Governance, Risk, and Compliance - Data segregation

[Brad Fleming]

We are planning to use GRC for IT and non-IT (i.e., environmental) risk and compliance.  We are a single service provider with a dedicated instance, & no domain separation.  Within GRC do we have the ability to restrict visibility to data that mimics domain separation?  For example, Users within ABC department/groups only see IT related risk and compliance dashboards/reports/data, and Users withing XYZ department/groups only see non-IT related risk and compliance data?

[SanjivMeher]

We had similar requirements. But OOB there is no solution. I am not sure if they have it in their future roadmap, but you should check with your sales rep.

You may need to make changes to ACL based on entity associated to the control to implement such kind of restriction.

[Brad Fleming]

Thank you for your insight, Sanjiv, much appreciated!

[Sebastien Fix]

@SanjivMeher  This is incorrect, this is OOTB using Confidentiality tags:
https://docs.servicenow.com/en-US/bundle/tokyo-governance-risk-compliance/page/product/grc-common/co...

You can also leverage another OOTB function for Functional domains:
https://docs.servicenow.com/bundle/tokyo-governance-risk-compliance/page/product/grc-workspace-compl...

[SanjivMeher]

@Sebastien Fix I think the confidentiality tags are more like marking a particular record as confidential. Not for different compliance team.

And Functional domains are to segregate data, but not to restrict users from seeing each others data.

But this fields may be used to build the functionality.