# OneTrust review: 64/100 **URL:** https://theauditrail.com/vendors/onetrust/ **Published:** 2026-10-11 **Modified:** 2026-10-11 **Author:** The Audit Trail editorial desk > OneTrust scores 64 out of 100 on rubric v0.9. Top marks on vendor risk and automated evidence, none on trust and questionnaires. --- Scorecard ![OneTrust logo](https://theauditrail.com/logos/onetrust.png) # OneTrust Scorecard The Audit Trail editorial desk Published Oct 11, 2026 64 Adequate (55 to 69) 6th Published Scored on rubric v0.9, October 2026 Verdict Scores 5 of 5 on vendor risk management, through a Third-Party Risk Management package sold separately from Tech Risk & Compliance, and 5 of 5 on automated evidence. Trust and questionnaires earns no credit, pricing transparency scores 1 of 5 and audit path 2 of 5. **Best for companies that already run privacy on OneTrust.** ![OneTrust Dashboard and Analytics showing 1278 total risks, 76 mitigated risks and risks by category charts](https://theauditrail.com/shots/reviews/onetrust/tech-risk.webp) OneTrust product page, captured 6 October 2026 Strengths - Top score on vendor risk management - 500+ system connectors claimed, plus APIs - Custom frameworks Limitations - No price on its website - Trust and questionnaires scores 0 of 5 - Audit path scores 2 of 5 Full review · 8 min read The full OneTrust review What you get · Plans and pricing · Frameworks · Evidence collection and monitoring · Audits · Vendor risk Close OneTrust sells privacy, consent and AI governance software, and its Tech Risk & Compliance line is what a SOC 2 or ISO 27001 buyer puts next to [Drata](https://theauditrail.com/vendors/drata/). It scores 64 out of 100 on our rubric. That ranks it sixth of the seven platforms we score, behind [Scrut](https://theauditrail.com/vendors/scrut/) at 72 and ahead of [Thoropass](https://theauditrail.com/vendors/thoropass/) at 52. OneTrust scores 5 out of 5 on vendor risk management, through Third-Party Risk Management, a package sold separately from Tech Risk & Compliance, and 5 out of 5 on automated evidence. Trust and questionnaires is the weak point and earns no credit. Pricing transparency scores 1 out of 5 and audit path 2 out of 5. Quote only Price on onetrust.com 50+ Frameworks claimed 500+ System connectors claimed 2 months Average time to implement, G2 2016 Founded, Atlanta 14,000+ Customers claimed ## What you get Tech Risk & Compliance holds two products. OneTrust says Compliance Automation collects evidence, maps controls and tracks audit readiness. It says IT Risk Management keeps “an evergreen asset inventory” and scores risk “across an inventory of assets, processes, and vendors.” OneTrust’s own summary of the line: “Simplify Compliance and Manage Risk With Confidence.” [![OneTrust Dashboard and Analytics showing 1278 total risks, 76 mitigated risks and risks by category charts](https://theauditrail.com/shots/reviews/onetrust/tech-risk.webp)](/shots/reviews/onetrust/tech-risk.webp) OneTrust Tech Risk and Compliance page, captured Oct 6, 2026 The same platform sells privacy automation, consent management, AI governance and third-party management, the wider scope that [GRC software](https://theauditrail.com/best/grc-software/) covers. A company already on OneTrust for privacy buys compliance from the vendor it already pays. The older product, Certification Automation, is on its way out. It is the former Tugboat Logic, and OneTrust stopped renewing it on August 31, 2026. OneTrust says its non-SSO users are migrated to the main OneTrust platform. OneTrust was founded in 2016 and has its US headquarters in Atlanta. It reports 2,000 employees and says more than 14,000 customers use it. John Heyman replaced founder Kabir Barday as CEO in February 2026. ## Plans and pricing Plan Price What it adds Tech Risk & Compliance Quote only Compliance Automation and IT Risk Management, 50+ frameworks, policy workflows Third-Party Risk Management Base Quote only Third-party inventory, automated assessments, risk intelligence data Third-Party Management Suite Quote only Adds Dow Jones screening for sanctions and watchlists, plus adverse media monitoring [![OneTrust pricing page Tech Risk and Compliance package with five key capabilities and a Get Pricing button, no price shown](https://theauditrail.com/shots/reviews/onetrust/pricing.webp)](/shots/reviews/onetrust/pricing.webp) OneTrust