Configuration Compliance and Policies & Compliance Management

[KhalisRahman]

I know that control attestations and indicators will determine whether a control is Compliant. I have a question when it comes to Configuration Compliances being activated as well. How does the Test results from Configuration Compliance work with the Indicators. Let's say I have configured a Manual Indicator, is the test results going to override the indicator result?

[Anushree Randad · Accepted solution]

Hi @KhalisRahman ,

We have OOTB integration with configuration compliance with control objective. So when you map control objective to configuration tests, we generate entities and controls based on the entities/assets associated to test results such as windows servers, linux servers, laptops etc. In the background we generate indicators to run on these generated controls which will help with continuous monitoring of the controls based on the test results from the mapped config test. If the test results are 'passed', then control is marked as compliant, but if results are 'failed', then issue is generated and control is marked as non-compliant. When these test results pass next time, then issues are auto-closed and controls are marked as compliant. If you have additional manual indicator running on the same control, then the control status will change based on the result of manual indicator. But if config test results come after the manual indicator is run, then yes, the result will be overridden as long as there is no existing open issue.

Thanks,

Anushree

Product Manager, Risk BU, ServiceNow

[KhalisRahman]

Thanks Anushree Randad. 

" So when you map control objective to configuration tests, we generate entities and controls based on the entities/assets associated to test results such as windows servers, linux servers, laptops etc. In the background we generate indicators to run on these generated controls which will help with continuous monitoring of the controls based on the test results from the mapped config test."

May I know what are the scripts or business rules that drives the above process?