We are in the process of adding our frameworks, policies and regulatory documents. Then we will parse these into citations and into control objectives. Of course many of the control objectives are looking for the same conditions, for example say th...
Can I customize ServiceNow for my product needs?I plan to hire full stack devs for this issue following this guide. Will I succeed? Have anybody had such an experience?
In GRC: Advance Risk assessment module : how do trigger assessments ?
Hi,I was wondering if anyone knows what is the difference of creating a hierarchy of Policies (One parent policy with one or more child policies) and a hierarchy of Control Objectives (One parent Control Objective with one or more child Control Objec...
Hi I have a sample of 49 Audit Tasks, 2 are marked as closed complete. When should the approver receive a request to either approve or reject the engagement? Is it only after all tasks are closed and no pending open tasks.
Created 2 Entities with respective Controls(Control Objectives)Control Objectives were having Parent Child Relationship ( CO1 - Parent , CO2 - Child)Now CO2 is assessed and got Compliance status which in deed gets compliance Score on to Entity.I need...
Hi Experts, I would like to know if is there a standard build already available in UCF for GRC standard frameworks (the basic compliance frameworks that contain the authority documents, citations, and controls). Is there a possibility to obtain these...
Can someone explain the value of manual indicators in comparison to Attestations. They seem to do similar things. I will break this down into two areas to help my understanding. Situation: I have a control objective applied to 100 devices where I nee...
Most GRC issue(IPT's) are taking more than 20 seconds to open from the list view in both new tab, current tab. This issue began several months ago. They used to open very quickly. This is a major time waster and makes it very difficult to manage our ...
I am looking to input CIS Controls into service now as an Authority document, but would like to know your views on how you would pick out the Entity Types and group them with Control Objections. I would like to have the description specific to the en...
Hi, I have a very simple entity filter on the sys user table for a proof of concept I'm demoing. The filter conditions look for specific users in the organisation (this works and creates entities for each one). However, the owner isn't getting popula...
We are fairly new to GRC and are in the process of setting up our entity framework.However, due to a recent business re-org. we need to deactivate a specific entity type and replace it with 4 new entity types that will take on the existing risks and ...
Hello! Is there a way to adjust the risk scoring so the scoring reflects what the heatmap colors are? Red on a heatmap is usually a very high risk, but the heatmap puts a risk that has a high inherent or residual risk in the red zone just because it ...
Hi Community,I noticed a weird thing with Entity Scoping (perhaps it's just me or it's a SN nuance)...1. I created an Entity Class called 'SOX Infrastructure' 2. I created an Entity Type called 'SOX Applications' and in the 'Entity Filter', I build m...
We are planning to use GRC for IT and non-IT (i.e., environmental) risk and compliance. We are a single service provider with a dedicated instance, & no domain separation. Within GRC do we have the ability to restrict visibility to data that mimics...