GRC Tutorials

[Thomas85]

We are planning to implement GRC Policy and compliance ,I am newbie to it ,can anyone help me with some good reading docs,I have gone through community and read some articles but I am looking something more advanced.

[Thomas85]

@Jan Spurlin ,can you provide some inputs.

Thank you.

[Tausif8]

There are some fantastic articles written by @Eric Feron , @Pranav Bhagat and many others in the GRC Forum.Also do check the community youtube channel where you can find tons of Policy and compliance videos.

[Jan Spurlin · Accepted solution]

There are several courses taught by instructors that provide the more indepth information about GRC. However, to get started there is a section in this forum (look at the boxes at the top) for New Customers. @Eric Feron has compiled a series of videos/articles that are intended to help new customers.

Here is a link to the GRC Fundamentals class

https://nowlearning.service-now.com/lxp?id=overview&sys_id=e08772c4db1a7340760a710439961958&type=cou...

We strongly recommend taking this before you take the implementation class. This is not about the basics of GRC, this is about how the ServiceNow application works for a customer trying to manage GRC.

https://nowlearning.service-now.com/lxp?id=overview&sys_id=c718b68cdb5eff40de3cdb85ca961922&type=cou...

This second link is to the Risk and Compliance Implementation course. We were discuss how to implement GRC and some common modifications/customizations we see.

Hope this helps.

Jan

[Richard Rivett]

I am making the assumption that you are starting from the very beginning (apologies if this is not correct). Is so then it is important to remember that the solution supports the framework.

Yes its processes and workflows help guide that framework, but ultimately before you start to implement you will need to determine and agree the objective is and what the end state looks like.

If you were using a partner typically the initial phase of the project will be workshops where core requirements are unearthed, validated and refined.

So my initial questions would be:

• Do you have your referential data confirmed i.e. Organisational Hierachies? 
• Are you looking to link Control Objectives to Policies? Do you know which Policies link to which Controls?
• Are those control objectives linked to external regulations? 
• Are your policies going to be managed within SN?
• What format are those policies currently?
• Are your Control Objectives linked to Risks either now or in the future?
• Have you considered what access rights Compliance users will require? OOTB? Bespoke?
• Have your compliance customers defined their reporting requirements?

Sorry for all the questions, but before embarking on the technical installation, the above is essential. In 8 years of delivering GRC Platforms, clients who have implemented first, before agreeing upon a framework have spent 100-150% more on remediation or worse still simply given up.