<Partner Name> <Partner Product> RSA® ARCHER® GRC Platform Implementation Guide Thomson Reuters Regulatory Intelligence Feeds Bobbi Ireton, RSA Engineering Last Modified: May 22nd, 2018 Thomson Reuters Regulatory Intelligence Feeds Solution Summary The integration with Thomson Reuters Regulatory Feeds (TRRI Feeds) into the Corporate Obligations Management offering affords compliance teams to more easily manage the ever-growing volume of alerts from the world’s financial regulators. TRRI feeds provide firms with automated regulatory alerts from a database covering hundreds of global regulators. Multiple TRRI feeds can be created and configured to a client’s specific regulatory requirements by content type, geography, keyword, sector, organizations, and themes. Providing client-defined, customizable feeds in Thomson Reuters provides an automated way for clients to quickly eliminate volumes of regulatory content that is not relevant to their organization. The RSA Archer GRC Platform then allows customers to automatically import their Thomson Reuter data directly into the RSA Archer Regulatory Change Management solution. RSA Archer Regulatory Change Management allows you to consolidate information from multiple regulatory bodies, document the impact and sustain a repeatable auditable regulatory change program. The solution provides a centralized repository of regulatory data, clear reporting of activities related to regulatory issue remediation, and a consistent and repeatable regulatory change management process. As a critical component of your governance, risk and compliance program, RSA Archer Regulatory Change Management delivers the tools you need to analyze regulatory news, automatically notify responsible personnel, and proactively address issues before they impact your organization. Additionally, the RSA Archer GRC Platform produces real-time reports and user- specific dashboards to view regulatory news, type and impact to your organization, and to monitor the overall status of your regulatory change management program. Once the integration is installed successfully, the Thomson Reuters data is fed into the Regulatory Intelligence Items application and follows the current regulatory change review workflow in the Corporate Obligations Management use case. Partner Integration Overview GRC Solution Type Corporate Obligations Management Uses Out Of The Box Solution Yes (Regulatory Intelligence Items) Uses Custom Application No Requires On-Demand License No Important: This integration is not supported in Archer Hosted environments due to that fact that changes to the web.config file are required. -- 2 - Thomson Reuters Regulatory Intelligence Feeds Partner Product Configuration Before You Begin This section provides instructions for configuring Thomson Reuters with the RSA Archer GRC Platform. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to install the required components. All Thomson Reuters components must be installed and working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. Important: The integration described in this guide is being provided as a reference implementation for evaluation and testing purposes. It may or may not meet the needs and use cases for your organization. If additional customizations or enhancements are needed, it is recommended that customers contact RSA Professional Services for assistance. Thomson Reuters Configuration Thomson Reuters integrates with the RSA Archer framework via the Archer Data Feed service. TRRI feed content is a one XML schema delivered via sFTP to a client specified location. Therefore for this integration, the RSA Archer feeds are set to retrieve data files using the FTP protocol. Once a client has gained appropriate access to the Thomson Reuters Regulator Intelligence OnePass system, TRRI Feeds can be configured with an Advanced Search feature which is utilized to filter regulatory data that is relevant to your organization. Our current implementation with Thomas Reuters technically incorporates two schemas; Source XML and the Taxonomy file. -- 3 - Thomson Reuters Regulatory Intelligence Feeds In order to generate the desired Source XML and associated full Taxonomy file, perform the following steps: 1. Log into your account and select RI Feeds. 2. In order for RSA Archer Data Feed Manager to process these two XML schemas correctly, define two external delivery locations; one for the Taxonomy file and one for the Source XML. (Note: In order to establish a valid Root directory, a client configured sFTP site with two directories must first be defined.) 3. Create new feed(s) and select to add content from either Search or the Library. -- 4 - Thomson Reuters Regulatory Intelligence Feeds 4. Search configuration details 5. For the RSA Archer integration, we are leveraging the flattened.xml file inside the XSLT transform that is generated as part of the Thomson Reuters taxonomy outputs. For the taxonomy files select your Taxonomy delivery location. We recommend clients select to receive automatic updates as taxonomy files are updated. 