Migrate Legacy GRC to new Modules

[Matt Dumont1]

Has anyone done the migration from Legacy GRC to the new separate modules?   We're interested in doing so, but need to come up with an estimated LOE for our project plan.   We are aware of the migration tool, but there are several functions of Legacy GRC that are not supported by that tool, so we would like to get some insight into the true difficult from someone who has accomplished the task.   Thanks!

[dravvyramlochun]

Hello Matthew,

I did not do the migration but I can provide you some info with regards to the supported and unsupported migration:

Supported migration

After migrating from the Legacy GRC application, certain relationships between elements are maintained.

Relationships for the following elements are maintained.

Legacy GRC	Migrated GRC
Authority Documents [grc_authoritative_source]	Authority Documents [sn_compliance_authority_document]
Citations [grc_authoritative_src_content]	Citations [sn_compliance_citation]
Policies [grc_policy]	Policies [sn_compliance_policy]
Controls [grc_control]	Controls [sn_compliance_control] Policy Statement [sn_compliance_policy_statement]
Risk Definitions [sn_risk_definition]	Risk Statements [sn_risk_definition]
Risks [grc_risk]	Risks [sn_risk_risk]
Control Test Definitions [grc_control_test_definition] - manual type	Indicator Template [sn_grc_indicator_template] - manual type
Risk Criteria Thresholds [grc_risk_criteria_threshold]	Risk Criteria [sn_risk_criteria]

Unsupported migration

After migrating from the Legacy GRC application, not all functionality is automatically migrated.

Migration of the following elements or other custom functionality, while it is not supported, can be accomplished.

• Control Test Definitions [grc_control_test_definition] - auto type and attestation type
• Audit Instances [grc_audit]
• Audit Definitions [grc_audit_definitions]
• Control Tests [grc_control_test]
• Conditions [grc_condition]
• Requirements [grc_audit_requirements]
• Activities [grc_activity]
• Control Test Sample Data [grc_control_test_sample_data]
• Scope [grc_entity]
• Observations [grc_observations]
• Remediations [grc_remediation]

Reference:

https://docs.servicenow.com/bundle/helsinki-it-business-management/page/product/grc-enterprise/refer...

https://docs.servicenow.com/bundle/helsinki-it-business-management/page/product/grc-enterprise/refer...

[Matt Dumont1 · Accepted solution]

Mr. Ramlochun,

      Thank you for the input.   We did find that documentation.   As with many things in ServiceNow, implementation often takes longer in practice than in theory.   In case anyone was wondering, I have entered the answer from ServiceNow HI below:

It takes anything between 1-2 months for the entire migration process. This activity includes following steps: 1) Understanding differences between legacy and current GRC modules 2) Understanding and creating profiles and profile type structure 3) Identifying control and profile relationships 4) Migrating risks, policies, controls, authority documents, citations etc. using migration utility 5) Migrating Control test definitions to indicator templates for creating manual indicators using migration utility 6) Coming up with custom scripts for other migrations if they are not available as part of out of the box migration utility 7) Migrating all legacy custom fields into new GRC modules 😎 Once all the data is migrated, mapping all the right permissions/roles with all your custom roles and groups (if any) There might be other activities involved based on how the customer has set up the legacy system.

[Michael Bachme1]

We are in the same situation. Can you provide a list of what tables and fields that map to the new GRC?

[urmilla]

Hi Matt, This was helpful. 

Just had a query with regards to this upgrade:

Does installing of the new plugins facilitate this upgrade or what was the approach used, if you could provide some insights?

Thanks,

UD