Controls Objectives to Entity Types

[JahanzebB]

After we have defined an Entity Type filter, we need some guidance on Entity Scoping> Adding related Controls Objectives. 

Here is what I understand:

1. When a Policy is added to an Entity Type, all of the Controls Objectives from the Policy are added to the Entity Type> Controls Objectives. Let's call this the Data Center Entity type. 

a) I have a policy for Data Center Security and can add this policy to this Entity Type. This will give us all of the Entity Type> Controls Objectives for Data Centers. 

The issue that I run into: 

1. Let's say I have a Controls Objective that is associated with 3 different Policies.

a) Does this follow best practice within ServiceNow : One Controls Objective repeated across different Company Policies?

b) What is the best way to decide which Policy to add to this Entity Type? Should we just manually add all of the Controls Objectives? 

Thanks,

Jahanzeb

[Dexter Parre_o]

Hi,

A) You mean the maximum number of Control Objectives (not Controls) that can be mapped to Entity Types? I would suppose that you can add as many as you want and the limit should be equivalent to the max number of records a table can hold (since the mapping is stored in a m2m table).

B) I would suggest you retire a control/risk instead of removing them. However, if all the controls/risk you want to retire all belong to a specific entity, better to revise the entity type filter so that it wouldn't capture the unnecessary entities that would create the unnecessary controls/risks. I believe there are no issues removing them but as I've said, better to correct your entity type filter...i think this is the root cause of your issue.

Regards,

Dexter