- Post History
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
on 10-22-2020 04:37 PM
I was just going through Idea portal, and its difficult to see everything in one place. Please find a current list of open ideas. Things which are planned not included. Sorry if I missed any...
Not sure if this article should be maintained or new one posted regularly (Top 5/10?). If you have raised a new idea on the Idea Portal, please comment with the link and brief description.
GRC Ideas
Review the idea and comment/vote
Capability to perform a target risk assessment
Exception Approval and Verification Rules Dependent on Fields
The current Exception Approval Rules has conditions to permit some approvals based on control objective, risk rating, etc. They are statically defined. However, there are instances where one or more approvals are dependent on the referential data, such as the requester's department, the requester's manager, etc. Those cannot be defined from the approval rules today. Adding the ability to define an approval based on a name in a certain field on the view/form will allow more customization and easier self-administration. This concept should also apply to 'Verification Rules' too.
Extend existing Dependency Views (app.ngbsm) to be able to generate a dependency between:
- risks, issue and remediation tasks.
- authority document, control objectives, policies, controls, etc.
At this moment, Next Generation Business Service Management Map is restricted to cmdb_ci field and therefore we cant customize to provide any relationship within the GRC world.
Active flag on sn_grc_choice table
This table is used across various areas of GRC , and it would be great to be able to deactivate options - rather than having to delete.
This would require a new true/false field: active , as per standard table structure (e.g. task)
And update to all standard reference qualifiers e.g. type, classification, category on sn_grc_content etc
VRM: Support for Multiple Vendor Engagement assessment
Key Capabilities Required: 1. Ability to structure vendors based on services or products they provide, engagements you have with them or different sites 2. Ability to have separate primary and secondary vendor contacts per engagements/services and flexibility to share these vendor contacts across various engagements/services 3. Ability to perform tiering assessments and come up with a risk tier per engagements/services/sites 4. Ability to perform risk assessments and come up with a risk rating per engagements/services/sites based on risk area 5. Ability to manage issues for each engagements/services/sites 6. Ability to review and approve/electronic sign-off engagements/services/sites 7. Ability to rollup risk tiers, risk ratings and issues at vendor level 8. Ability to report on risk tier, risk ratings across various vendors engagements/services and slice and dice based on risk areas Business Rationale: Customers need to review their Vendors in the context of the Services being provided or engagements they have. Different Services will lead to differing levels of questionnaire and/or additional checks or document requests. When a Vendor provides the same (or different) services from multiple sites within their organization there can be a requirement to assess each location as a standalone assessment and decide to Pass some while Failing others. Therefore, customers would want to monitor risk tiers or risk ratings at different services or engagements level rather than at vendor vendor.
Enhanced Security in GRC to ensure only authorized users are able to access the data
Key Capabilities Required: 1. Ensure only authorized users are able to access the data 2. Even users like GRC Admin/System admin should not be able to access the data Business Rationale: For most customers, GRC data is highly confidential. Some of the risks and audit information is sensitive and only restricted users should be able to the access the data. However, currently admins can impersonate to be other users and can access confidential information even though they should not be. This is a huge issue which needs to be fixed. Applications like HR and SIR already supports this capability and we should improve data security in GRC as well
Delegate Attestations and Risk Assessments
There are a lot of customers who want the ability to 'delegate' an attestation or risk assessment, if the assigned to person is not available OR in fact, if the control/risk owner wants to delegate the task but still remain the owner.
It is possible to change the user but this can cause a loss of traceability. Other approaches may result in unintended consequences by customising baseline settings.
Prevent/Fix Empty Numbers in GRC
Since GRC Scoped Apps were released in Helsinki, this bug has been present and still exists today.
I have created an article to explain, but please resolve in the core release:
Whenever we want to create controls that are linked to the control objective but have different details like separate names, descriptions for control, that is not possible.
The details are always copied over from Control Objective to Control. This should be the case whenever Controls are populated automatically. But if we would like to create controls with different from the details in Control objective it doesn't allow us to do so.
