GRC: Profiles, Profile Types, Profile Classes

[kristenankeny]

In preparation for my next project, I'm reading through the GRC documentation and I'm a little confused. This is what I understand it is saying:

Profile type has a single reference to a profile class

Any record in ServiceNow can have a profile generated

When you define a profile type, the profiles are automatically generated

A profile can only have a single profile class, but it can have many profile types

So, if profile can have multiple types, and each type can have a class, then how does the profile only have a single class? Say I create two profile types: Business Services and Critical Business Services. Both point at the business services table. The former has the condition that the service is not retired. The latter has the condition that the service is not retired and its business criticality is high. My expectation is that a single profile is generated, linked with both profiles types. But what if profile type "Business Services" is in Profile Class A and profile type "Critical Business Services" is in Profile Class B? What determines the Profile Class for a highly critical business service - is it just the type the triggered the initial creation of the profile? Also, when auto generating profiles, is servicenow first checking to see if a profile already exists for a record and if so, just creating the link between the new profile type and the existing profile? Or did I misunderstand the documentation?

[linnbuchanan · Accepted solution]

I can answer some of your questions, but not all. Take this as you will (I'm a Business Analyst just learning GRC in Jakarta and struggling with Profiles!)  

Your understanding of the documentation is correct as far as I can tell.

How does the profile only have a single class?

But what if profile type "Business Services" is in Profile Class A and profile type "Critical Business Services" is in Profile Class B? What determines the Profile Class for a highly critical business service - is it just the type the triggered the initial creation of the profile? Think of Class as the top level hierachy that YOU define. You can only have a single root class, but you can have many classes. I've started creating a series of classes based on facility locations and business functions. But this is defined by you, it is not auto assigned, you do that when you create the profile type. You choose which class profile type Business Services is assigned to and what class (they could be the same) that profile type "Critical Business Services" is assigned to.    

Also, when auto generating profiles, is servicenow first checking to see if a profile already exists for a record and if so, just creating the link between the new profile type and the existing profile? YES THIS IS CORRECT.

Or did I misunderstand the documentation? You understood correctly.

[sajal]

The profile class has no direct relation with profile type , it only has relation with profiles and other profile classes.

Whereas, Profile types has a direct relation with profiles. ..

In Definition also, it is stated that Profile class allows GRC manger to differentiate different types of profile whereas, profile type contain 1 or more profile...

So to best of my understanding, I believe you are contemplating it wrongly.

Please suggest !!!

Regards,

Sajal Gupta

7838850004

[Didem Ochsner]

Hi,

It's a bit too late as an answer for Kristan but for all others who seek some support, my answer could help.

Profile Types are not directly related to Profile Classes. It is  not a hierarchy. It's a category relationship.

Profile Types allow you to create a filter that generates Profile Records based on that filter. But you can also create Profile records manually and assign them to Profile Types. Then individual Profile records can be grouped into a Profile Class.

Profile Types and Profiles are typically defined based on who needs to manage a risk or a control.  Profile Owner becomes Control / Risk Owner. That could be different from the way you want to report out on these risks. That's where Profile Classes come into play.

Profile Types are needed to generate registered risks and controls and therefore should be defined early in the process. Profile Classes are not required and can be defined later in the implementation process.

Best,

Didem