pricing page, captured Oct 6, 2026 Prices are in US dollars. OneTrust prints no figure for any package. Tech Risk & Compliance is priced by admin users and asset inventory. Vendor risk management is a separate package, priced by admin users and third-party inventory. ## Frameworks OneTrust claims 50+ ready-to-use frameworks on its Compliance Automation page and 55+ on the Tech Risk & Compliance page. [SOC 2](https://theauditrail.com/frameworks/soc-2/), [ISO 27001](https://theauditrail.com/frameworks/iso-27001/), HIPAA, GDPR and NIS2 appear as framework cards on the Compliance Automation page, and PCI DSS has a separate OneTrust page. [CMMC](https://theauditrail.com/frameworks/cmmc/) 2.0 has a page that covers all three maturity levels, and NIST CSF is named among the frameworks it automates. That earns 4 out of 5 on framework coverage. ISO 42001 sits in OneTrust’s separate AI Governance package, so it adds nothing to this score. FedRAMP and NIST 800-53 earn no credit. OneTrust says a team can “auto-populate your own custom framework” and map one piece of evidence to several frameworks. It calls that “Collect once, comply many.” ## Evidence collection and monitoring [![OneTrust Compliance Automation product graphic of a framework compliance chart for CCPA, GDPR, SOC 2, NIST CSF and ISO 27001](https://theauditrail.com/shots/reviews/onetrust/monitoring.webp)](/shots/reviews/onetrust/monitoring.webp) OneTrust Compliance Automation page, captured Oct 6, 2026 OneTrust gives two integration numbers on one page. The Tech Risk & Compliance summary claims “200+ pre-built integrations.” OneTrust cites “500+ pre-built system connectors” for its integrations gallery further down the same page. The rubric scores the larger figure, which gives 5 out of 5 on automated evidence. Evidence comes in through what OneTrust calls “pre-architected end-to-end collectors,” AWS among them. OneTrust says Compliance Automation runs continuous controls monitoring and reports through real-time dashboards. OneTrust also offers APIs, SDKs and a visual integration builder. ## Audits OneTrust says teams can invite auditors to review their compliance in the platform, and that its SOC 2 product lets teams “collaborate with auditors.” That is worth 2 out of 5 on audit path. Level 3 on audit path also needs a named network of audit firms, and OneTrust earns no credit there. Its Tech Risk & Compliance page lists service partners and technology partners. Whichever firm a company hires, the SOC 2 report is signed by a [licensed CPA firm](https://theauditrail.com/frameworks/soc-2/who-performs-a-soc-2-audit/). ## Vendor risk Vendor risk management is OneTrust’s strongest criterion, and it scores 5 out of 5. OneTrust says Third-Party Risk Management builds the third-party inventory, tiers each supplier by risk and sends assessments from the platform. More than 50 built-in control frameworks can shape those assessments. [![OneTrust third-party assessment review listing risks with inherent risk scores and category scores](https://theauditrail.com/shots/reviews/onetrust/vendor-risk.webp)](/shots/reviews/onetrust/vendor-risk.webp) OneTrust Third-Party Management page, captured Oct 6, 2026 OneTrust’s own wording on the AI step is “Use AI to ingest external risk evidence and generate questionnaire response.” After onboarding, it says the product can “continuously monitor third-party risk and trigger reassessments.” It also says it screens cyber risk ratings and breach activity from RiskRecon, SecurityScorecard and HackNotice. OneTrust says its AI-powered data collection cuts assessment time by up to 70%. The Suite package adds Dow Jones screening and adverse media monitoring. ## Trust center and security questionnaires Trust and questionnaires earns no credit: neither a trust center nor questionnaire tooling is credited to Tech Risk & Compliance, so the criterion scores 0 out of 5. OneTrust publishes its own security records at onetrust.com/trust. It lists ISO 27001, two SOC 2 Type II reports, PCI DSS, HITRUST and TISAX, plus a 2026 penetration test summary. 