AS A Compliance Manager GIVEN THAT our GRC Profiles have been arranged in a M2M relationship representing Risk and Compliance inheritance AND I am looking at a dashboard, like Compliance Overview - PA Premium I WANT to be able to select a Profile and have reports display results for all profiles Downstream of the selected profile SO THAT I can view the real compliance impact on higher parts of the organization without customizing tables and reports. --- As an organization, we have 3 subsidiary companies each of which implements operational controls, based in part on guidance from the group level. The compliance of the overall group depends on the compliance of each subsidiary company. This same pattern repeats at lower levels of granularity, like Departments and Vendors. Currently, the Compliance Overivew - PA Premium dashboard allows for reports to be filtered by Profile and Control State using Interactive Filters. However, we are only able to select individual profiles, and not a whole hierarchy of profiles based on the Upstream/Downstream relationships we defined. When I look at a profile, I can see in related lists the Upstream and Downstream profiles. I want to be able to use this relationship in an interactive filter, to easily select a profile and filter to all downstream profiles.
The default short description when an issue is created through an attestation is currently '[name profile] has an assessment failure'.
This short description is not liked by stakeholders as it comes across as too negative. Therefore they would like to change it.
Changing the default description is currently only possible by changing the OOTB scripts or by creating additional business rules.
Can you make the default issue short description configurable?
As a vendor I would like to enhance compliance transparency and give my customers real time insight in my compliance status via a customer portal. E.g. Compliance test results re Identity Access Management are visible via a customer portal. The customer should see that the controls are compliant or not, what was tested and the results (for external reporting purposes).
Now we have to report the results via email and memo's.
If issues are reported, the customer should havehave real time insight in the follow up status and updates. This will optimize my reporting process to customers re updates on audits and enhance transparency. No memo's and limited emails and track and trace via GRC.
Tag users in comments on the Portal
We've a feature on the native view on journal fields like worknotes/comments to tag users using '@'.
This feature isn't working on our portal for the same record.
It would be really good for an application which requires constant communication on a record.
It is very unfortunate that we have this feature on the native view and not the portal
Indicators should have the option to specify Primary Key Field
Within GRC Indicators, if you were to execute on task_ci or any database view (Use cases could follow)
The limitation within the current code assumes that the field is going to be sys_id, but it could be PREFIX_sys_id if it were a database view... so the two lines in basic and indicator strategy would always fail...
count.addQuery(this.indicatorRecord.getValue("reference_field"), profile.applies_to);
gr.addQuery(this.indicatorRecord.getValue("reference_field"), this.indicatorRecord.item.profile.applies_to);
- 1,270 Views
Eric Feron
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Thank you Phil, this is super helpful.
E
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Phil - this is great. We appreciate you organizing this information.
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hey guys, no problem - I think the Idea Portal needs to be able to link to categories and be easier to organise tbh.
Until then, what do you think.... a regular round up of Top Voted Ideas?? (I cannot do this post again , it took way too long!! But once I started I had to finish... )
Eric Feron
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
I agree with your thought and I can say that it will not happen 🙂 sorry .
A regular round up of the top ones would be great!
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hey Phil,
I posted this one yesterday: it concerns the fake "0" Compliance Score whenever a control objective is not tested, or an AD has no controls and so on.
https://community.servicenow.com/community?id=view_idea&sysparm_idea_id=364dcccf1b08a0106531ea89bd4bcbb9&sysparm_idea_table=x_snc_com_ideation_idea&sysparm_module_id=enhancement_requests
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hey Sebastien! When you look at this control objective, from the form it might not be obvious, but from a reporting perspective - there is a field called 'Has downstream controls', when this is TRUE... then the '0' is valid, but when it is FALSE you should ignore zero... this is great to be aware of for aggregating on reports...
Will this help? Because I understand 0 could skew the numbers, but be sure to account for 'has downstream controls', this will handle when the controls have got a status (compliant or not compliant... N/A is ignored...)
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
Hi Phil, I have described that workaround in the Idea I posted - but at this stage in SN development, workarounds should be minimized/addressed:-)
- Mark as Read
- Mark as New
- Bookmark
- Permalink
- Report Inappropriate Content
I posted a requirement for Advanced Risk Assessment. It is about the grouping of notifications and the approval / sign-off and available at that link:
https://community.servicenow.com/community?id=view_idea&sysparm_idea_id=cf2d8606dbe4e410f21f5583ca961932&sysparm_idea_table=x_snc_com_ideation_idea&sysparm_module_id=enhancement_requests
