maturity and confidence
Maturity · how much it covers
- core
- What the product is built around; the capability is covered end to end.
- strong
- Covered well, with a few gaps a buyer would notice.
- partial
- Covers part of the capability; expect to pair it with something else.
- emerging
- New or thin; on the roadmap more than in the product.
Confidence · how well it is evidenced
- Evidence confidence: high
- The vendor's own documentation describes this module doing it.
- Evidence confidence: medium
- Documented, but how far it reaches into the capability is our reading.
- Evidence confidence: low
- Our judgment; we found no public page that confirms it.
- PC-760.10
Consent Management Platform
Evidence confidence: highMaturity: coreCookie banners and preference centers configured by region and language, trackers held back until a visitor agrees, and a searchable log of every consent and its changes across web, mobile and connected TV.
Vendor page: onetrust.com/products/consent-management/ ↗ - PC-760.20
Universal Consent & Preference Management
Evidence confidence: mediumMaturity: strongConsent and communication preferences recorded once and honored across channels and systems beyond the website banner.
- PC-760.30
Privacy Operations
Evidence confidence: highMaturity: coreA maintained map of personal data processing and the assets, processes and vendors behind it, AI-assisted privacy and data protection impact assessments, and logging of personal data incidents with a view on whether a regulator must be told.
- BC-140.10.30Privacy & Data Protection Obligations
- BC-1270.50.10Privacy Impact Assessment
- BC-1270.50.20Data Flow & Subprocessor Mapping
- BC-760.30.20Security Incident Response
- PC-760.40
DSAR Automation
Evidence confidence: highMaturity: coreRequests from individuals to access, correct or erase their data, handled by workflow, with records found and deleted in connected systems without scanning everything and results returned to the requester over a protected channel.
Vendor page: onetrust.com/solutions/privacy-automation/ ↗ - PC-760.50
DataGuidance
Evidence confidence: highMaturity: strongResearch on privacy and related laws by jurisdiction, with an assistant for questions, used to keep obligations current.
Vendor page: onetrust.com/solutions/privacy-automation/ ↗ - PC-760.60
Third-Party Risk Management
Evidence confidence: highMaturity: coreIntake screening and tiering of third parties, assessments across security, privacy, ethics and compliance with AI help on evidence, and monitoring of security ratings, breaches and adverse news between reviews.
- BC-640.40.10Supplier Risk Tiering
- BC-640.40.20Continuous Risk Monitoring
- BC-760.60.10Supplier Security Assessment
- PC-760.70
Third-Party Due Diligence
Evidence confidence: mediumMaturity: partialScreens new third parties against risk and compliance databases at intake so that low-risk ones can be approved without a full assessment.
Vendor page: onetrust.com/solutions/third-party-management/ ↗ - PC-760.80
IT Risk Management
Evidence confidence: highMaturity: strongAn IT asset inventory tied to risk assessments, with scoring and roll-up of technology and security risks.
Vendor page: onetrust.com/solutions/tech-risk-and-compliance/ ↗ - PC-760.90
Compliance Automation
Evidence confidence: mediumMaturity: strongA control library over a large set of prebuilt frameworks, evidence collected once through connectors and reused across them, and a portal where staff read and attest to policies.
- BC-1270.10.10Control Framework Management
- BC-1270.10.20Continuous Evidence Collection
- BC-140.40.20Compliance Testing
- BC-140.20.30Attestation & Certification
- BC-760.10.30Security Control Testing
- PC-760.95
AI Governance
Evidence confidence: highMaturity: strongOne record of each AI system and its parts, including models, agents, datasets and suppliers, with an owner and lifecycle stage, risk tiers set by the same rules whether the AI was built or bought, and prebuilt assessments for the main AI laws and standards.
- BC-770.10.50AI System Inventory
- BC-770.10.30AI Risk & Model Review
- BC-770.10.20Responsible AI Policy
- BC-140.10.10Obligation Inventory
- PC-760.97
Guardrail Enforcement and Guardian Agents
Evidence confidence: highMaturity: emergingPolicies carried out at the point where AI runs to stop or mask sensitive content and hold agents to their allowed actions and MCP use, with agents that watch other agents in production.
- BC-760.50.50AI Runtime Protection
- BC-770.50.50Model & Tool Access Brokering
- BC-770.30.40Output Evaluation & Guardrails
Sources · checked
The public vendor documentation this mapping is based on. Maturity and confidence are our judgment, not the vendor's claim.
- AI Governance Software | Solutions | OneTrust www.onetrust.com/solutions/ai-governance/
- Privacy Automation | Solutions | OneTrust www.onetrust.com/solutions/privacy-automation/
- Third-Party Management | Solutions | OneTrust www.onetrust.com/solutions/third-party-management/