We've updated the ServiceNow Community Code of Conduct, adding guidelines around AI usage, professionalism, and content violations. Read more

Best Practices for Implementing Policy and Compliance for New Organizations

Go to solution
HarshC303096983
Tera Contributor

3 weeks ago

What is the recommended approach to setting up Policy and Compliance for an organization that is completely new to the module?

 

How should we get started with the initial configuration, and what foundational setup steps are critical?

 

Which linkages and relationships (for example, between policies, controls, risks, and profiles) are most important to establish early to ensure a scalable and effective implementation?

0 Helpfuls
  • 838 Views
3 ACCEPTED SOLUTIONS

Go to solution
Aditya_hublikar
Mega Sage
In response to Aditya_hublikar

3 weeks ago

Hello @HarshC303096983 ,

 

I hope you are doing well . Does my response helps you ?

 

If my response helps you then mark it as helpful and accept as solution. It will helps other community future queries.

Regards,

Aditya

View solution in original post

0 Helpfuls

Go to solution
Matthias Ferstl
Mega Guru
In response to VaishnaviK3009

3 weeks ago

This is either an AI answer or you should revisit documentation / snow-university

Please mark answers (not only mine) as helpful if they were
and "accepted solutions"This motivates others to take part, post solutions and find answers. Thanks! - Mat

View solution in original post

0 Helpfuls
4 REPLIES 4

Go to solution
Aditya_hublikar
Mega Sage
In response to Aditya_hublikar

3 weeks ago

Hello @HarshC303096983 ,

 

I hope you are doing well . Does my response helps you ?

 

If my response helps you then mark it as helpful and accept as solution. It will helps other community future queries.

Regards,

Aditya

0 Helpfuls

Go to solution
VaishnaviK3009
Tera Guru

3 weeks ago

Hi @HarshC303096983 !!

 

Recommended approach for a new Policy and Compliance implementation

1. Define scope and objectives

  • Identify initial regulations/frameworks in scope

  • Decide which business units or entities to include first

  • Start small and expand later

2. Set up Entity and Profile structure (critical foundation)

  • Create entity types (enterprise, subsidiary, business unit, etc.)

  • Create organizational, business unit, and IT/application profiles

  • Profiles determine policy applicability and compliance reporting

3. Configure Policy Management

  • Define policy types and categories

  • Set up policy lifecycle states and ownership

  • Create clear policy statements that define intent, not controls

4. Define Controls early

  • Create control objectives and controls (manual/automated)

  • Map policy statements to controls

  • Associate controls to applicable profiles

5. Create Authority Documents

  • Load regulations, laws, and standards as authority documents

  • Map authority documents to controls (not directly to policies)

6. Align Risks at a high level

  • Define a basic risk taxonomy

  • Create high-level risks

  • Map controls to risks

7. Enable assessments later

  • Configure control assessments and policy attestations

  • Enable reporting once data and ownership are stable

Key relationships to establish early

  • Profiles → Policies

  • Policies → Policy Statements

  • Policy Statements → Controls

  • Controls → Profiles

  • Controls → Risks

  • Controls → Authority Documents

 

Mark this as Helpful if it clarifies the issue.
Accept the solution if this answers your question.

Regards,
Vaishnavi
Associate Technical Consultant

0 Helpfuls

Go to solution
Matthias Ferstl
Mega Guru
In response to VaishnaviK3009

3 weeks ago

This is either an AI answer or you should revisit documentation / snow-university

Please mark answers (not only mine) as helpful if they were
and "accepted solutions"This motivates others to take part, post solutions and find answers. Thanks! - Mat
0 Helpfuls