tmc3 Limited

Third Party Risk Management

Third-Party Risk Management by OneTrust. The platform enables organisations to streamline and efficiently manage third parties and suppliers throughout the supplier due diligence lifecycle. Automated workflows simplify supplier risk assessments and intelligently flag risks based on your custom scoring methodology or choose from 25+ built-in control frameworks.

Features

• Automate supplier onboarding questionnaires and easily manage supplier risk profiles
• Create a single source of truth with centralised supplier management
• Trigger actions or notifications, create reassessment automations using contract expirations
• Track supplier risk and performance over time with AI-driven dashboards
• Embed third party risk management into operations to simply compliance
• Seamlessly create workflows across systems utilising 500+ pre-built plugins
• Centrally track, monitor and update supplier due diligence risk profiles
• Built-in business intelligence engine to automate supplier compliance reporting
• Simplify decision-making with in-platform supplier risk management recommendations
• Layer on any control framework, risk category, or scoring methodology

Benefits

• Simplify third-party and supplier risk management
• Save time and speed up supplier onboarding with inherent automation
• Single-source of truth to ensure correct information for critical decisions
• Focus teams on risk reduction, not on supplier evidence collection
• Prioritisation allows focus on the areas that matter the most
• Accurately measure third-party risks and supplier maturity
• Remove manual processes, reducing cost and improving output
• Improve productivity with automated workflows, pre-built templates and integrations
• Real-time insights and analytics to demonstrate supplier due diligence
• Supplier onboarding completed faster with collaboration and productivity tools integrations

£78,840 to £157,680 an instance a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Frameworks@tmc3.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

528522959702861

Contact

Nathan Tittensor
0113 8730449
Frameworks@tmc3.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: OneTrust solution supports an on-premise implementation, and specific hardware and software requirements can be provided as the sales cycle continues.
• System requirements: Web browser

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Yes all active clients can access our online support portal at any time.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AAA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: OneTrust provides our customers real-time SLA metrics through our status page found within the OneTrust Support Portal (https://my.onetrust.com ), which allows our customer base to see direct, on-demand access to real time SLA data
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The software is typically implemented within one to two months with more complex needs taking longer. OneTrust supports full implementation services through our in-house privacy certified Implementation team. OneTrust's solution is ready to use out-of-the-box the day after contract negotiations are complete, and customers will receive assigned implementation resource(s) within a week to support for the duration of the project.; ; OneTrust defines project responsibilities, milestones, and client expectations through our Statement of Work (SOW) documents, either standard implementations or customized if specific implementation requirements are needed. OneTrust Professional Services include the provisioning of training materials and webinar resources via access to the MyOneTrust online support portal, a kick-off meeting to explain our implementation process and workshop and Q&A sessions on configuration and leading best practices for leveraging our solution internally in your organization
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Customer data is retained for the life of the contract with OneTrust unless deleted by the customer through the UI of the application unless deleted by the client. ; ; In the event of contract termination, a copy of customer data is provided to the customer and all remaining data on OneTrust systems is deleted within thirty days of contract termination; Microsoft Azure follows NIST 800-88 data destruction policies.
• End-of-contract process: No additional cost.; ; In the event of contract termination, a copy of customer data is provided to the customer and all remaining data on OneTrust systems is deleted within thirty days of contract termination; Microsoft Azure follows NIST 800-88 data destruction policies.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.1 AAA
• Description of service interface: GUI of the app available through internet browser.
• Accessibility standards: WCAG 2.1 AAA
• Accessibility testing: Testing conducted internally
• API: Yes
• What users can and can't do using the API: OneTrust uses REST-based APIs to pull data into the OneTrust application. All API calls require an OAuth bearer token to prove that the user is logged in and has been granted access to the resource being accessed. OneTrust has the largest network of deep, pre-defined system integrations through our API connectivity abilities. This includes a catalogue of pre-integrated applications that make it easy to integrate privacy into your existing application workflows across your organization. We offer the industry’s broadest and deepest set of integrations and are continuously adding new ones to our library. The OneTrust platform provides a powerful but flexible way to connect to your applications through APIs, SDKs, data feeds, system integration, and more. Out of the box integration capabilities include JIRA, ServiceNow, Zendesk, Slack, email, Tableau, Google Suite, and popular tag managers such as Tealium, Google Tag Manager, Adobe Launch, and much more. Please see our website for additional details.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • ODF
  • PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Dashboards, reporting, UI and other elements within the product are customisable.

Scaling

• Independence of resources: The VM's do not use resource pools; they use individual guaranteed CPU/memory cycles.