6. Analyze process queue for delivery status -- 5 - Thomson Reuters Regulatory Intelligence Feeds RSA Archer GRC Configuration RSA Archer Prerequisites Important: This integration is not supported in Archer Hosted environments due to that fact that changes to the web.config file are required. As noted above, in order to configure the RSA Archer Platform, you must first download the following components from the RSA Archer Exchange: File Name Description Thomson_Reuters_Regulatory_Intelligence_ Contains updates to the Regulatory Intelligence Items Integration_Install.zip application which support the Thomson Reuters integration Data Feed retrieves the taxonomy file from the sFTP TR_Taxonomy.dfx5 location Data Feed retrieves and processes the Thomson Reuters TRRI_Feed.dfx5 regulatory change or Source XML data from the sFTP location Important: Version 6.2 P3 or higher of the RSA Archer Platform is required, as the application package will not import into prior versions of RSA Archer. Configuration Changes The taxonomy classifications in RSA Archer are represented as hierarchical values lists, and are an important attribute of the regulatory intelligence record. RSA Archer does not technically ingest the taxonomy file but rather utilizes the file as a lookup to perform the essential buildout of the full taxonomy structure from the Source XML file. Full hierarchy structure is required in order to correctly set the values list inside RSA Archer applications. In order to ensure the Source XML is always referencing the latest version of the taxonomy file, we reference the taxonomy file inside the XSLT rather than copying in potentially stale data. Configuration settings must be altered to accommodate the ability for XSLT to reference the taxonomy file located in the file repository. 1. Update all web config files with the following entry (do not replace existing entries): <appSettings> <add key="AllowXsltScript" value="true" /> </appSettings> 2. Update all job servers with the following entry in ArcherTech.JobFramework.Job.exe.config file: <appSettings> <add key="AllowXsltScript" value="true" /> </appSettings> -- 6 - Thomson Reuters Regulatory Intelligence Feeds Installing the Package After you have downloaded the integration files, you will need to import the package to update the Archer application. To do so, perform the following steps: 1. Login into RSA Archer. Go to Administration -> Application Builder -> Install Packages. 2. Click Import and select the location of the package file (Thomson_Reuters_Regulatory_Intelligence_Integration_Install.zip). 3. Click the Install button to install the package: *Mapping tool can be used prior to install to identify updates occurring, such as new sub- forms, an iView, new reports, new fields, new DDEs, and new layout objects. Importing the Data Feed Files Once the application install is complete, you will need to import and configure the TR_Taxonomy Data Feed. This feed retrieves the taxonomy file from the sFTP location and saves it to the data feed directory/alias in the file repository, unless a relative path has been defined in the ACP. File repository location is defined in the Archer Control Panel. To configure the feed, perform the following steps: 1. Select Manage Data Feeds from the Navigation Menu, by selecting Administration -> Integration -> Manage Data Feeds. -- 7 - Thomson Reuters Regulatory Intelligence Feeds 2. Click the Import link and browse to the data feed file you downloaded (TR_Taxonomy.dfx5). 3. Update the following settings on the General Information tab:  Set the status to active  Define the Target path where to place the file as it is retrieved off the sFTP site. 4. On the Transport tab update the following information:  Update the Fully-qualified URL with a valid sFTP server location  Enter a user name and password for the sFTP account  If applicable, update the Proxy and Post-Processing -- 8 - Thomson Reuters Regulatory Intelligence Feeds 5. Under Schedule tab, note the retrieval of a potential newly delivered taxonomy files from the sFTP server occurs once a day. 6. Save the Data Feed. Click the Run Detail link for additional information on the status of the feed or to troubleshoot any feed errors. Next, you will need to import and configure the TRRI_Feed. This feed retrieves and processes the regulatory change files (*.zip) from the sFTP server location. To configure the feed, perform the following steps: 1. Select Manage Data Feeds from the Navigation Menu, by selecting Administration -> Integration -> Manage Data Feeds. 2. Click the Import link and browse to the data feed file you downloaded (TRRI_Feed.dfx5). Update the following settings on the General Information tab:  Set the status to active  Define the data feed service user account -- 9 - Thomson Reuters Regulatory Intelligence Feeds 3. On the Transport tab update the following information:  Update the Fully-qualified URL with a valid sFTP server location  Enter a user name and password for the sFTP account  If applicable, update the Proxy  Update the Post-Processing destination file. This ensure files delivered to the sFTP from Thomson Reuters are not reprocessed on the next data feed run. 4. On the Navigation tab, admins must update the transform to point to their taxonomy share location. The XSLT processor cannot use either the data in the transport tab or a relative path defined in the ACP. The XSLT processor inherently writes to the same location as the stylesheet located on the system. -- 10 -