131 of the 164 cloud companies in our [trust center study](https://theauditrail.com/research/trust-centers/) run a dedicated trust center. [![OneTrust trust center listing ISO 27001, SOC 2 Type II audit reports, PCI DSS, HITRUST, TISAX and TX-RAMP documents](https://theauditrail.com/shots/reviews/onetrust/trust-center.webp)](/shots/reviews/onetrust/trust-center.webp) OneTrust trust center, captured Oct 6, 2026 ## Policies and people OneTrust says policies live in an employee portal with version control and approval workflows. It says approval steps can follow the company’s own terms, phases and reviewers. OneTrust lists “Track policy attestations & exceptions with automated follow-up” among the capabilities. OneTrust says a scoping survey builds the starting list of policies and controls. It also says incidents and issues run through their own workflow, from intake through remediation. ## Support and services Support comes in four Success Packages. Essentials covers Monday to Friday, 8AM to 11PM GMT, with a 4-hour first response target for the most severe issues. Plus Success adds round-the-clock support for those issues. Premier adds a dedicated Customer Success Manager and a 2-hour target. Signature cuts the target to 1 hour. ## What G2 reviewers say OneTrust Tech Risk & Compliance holds 4.5 out of 5 from 109 reviews on G2. 77% of reviews are five stars and 19% are four stars. What G2 reviewers say Review themes by number of mentions, October 2026 4.5 109 reviews 5 77 % 4 19 % 3 1 % 2 0 % 1 0 % Praised for Ease of use 13 Automation 10 Risk management 9 Compliance management 9 Features 7 Complaints Difficult setup 6 Complex implementation 6 Learning difficulty 5 Learning curve 5 Complex setup 5 [All reviews on G2 ↗](https://www.g2.com/products/onetrust-tech-risk-compliance/reviews) Ease of use leads the praise themes, followed by automation, risk management, compliance management and features. The complaint themes cover setup, implementation and the learning curve. G2 reviewers put average time to implement at 2 months. A reviewer on interface and cost: “The dashboard UI needs a refresh and the price is a bit high compared to similar products.” Some reviews on the listing describe privacy work, such as cookie consent, under the same product name. ## Who should buy OneTrust - **Companies already on OneTrust for privacy or consent.** Compliance, vendor risk and privacy then run on one platform from one vendor. - **Security teams whose heaviest load is supplier reviews.** Vendor risk management scores 5 out of 5 through the separately sold Third-Party Risk Management package, level with Sprinto, Vanta and Scrut. - **Programs that need IT risk scoring next to compliance.** OneTrust says IT Risk Management ships inside Tech Risk & Compliance, with an asset inventory and risk dashboards. ## Who should look elsewhere - **You want a price before the first call.** [Secureframe](https://theauditrail.com/vendors/secureframe/) prints a starting price of $7,500 a year for up to 100 employees on its website, and scores 2 on pricing transparency against OneTrust’s 1. - **You want the audit bought with the platform.** [Thoropass](https://theauditrail.com/vendors/thoropass/) delivers the audit through an in-house CPA firm and scores 5 on audit path. [Drata](https://theauditrail.com/vendors/drata/), [Vanta](https://theauditrail.com/vendors/vanta/), [Sprinto](https://theauditrail.com/vendors/sprinto/) and [Scrut](https://theauditrail.com/vendors/scrut/) all score 3 with named audit firm networks. - **You answer a lot of security questionnaires.** Drata pairs its trust center with AI questionnaire assistance and scores 4 on trust and questionnaires against OneTrust’s 0. The six other platforms all score 4 there. - **You will build custom tests.** [Sprinto](https://theauditrail.com/vendors/sprinto/) scores 5 on customisation, two points ahead of OneTrust’s 3. - **You need FedRAMP or ISO 42001 inside the compliance product.** The other six platforms all score 5 on framework coverage, a point ahead of OneTrust’s 4. FedRAMP earns OneTrust no credit, and its ISO 42001 support sits in the separate AI Governance package. ## How we score it OneTrust scores 64 out of 100 on [rubric v0.9](https://theauditrail.com/rubric/), one of the [seven platforms we score](https://theauditrail.com/vendors/). Full marks go to vendor risk management and automated evidence. Trust and questionnaires is the lowest score at 0 out of 5. Pricing transparency follows at 1 out of 5, since onetrust.com names its packages without a dollar figure, and audit path at 2 out of 5. OneTrust against the field