Analytics

• Service usage metrics: Yes
• Metrics types: All support levels include Software Updates, remote support, unlimited support requests, and support requests and responses via telephone (onetrust.com/company/contact) or web (my.onetrust.com). Scheduled maintenance takes place between the hours of 10PM – 2AM local time based upon the location of the data centre and users will receive notification of scheduled maintenance 24 hours in advance via the support portal (provided such user has opted to receive notices from the support centre). See further information in our Support Level Document
• Reporting types:
  • Real-time dashboards
  • Reports on request

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: OneTrust

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: OneTrust supports an export/import feature that allows external users (e.g. a vendor receiving an assessment) to download the related template into a practical excel format. This means that, in case of latency issues that impact the ability to operate directly online, this functionality would enable the recipient to complete the assessment offline and then subsequently upload results back into the platform
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: OneTrust guarantees a high availability of our overall platform through our SLA of 99.95% during any given calendar month. Tmc3 can attach OneTrust's SLA to the contract by purchasing Enterprise Licensing or Support. OneTrust's also offers a SLA for our Website Scanning and Cookie Compliance module of 100% during any given calendar month.
• Approach to resilience: Backups are stored at secondary Azure data centre, more details available on request.
• Outage reporting: Through our online support portal

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: Defined in our SOC 2 Type II report, available on request
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Coalfire Certification
• ISO/IEC 27001 accreditation date: 15/02/2022
• What the ISO/IEC 27001 doesn’t cover: The scope of the Integrated Management System (IMS) is bounded by specified services for OneTrust Privacy, Security & ; Governance. The IMS is comprised of components, network devices, and software, that are operating to make OneTrust Privacy, ; Security & Governance Software available to customers within Microsoft Azure production accounts. These activities are governed ; by the implemented controls in accordance with the organizational Statement of Applicability based on ISO/IEC 27001:2013, which ; further extends to the additional controller and processor controls defined within ISO/IEC 27701:2019.; The departmental scope includes the General & Administrative, Marketing, Professional Services, Research & Development, and ; Sales teams affecting the IMS
• ISO 28000:2007 certification: No
• CSA STAR certification: Yes
• CSA STAR accreditation date: 25/03/2022
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: N/A
• PCI certification: Yes
• Who accredited the PCI DSS certification: Available upon request
• PCI DSS accreditation date: Available upon request
• What the PCI DSS doesn’t cover: Available upon request
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • SOC 2 Type II Report
  • ISO/IEC 27701 Privacy Information Management System Certification

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: OneTrust has a policy that provides management direction and support for information security in accordance with business requirements, and relevant laws and regulations.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: OneTrust has a policy that establishes procedures on the proper management of IT production, including change management, capacity management, malware, backup, logging, monitoring, installation, vulnerabilities, etc.; ; https://www.onetrust.com/trust/
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: OneTrust teams perform ongoing product vulnerability management for the OneTrust application through regular assessments and reviews of product environments, employing vulnerability scan assessments and web application vulnerability assessments. OneTrust also performs internal OneTrust security team penetration testing, and an annual engagement with a OneTrust validated third-party. OneTrust applies product vulnerability remediation following the CVSS rating methodology: Critical patches are applied within six weeks; high patches within nine weeks; medium patches within 12 weeks; and low patches within 24 weeks. ; OneTrust leverages the agile development methodology with three-week sprints to push a new release to our software on a regular basis.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Defined in our SOC 2 Type II report, available on request; ; https://www.onetrust.com/trust/
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: We manage all incident responses with our incident response team and our incident response plan crafted and executed internally in accordance with applicable laws and regulations as well as our ISO 27001 certification. Information available on request.; ; https://www.onetrust.com/trust/

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  In 2024, tmc3 has achieved Net Zero emissions.; ; tmc3 has implemented a documented Environmental Management System to reduce our environmental impacts. We will continue to focus on further reductions and our sights remain firmly set on exceeding all elements of our Science-Based Target on a long-term basis.; ; Actions we take include, but are not limited to: establishing environmentally sensitive purchasing policies (buying recycled or long-life products; favouring products derived from natural/sustainable sources) and monitoring the environmental performance of our suppliers; ensuring that all decisions regarding working practices and purchasing take environmental considerations into account. We measure, monitor and minimise our usage of resources and consumables, and our greenhouse gas emissions. We actively look for ways to reduce waste and recycling, and encourage the use of sustainable modes of transport. We encourage home working and the use of virtual collaboration tools.; ; tmc3's Carbon Reduction Plan has been completed in accordance with PPN 06/21 and associated guidance and reporting standard for Carbon Reduction Plans. This is available on the tmc3 website.; ; For the provision of these services, we commit to offsetting the carbon footprint for the development of the tmc3 deliverables and, if requested, will provide certification verifying this action has been completed within a month of project completion. We will measure the ‘As-is’ state of the contract to give us an accurate benchmark to work from, and how we need to progress throughout the contract lifecycle. This will include measuring against Scope 1,2&3 emissions, for example: Water use, electricity use, conducting a materiality checklist, measuring business travel, working from Home, business travel accommodation, employee commuting etc. We will gather data across all scope of emissions and utilise carbon calculator tooling to give an accurate and transparent measurement. We will then present these findings back to you and key stakeholders.

