Query on GRC Control

[Sachin G K1]

Hi All,

I have seen that there is field called Exempt in control form(to ignore implementation of control), and there is another field called Enforcement(which has to two values mandatory and voluntary).

What happens if select Exempt as True and Enforcement as Mandatory. Will the control gets implemented. Does Exempt overrides Enforcement field?

And, as i am new to ServiceNow GRC, please let me known difference between grc,irm and secoops. Does IRM comes under GRC?

Thanks in Advance

[msd93 · Accepted solution]

Hi @Sachin G K1 

When you set "Exempt" to "True," it indicates that the control does not apply to the specified entity, and they are exempt from complying with it.

When "Enforcement" is set to "Mandatory," it means that the control or requirement must be enforced, and there are no exceptions.

The "Exempt" field and the "Enforcement" field can work together, but "Exempt" typically overrides "Enforcement." Thus if you set "Exempt" to "True" for a specific entity or record, it indicates that the control or requirement does not apply to them, regardless of the "Enforcement(mandatory/voluntary)" setting.

1. GRC (Governance, Risk, and Compliance):

   • Purpose: GRC is a comprehensive platform that helps organizations manage governance, risk, and compliance-related activities. It enables businesses to identify, assess, monitor, and mitigate risks while ensuring compliance with regulations and standards.
   • Key Features: GRC in ServiceNow includes features like policy and compliance management, risk management, audit management, and issue management. It provides a holistic view of an organization's risk and compliance posture.

2. IRM (Integrated Risk Management):

   • Purpose: IRM is a subset of GRC that specifically focuses on integrated risk management. It helps organizations identify, assess, and mitigate risks across various business processes and functions. IRM can include financial risk, operational risk, IT risk, and more.
   • Key Features: IRM in ServiceNow may include risk assessment, risk quantification, risk scoring, risk treatment planning, and reporting. It provides tools for managing risk across the enterprise.

3. SecOps (Security Operations):

   • Purpose: SecOps focuses on managing and responding to security incidents and threats. It aligns security operations with IT operations to improve security incident detection, response, and resolution.
   • Key Features: SecOps in ServiceNow includes features such as security incident management, threat intelligence, vulnerability response, and automated workflows for incident response. It helps organizations strengthen their security posture.

IRM is often considered a subset or component of GRC. While GRC encompasses a broader range of governance, risk, and compliance activities, IRM specifically addresses the risk management aspect in greater detail. Essentially, IRM is a specialized focus area within the broader GRC framework.

Hope this info helps you.

[Sachin G K1]

@msd93 Great, Thanks!!