OneTrust Average of the 7 platforms we score Framework coverage **4**/5 7th of 7 Automated evidence **5**/5 Tied 1st of 7 Audit path **2**/5 Tied 6th of 7 Pricing transparency **1**/5 Tied 2nd of 7 Trust and questionnaires **0**/5 7th of 7 Vendor risk management **5**/5 Tied 1st of 7 Customisation **3**/5 6th of 7 User sentiment **4**/5 7th of 7 ## Score by criterion - Framework coverage15% of total 4/5 SOC 2, ISO 27001, HIPAA and GDPR on the Compliance Automation page, PCI DSS and CMMC 2.0 on separate onetrust.com pages, and NIST CSF in a Tech Risk & Compliance data sheet. No credit for FedRAMP or NIST 800-53, and ISO 42001 sits in the separate AI Governance package. Level 4: All of level 3, plus one or two of ISO 42001, NIST CSF, NIST 800-53, FedRAMP or CMMC. - Automated evidence20% of total 5/5 OneTrust claims 200+ pre-built integrations for Tech Risk & Compliance and 500+ pre-built system connectors in its integrations gallery, on the same page. It says it runs continuous controls monitoring, with APIs and a visual integration builder. The score uses the larger figure, 500+. Level 5: 300 or more published integrations, continuous tests, and a public API or custom integration builder. - Audit path15% of total 2/5 OneTrust says teams can invite auditors to review their compliance in the platform. No credit for a named network of audit firms. Level 2: A named partner network of audit firms, or auditors can review evidence inside the platform. - Pricing transparency10% of total 1/5 One Tech Risk & Compliance package is published with its capabilities and a pricing basis (admin users and asset inventory), with no dollar figures. Level 1: Plan names and inclusions are published, with no numbers. - Trust and questionnaires10% of total 0/5 Trust and questionnaires earns no credit: neither a trust center nor questionnaire tooling is credited to Tech Risk & Compliance. Level 0: No trust center and no questionnaire tooling. - Vendor risk management10% of total 5/5 OneTrust says its separately sold Third-Party Risk Management builds the third-party inventory, tiers risk, sends assessments, uses AI to "ingest external risk evidence" and can "continuously monitor third-party risk and trigger reassessments". Level 5: All of level 4, plus continuous monitoring of vendor risk after onboarding. - Customisation10% of total 3/5 OneTrust says teams can "auto-populate your own custom framework" in Compliance Automation. No credit for custom automated tests. Level 3: Custom frameworks can be built. - User sentiment10% of total 4/5 4.5 out of 5 from 109 reviews of OneTrust Tech Risk & Compliance on G2. Level 4: Average 4.5 or higher with 25 to 199 reviews. Not credited in this score - A trust center - Questionnaire tooling - FedRAMP and NIST 800-53 - A named network of audit firms - Custom automated tests OneTrust can ask for a re-check of any of these. If the score changes, the change is logged. Sources 1. [OneTrust Tech Risk & Compliance](https://www.onetrust.com/solutions/tech-risk-and-compliance/) 2. [OneTrust Compliance Automation](https://www.onetrust.com/products/compliance-automation/) 3. [OneTrust Compliance Automation demo page](https://www.onetrust.com/forms/compliance-automation-demo/) 4. [OneTrust pricing and packaging](https://www.onetrust.com/pricing/) 5. [OneTrust SOC 2 compliance](https://www.onetrust.com/solutions/soc-2-compliance/) 6. [OneTrust Third-Party Management](https://www.onetrust.com/solutions/third-party-management/) 7. [OneTrust Third-Party Risk Management](https://www.onetrust.com/products/third-party-risk-management/) 8. [OneTrust integrations](https://www.onetrust.com/integrations/) 9. [OneTrust trust center](https://www.onetrust.com/trust/) 10. [G2 listing](https://www.g2.com/products/onetrust-tech-risk-compliance/reviews) ![OneTrust logo](https://theauditrail.com/logos/onetrust.png) OneTrust [onetrust.com ↗](https://www.onetrust.com) 64 Adequate (55 to 69) 6th Status Published Founded 2016 Headquarters Atlanta, Georgia [G2 ↗](https://www.g2.com/products/onetrust-tech-risk-compliance/reviews) 4.5/5 · 109 reviews Pricing Quote only Assessed Oct 11, 2026 Tagline on onetrust.com > Scale your resources and optimize your risk and compliance lifecycle across a complex technology landscape. **Quote only.** The vendor lists no dollar price on its website or on an AWS Marketplace listing.