Control Attestation vs Continuous Controls Monitoring

[KrithikaV]

Hi,

From the ServiceNow documentation, I see that control attestation is to just confirm that the control is in place.

However, it seems to me at times that  control attestations are made to  perform the same functionality of continuous controls monitoring.

Let us take an example: 
Control: Access Reviews are performed quarterly
Here, what would be the control attestation ?
1. Attest that there is a control (procedure) to perform access reviews every quarter or 
2. The  manager confirming that access review is complete for the specified quarter (as explained in the post: https://www.servicenow.com/community/grc-forum/how-attestation-and-indicators-are-different/m-p/3365...

Thanks,
Krithika

[Hemanth M1 · Accepted solution]

Hi @KrithikaV ,

These two are distinct but complementary approaches.

Control Assessment/Attestation : is a periodic survey/Assessment based process where control owners manually confirm that controls are implemented correctly - More of a Manual way

Continuous control Monitoring: Is an automated, ongoing process that uses indicators to continuously assess and validate control compliance through system data

Let's take your example:

Control: Access Reviews are performed quarterly.

1)As the control owner, every three months you will be assigned an assessment to confirm whether Access Reviews are in place or not. This is known as Control Attestation. (You can provide evidence here, but we can't fully rely on this alone.)

2)On the other side, an indicator will be set up to run every three months, which will check your AD or wherever your access logs are available to perform a review.

• If it passes, the control is compliant.
• If it fails, your control becomes non-compliant, resulting in an issue.
• You can also run this on-demand. (There are different ways to set up indicators: basic, manual or scripted.)

I tried to keep it simple here. Hope this helps, if so

[Hemanth M1]

We can talk all day long on this!

Simply put - Indicators are the second line of defense: make sure to monitor the status of control implementation!

@KrithikaV : Let us know what questions you have after reading all of this - Lets resolve your queries first.

[KrithikaV]

Hi @Hemanth M1 ,
If control attestation evaluates the control - checks if access review was performed, then when the control moves to the Monitor stage - what is it expected it monitor? 

Suppose, if one has not implemented continuous controls management, then they might not have set up indicator templates or indicators. In that case, what will happen in the 'Monitor' state?

Thanks in advance,
Krithika

[Matthias Ferstl]

I cite from training-material (GRC: IRM Implementation Participant Guide) which you also should use:

State attest: "Control Owners are assigned ... to attest that a control is implemented"

Also check this one (read about the whole lifecycle):
https://learning.servicenow.com/nowcreate?id=nc_asset&asset_id=771f64aa479a66d019dfe23c326d43e7&nc_s...

State monitor: "In monitor indicators monitor the controls status and evaluate an organizations compliance".