How to ensure confidentiality in IRM/GRC module?

[SN_Jeanette]

Hi all,

We've started using the audit module, and would like to get some tips regarding how we best can set up servicenow with the aim to keep information contained and confidential according to our organizational structure. Please reach out if you've rigged this in a smart and efficient way.

/ Jeanette

[Hayo Lubbers]

Hi @SN_Jeanette ,

I've implemented a custom ACL / before business rule structure, before the GRC User Hierarchy was available, based on the assignment to an entity. I cannot recommend a custom approach within the GRC modules.

I think you might benefit from the GRC User Hierarchy (https://docs.servicenow.com/bundle/utah-governance-risk-compliance/page/product/grc-common/concept/u...). It should give you quite some flexibility.

Good luck!

[SN_Jeanette]

Thank you @Hayo Lubbers , that's valuable input! I'll look into that!

[Markus1]

Hello @SN_Jeanette 

I just want to add to what @Hayo Lubbers wrote, the user hierarchy is worth checking out.
I would also recommend to check out the confidentiality tagging:
https://docs.servicenow.com/en-US/bundle/utah-governance-risk-compliance/page/product/grc-common/con...

[SN_Jeanette]

Markus, thank's 🙂