  Tackling economic inequality

  Social responsibility and supporting our communities are hugely important aspects of who we are. We love to spend time and energy helping local charities and developing the security professionals of tomorrow, through organising meetups and mentorship initiatives. Cyber Choices, Hullo and Hull4Heroes are just a few charities and initiatives we support. For us, this is much more than a set of words, this is about the positive impact we have on society, the environment and the economy.; ; tmc3 are pleased to confirm that all of our staff and associates are paid above the real living wage, in addition to receiving a pay review following every performance review. Furthermore, we hold formal accreditation from the Living Wage Foundation as a living wage employer. In our supply chain of associates, we prefer to work with known and trusted associates with well-established subcontracts and working practices. We do not use zero hour contracts. ; ; We are committed to creating job opportunities, particularly for those who face barriers to employment or are located in deprived areas. Our hiring practices are inclusive, and we provide comprehensive training to our employees to equip them with the necessary skills for their roles. Additionally, we offer apprenticeships and internships to individuals from diverse backgrounds, providing them with practical experience and a pathway to employment in the technology industry.; Each year tmc3 supports a number of young people to obtain an apprenticeship in Cyber Security through the tmc3 Academy.; ; To monitor and measure our efforts in tackling economic inequality, we will use Key Performance Indicators such as:; ; 1. Number of new businesses supported: This will measure our impact on entrepreneurship.; 2. Number of job opportunities created: This will assess our contribution to employment.; 3. Number of individuals trained and qualifications achieved: This will evaluate our efforts in supporting educational attainment.

  Equal opportunity

  tmc3 is committed to ensuring fair treatment of all stakeholders in our business from customers to employees. We believe in equality of opportunity and inclusion, where tmc3’s Equality, Diversity and Inclusion policy goes beyond what we are required to do to ensure all contributions are valued and respected. We ensure that in all our activities we promote equality and provide respect to all, irrespective of marital or civil partnership status; having or not having dependants; religion or beliefs; race (including colour, nationality, ethnic or national origin); disability; sex or sexual orientation; age; or pregnancy and maternity. This policy extends beyond our own employees to client personnel, subcontractors, suppliers and potential recruits, and underpins our approach to recruitment of staff and engagement with our supplier base.; Our tailored onboarding programs acclimate new employees with disabilities to the workplace culture and educate them on relevant policies and procedures but also include disability-specific information such as physical alterations, flexible hours, staff training and more ergonomic equipment and software.; The tmc3 Academy is a development programme designed to cultivate emerging talent in the field of security. The Academy is tailored to guide individuals into becoming security specialists. It provides a dynamic mix of practical experiences and formal coaching, all underpinned by three pillars: competence, knowledge, and transferable skills.; ; The tmc3 Academy aims to empower individuals within a span of 16 months, providing them with hands-on experience, dedicated study sessions, and individualised coaching. This approach facilitates their transition into confident members of both the client-facing and internal teams at tmc3. The Academy prides itself on its inclusivity, welcoming individuals from diverse academic backgrounds and placing an emphasis on transferable skills and motivation rather than prior exposure to cyber security.

  Wellbeing

  tmc3 is a company that is committed to supporting the health and wellbeing of our staff, both physically and mentally. We make every effort to ensure that our people are physically comfortable working at home by providing office equipment, and whatever else is needed (subject to individual accessibility requirements). ; We provide an Employee Assistance Programme for all staff including access to an online platform and 24hr confidential helpline. This provides counselling support and a virtual library of wellbeing information, ensuring all staff have practical support for all aspects of physical and mental wellbeing. Our team physically get together every 6-8 weeks, to participate in social and team building activities. We have employed a Mental Health First Aider, who provides advice and support, to our personnel and associates. ; We have created a safe space for all employees to ask for help. This can be done confidentially, or anonymously, through our ‘Better Ways of Working’ form, which is reviewed by the Executive Committee. We capture decisions made, within the ExCo Minutes. Recent examples of action taken: ; o Introduced the Electric Vehicle Scheme ; o Introduced an Employee Rewards and Recognition Scheme ; o Private Medical Healthcare Plans ; We conduct regular mental health and well-being workshops for staff and stakeholders, drawing on our experience of coaching and mentoring experience with Hullo Charity. We have encouraged all tmc3 personnel to provide a minimum of one day (paid) per annum, to charity volunteering. We also factor in team charity days, such as planting trees for the UK National Forestry Commission. ; We routinely monitor employee MHW by undertaking: Engagement surveys to analyse UK employee MHW issues and monitor progress, and, Account “Pulse check” surveys to understand how people are feeling and whether immediate intervention is required.

Pricing

• Price: £78,840 to £157,680 an instance a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: OneTrust offers a free 14 day trial of our platform of Privacy, Consent & Preference Management, Data Governance, Ethics & Compliance, and ESG solutions to help your organization learn how OneTrust can help you operationalize risk, compliance, and business initiatives to make trust a competitive advantage.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Frameworks@tmc3.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.