Hi All, I was wondering how to get the out of the box 'Notify attestation recipient' notification to send out an html email to a concerned user when a control is set to the 'attest' state. Currently I'm only able to get the email sent out if I choose...
Good Morning All, I have a requirement to configure Approval workflow on grc policies [grc_policy] For this, I have designed a workflow and used the approval_user activity. Also, added the Approval related list into the [grc_policy]. But when I exe...
Hi, I want to allow roll up of risks associated with specific locations to the company level here is what I have done: 1. create a new entity class called location 2. created a new entity class rule conecting cmn_locations to the location class 3. ...
Hi All, What is the use of "GRC Profile Generation" scheduled job. use case: Create profile based on Entity filter, other use case I don't know. this schedule job OOTB and run every a hour . Reduce this scheduled job in time if there is any effec...
Hello, Can anyone please explain in detail each and every state of the Issue life-cycle? I am really struggling to find a piece of documentation that would thoroughly walk-through every issue state ( New, Analyze, Response etc.. ) in order to descri...
Hi When creating/modifying a a control there is an option to tick a "key control" box indicating that the control is vitality important. However, when this box is ticked there is no obvious effect on compliance, risk scores, or anything else. Can any...
I created a new update set in DEV environment and unloaded all the dashboard data in that update set . When I exported that update set and imported the same update set in another instance the update set was retreived successfully but there were no cu...
Is there any relation between vendor tiering assessment and vendor risk assessment. Kindly clarirify
Hi, We are migrating from RSA Archer GRC to ServiceNow GRC and I have questions: 1. RSA Archer has a mail-merge capability, how can we create a mail-merge like formatted/structured reports in SNOW? We have been migrating from Archer to SNOW an...
Hi All, I'm trying to properly understand how everything is working with regards to entity relationships. I'm trying many different scenarios and I cannot understand the logic. reading through the documentation and going through the videos on entit...
As required by our 27001 Information Security Management System (ISMS) accreditation, I am trying to create an Information Security Awareness quiz to test staff knowledge of our ISMS system. I am using the quiz functionality of assessments. I would...
Hi, We have discovered that due to an scheduled task some controls which were already attested this year were triggered by a nightly scheduled job to put the controls in attestation, We now want to cancel those attestations but also put them in monit...
Hi, I'm working on entity scoping and came across an issue. I would like to have an entity class for vendors and for Companies. but vendors are actually records within the company table as well. so I can't create a rule to map the company table to ...
Does anyone know the purpose of the GRC.System user account that is brought in when activating the GRC plugins? I have a client who flagged this due to it containing the platform admin role (not just the scoped GRC admin role). I can't find details a...
I have a policy with an associated control objective, control, indicator template and indicator. The indicator shows passing as the last result. What changes the status of the control itself? It shows non-compliant? Is that tied to the attestatio...
