Category and Type fields for Policy Statements

[vijo1]

for Policy Statements.  - what is the scope or definition of Category and Type  fields.  In other words, how best can one define values for these fields

[Jai21]

Hi Vijo, 

Below is the table:

Category	List of options: Acquisition or sale of facilities, technology, and services Audits and risk management Compliance and Governance Manual of Style Human Resources management Leadership and high level objectives Monitoring and measurement Operational management Physical and environmental protection Privacy protection for information and data Records management System hardening through configuration management Systems continuity Systems design, build, and implementation Technical security Third Party and supply chain oversight Root Deprecated
Classification	List of options: Preventive Corrective Detective
Type	List of options: Acquisition/Sale of Assets or Services Actionable Reports or Measurements Audits and Risk Management Behavior Business Processes Communicate Configuration Data and Information Management Duplicate Establish Roles Establish/Maintain Documentation Human Resources Management Investigate IT Impact Zone Log Management Maintenance Monitor and Evaluate Occurrences Physical and Environmental Protection Process or Activity Records Management Systems Continuity Systems Design, Build, and Implementation Technical Security Testing Training

for full information, 

https://docs.servicenow.com/bundle/kingston-governance-risk-compliance/page/product/grc-policy-and-compliance/reference/r_PoliciesAndProcedures.html#ariaid-title7

Best

[vijo1]

Thanks, Jai

[Shiva Thomas · Accepted solution]

Hi Vijo,

When I passed my CISSP certification (Certified Information Systems Security Professional), I had to learn those by heart for the exam! 😅

Policy Statements are templates used to automate the creation of Controls. So the following apply to both Policy Statements and Controls.

They are classifications for Controls, based on pseudo-standardised vendor-neutral definitions. Auditors and CISO will inquire about your "Preventative Controls" or browse a list of your "Administrative Controls".
Regulation like PCI-DSS (for credit card industry) or ISO-27001 will require you to classify your controls, and those out-of-the-box field are very useful for that.

In the out-of-the-box GRC solution they are not used for any automation, but can still be useful for the business, as non-functional classifications, or as trigger for specific workflows. In theory, those field use a nifty column type of GRC Choice that can allows your Risk and Compliance admins to edit the available values without the need of a ServiceNow admin!
Of course, if those fields are not required for your usage, feel free to remove them from the user-interface.

Here are a few definitions found when googling for "control types and categories CISSP" images:

∴
Best regards from Switzerland
Shiva :¬,

If this reply assisted you, please consider marking it 👍Helpful or ✅Correct.
This enables other customers to learn from your thread.