Data Mapping & Risk Manager Release - July 4, 2024

In this release:

Key Features and Enhancements

• For Business Associate & Customer third party type, None is displayed in the Risk Assessment column
• Added Risk Summary and Data Transfer Risk Summary sections to the Third Party Record
• Ability to export multiple Risk Reports from the listing pages
• Risk & Assessments tab is updated immediately with risk changes

Feature Details

For Business Associate & Customer third party type, None is displayed in the Risk Assessment column

Benefits

Improves user experience.

Details

In this release, the Risk Assessment column of the Data Inventory All Records and Third Party Records tabs is updated. To be consistent with other parts of the application, “None” is displayed in the Risk Assessment column instead of disabled Start Assessment.

For record types of Partner, Service Provider, and Vendor, users can create only the Risk Assessment but not the data transfer assessment.

Added Risk Summary and Data Transfer Risk Summary sections to the Third Party Record

Benefits

Improves user experience.

Details

In this release, the following updates to the third party record will be implemented.

• Updated Assessments tab to “Risk & Assessments” tab (1)
• Added instructions to the tab (2)
  
  “Review the Risk Scores and proceed to complete the recommended assessments for the System Records owned by this Third Party.”
   
• Added the risk summary and data transfer risk summary sections to the Risk & Assessments tab

Risk Summary section

Review Inherent Risk Score box

• The inherent risk score is displayed.
   
  • If there are no systems associated with the third party record, only the third party “Third Party Score” option is enabled  and, when clicked, the Review Inherent Risk Score pop-up modal is displayed.
    
    
     
  • If system records are associated with the third party record, the “System Score” option is enabled and, when clicked, the Review System Risk pop-up modal is displayed.
    
    

Complete Risk Assessment box

• The Start Assessment button with drop-down is displayed (note that the Start Assessment button logic should work the same as the system and bp record).
  • If there are no systems associated with the third party record, then only the “Third Party Assessment” option is enabled. When clicked, the third party assessment pop-up modal is displayed.
    
    
    
    NOTE: If assessment is already created, users have the ability to view or change the assessment.
     
  • If system records are associated with the third party record, then the “System Assessment” option is enabled. When clicked, the system assessment pop-up modal is displayed.
    
    
    
    NOTE: If assessment is already created, users have the ability to view or change the assessment

Review Residual Risk Score & Download Report

• The Download Risk Report button and drop-down is added.
  
  
   
  • If the Third Party Risk Report option is clicked, then download begins.
  • If  the System Risk Report is clicked, then a pop-up modal is displayed that allows users to select the system record from the drop-down menu. Once selected, the residual risk score is displayed for that system and users will have the ability to download the report if one is available.
    
    

Data Transfer Risk Summary section

Review Inherent Risk Score box

• The data transfer inherent risk score is displayed.
• The Review Score button is added.
   
  • Button is only enabled when third party owns 1 or more system records.
  • When the button is clicked, the Review System Data Transfer Risk pop-up modal is displayed. Note that a drop-down menu to the top of the pop-up modal that lists only the system records that are owned by that third party is available.
    
    
     
  • Once a system is selected from the drop-down modal, the data transfer countries in the modal (same as system/bp design) are displayed.

Complete Data Transfer Risk Assessment box

• The assessment status is displayed (If all are complete status = Complete, if any are incomplete status = Incomplete, if all are in-progress status = In-Progress).
• The Start Assessment button is displayed. The button is enabled only if the third party record owns at least one system.
• When the Start Assessment button is clicked, the data transfer assessment pop-up modal is displayed.
  
  
   
  • At the top of the pop-up modal, a drop-down menu listing only the system records that are owned by that third party is added.
  • Once the user selects the system they would like to assess, the data transfer risk assessment options are displayed in the modal.
  • If assessment is already created, users have the ability to view or change the assessment

Review Data Transfer Residual Risk Score & Download Report box

• The Data Transfer Residual Risk score is displayed.
• The Download Risk Report button is added. This button is only enabled if one or more of the owned system records has a report available for download.
• When the button is clicked, a pop-up that allows users to select a system record from the drop-down menu (only systems owned by the third party are listed) is displayed.
  
  

Ability to export multiple Risk Reports from the listing pages

Benefits

Allows users to export multiple risk reports at one time.

Details

In this release, in the Business Process and Data Inventory listing pages, the following are added to the Export menu:

• PDF Reports
   
  • Risk Report (*new*)
  • Data Transfer Risk Report (*new*)
    
    When the user selects some records that don’t have the risk report available, a confirmation modal listing the records that are not available is shown, and gives the user the option to continue downloading only available reports.

• If all selected records are available, the system will send the reports to the email/notification.
• If only partial records are available, a confirmation modal showing records with unavailable reports is displayed.
• If all records are unavailable: a toast message saying “The selected records don’t have Risk Report/Data Transfer Risk Report available for download“ is displayed.

Risk & Assessments tab is updated immediately with risk changes

Benefits

Improves user experience.

Details

When risk changes are updated in the API, and the Risk & Assessments tab is visible, the risk sections should be updated.

This is applicable for both It System and BP.