By default, ServiceNow documentation states that reliant entities on a common control inherit results so far so good but it does not explicitly clarify what happens when reliant entities are added after a control been attested (e.g., in Review/Monitor state).
I tested on my end and I can confirm that:
-
You can add reliant entities while the common control is in Monitor state (post-attestation). It works.
-
The scheduled job “Compliance Score V2” is responsible for recalculating and propagating compliance scores.
-
After running this job, the newly added reliant entities will receive the updated compliance score from the common control. The job runs every 2 minutes, or you can wait 2 minutes or you can click "execute" button to force the update.
When to add reliant entities to a common control
-
From a technical perspective, there’s no official documentation which "stage" is the correct one for adding reliant entities to a common control. Associating a reliant entity is simply a way of telling the system that this entity depends on this control.
-
Best practice: Add reliant entities during the design phase (Draft), before attestation starts. What is an attestation? An attestation also known as a test or assessment, is used to demonstrate whether the control has been implemented correctly. From a design point of view, it just makes sense!
-
If reliant entities are added later (e.g., in Monitor/Review), they will still receive the compliance score once the ‘Compliance Score V2’ job runs.
Take a look at: Impact of common control on compliance score calculation
By default, ServiceNow documentation states that reliant entities on a common control inherit results so far so good but it does not explicitly clarify what happens when reliant entities are added after a control been attested (e.g., in Review/Monitor state).
I tested on my end and I can confirm that:
-
You can add reliant entities while the common control is in Monitor state (post-attestation). It works.
-
The scheduled job “Compliance Score V2” is responsible for recalculating and propagating compliance scores.
-
After running this job, the newly added reliant entities will receive the updated compliance score from the common control. The job runs every 2 minutes, or you can wait 2 minutes or you can click "execute" button to force the update.
When to add reliant entities to a common control
-
From a technical perspective, there’s no official documentation which "stage" is the correct one for adding reliant entities to a common control. Associating a reliant entity is simply a way of telling the system that this entity depends on this control.
-
Best practice: Add reliant entities during the design phase (Draft), before attestation starts. What is an attestation? An attestation also known as a test or assessment, is used to demonstrate whether the control has been implemented correctly. From a design point of view, it just makes sense!
-
If reliant entities are added later (e.g., in Monitor/Review), they will still receive the compliance score once the ‘Compliance Score V2’ job runs.
Take a look at: Impact of common control on compliance score calculation
