Enterprise Architecture and GRC. Standards and regulations applicable to Business App

[AirSquire]

We are implementing EA and IRM applications and one of the key ask is the ability to assign / flag the Business Applications with the different risk standards / regulations applicable to it. Which helps the IRM team to filter the Business Apps to assign required controls to it and also provides reporting capability. I am thinking of having a M2M table between the Business App and the Authority document to minimize introduction of any custom attribute on the Business App table. Following the EA and IRM recommended Architecture, if there are any OOB ways to achieve this, kindly share your insights.

[yogesh41]

Hi,

ServiceNow Enterprise Architecture and Integrated Risk Management (IRM, part of the Governance, Risk, and Compliance suite) work together to give application owners a single end-to-end workflow to identify risks, establish controls, and attest to those controls across the enterprise application portfolio.

Extensive documentation is available at Integrate with Governance, Risk, and Compliance to identify application risks and controls • Xanadu ... 

We would like know more about your approach and problem statement. Let us know if you need any further details to achieve this integration.

Yogesh

[AirSquire]

Hi Yogesh, thanks for your response, the request is to tag/assign the Business Applications with different standards/regulations/laws like - ISO27001 or SOX., which assists them in scoping the entities and assigning the risk exposure and further helps in running different reports against the Business App and Risk-related Data.

I don't want to create any custom field on any table or any m2m table which risk creating tech debt

[Doron Orbach]

Hi, would the standard tags help here? you can add a tag for any of the standards for example: "ISO27001" tag?