GRC Framework

abirakundu23
Giga Sage

3 hours ago

Hi All,

what all information need to know  in deeply for risk frameworks (ISO 31000, NIST, COSO) and compliance standards (SOX, GDPR, PCI-DSS, HIPAA) for GRC  Project ?

Please assist.

0 Helpfuls
  • 128 Views
1 REPLY 1

Maham Tahir
Mega Guru

2 hours ago

Hi @abirakundu23, 

 

Here are 5 brief points to help you prepare for your GRC project:

  1. Hierarchical Structure (Data Model Mapping):
    Understand how each standard is organized (e.g., NIST Families, ISO Clauses, GDPR Articles). You need to know how to break these down to map them correctly to Authority Documents and Citations in ServiceNow, ensuring the parent-child relationships remain intact.

  2. Risk Assessment Logic (RAM Configuration):
    For frameworks like ISO 31000 and COSO, you must deeply understand their scoring methodologies (Likelihood vs. Impact, ALE, Inherent vs. Residual). This is crucial for configuring Risk Assessment Methodologies (RAMs) and factor-based scoring to match the stakeholder's maturity level.

  3. Applicability & Scoping (Entity Classes):
    Know specifically what assets or processes each regulation targets (e.g., SOX = Financial Applications, HIPAA = PHI Data, PCI-DSS = Payment Gateways). This allows you to define the correct Entity Types and Entity Filters so controls are only generated for relevant items, avoiding "control spam."

  4. Commonality & Harmonization (Test Once, Comply Many):
    Understand where these frameworks overlap (e.g., Access Control is required by almost all of them). This knowledge helps you map multiple Citations to a single Control Objective, allowing the business to test one control to satisfy NIST, ISO, and SOX simultaneously.

  5. Evidence & Audit Cadence (Indicators):
    Know the required frequency and proof for each standard (e.g., SOX often requires quarterly evidence; GDPR requires 72-hour breach notification logs). This dictates how you configure Indicator schedules and Attestation templates to ensure the system collects evidence before the external auditor asks for it.

Lemme know if you have any question in any of these!

 

If you find my response helpful, mark it as helpful and accepted solution.

 

Regards, 

Maham Tahir.

0 Helpfuls