Transforming Business Continuity from Riskonnect (formerly Castellan) to ServiceNow

[Adam_on_Now]

If you're considering a transformation from Riskonnect to ServiceNow, you should be aware of a few key challenges and perils during the transformation.

First off, the IRM product was previously under the "Castellan" Company, but was acquired in July 2022, so you might see this product name a bit differently than "Riskonnect" based on your adoption of the product. 

There were several key challenges with migrating from Riskonnect to ServiceNow BCM:

1. Data Models are very different and need to be mapped/understood. For example, "Activities" in Riskonnect should map to Business Processes in your ServiceNow Instance. Make sure you have your business processes fully built out and they are defined in a way that make sense to the BC team that will be using them. Just because there is data in this table doesn't mean it's accurate!
2. Getting data OUT of Riskonnect. While there are some admin functions to export data out of Riskonnect through the Admin panel, however since the data models are very different, there will need to be some extensive Import set and transform map work done to get the data aligned in the ServiceNow Data model. The "unique keys" of Riskonnect are essentially non-existent, so we had to often use the "Name" field of the activity, BIA, or BCP that was in place which was problematic when looking for exact matches across spreadsheets, import sets, tables. 
3. Some data had to be extracted using the Riskonnect API as there weren't always options to export it through the Admin tools within Riskonnect. You'll need to leverage your Riskonnect admin to use this API to get some of the more transactional data out if you're looking to preserve it as part of the migration.
4. In my experience, the organization was used to performing BIAs and BCP's at the department level. Having a department-focused BIA is not how ServiceNow is built, and therefore there was a big adjustment to moving towards process-focused BIA's. This did require more "Approval" work to be done for the BIA, as they were used to conducting approvals at the BCP level, and not individually at the BIA. This overall is a GOOD transformation, as it provides more review therefore accuracy of the BIA up to the BCP, but it was an initial painpoint for the organization to adjust to.
5. Documentation Sections are your friend! These templated or "free form" sections of BCP can help capture things that don't have a direct mapping from Riskonnect to ServiceNow BCM.
6. Team Contacts - There is no exact equivalent to how the "Contacts" section of Riskonnect is displayed. ServiceNow BCM really relies on Everbridge to manage the Contacts and communications to those contacts during exercises and events. If you're not using Everbridge, you may want to reconsider or think about how contact information will be displayed within a plan.
7. As with any BCM implementation, plan for a decent amount of time/effort to update your PDF generation look/feel/content for the BIA and BCP PDFs. This is likely how you will communicate plan details with your auditors, so make sure you review this output thoroughly during your transformation.

Overall, a project like this *can* be done, but if you're looking to preserve the data as migrated from Riskonnect to ServiceNow, you will need to re-think your focus for BIA's and expect some involved excel/transform work to be necessary as part of the migration!