How to ensure confidentiality in IRM/GRC module?

[SN_Jeanette]

Hi all,

We've started using the audit module, and would like to get some tips regarding how we best can set up servicenow with the aim to keep information contained and confidential according to our organizational structure. Please reach out if you've rigged this in a smart and efficient way.

/ Jeanette

[SN_Jeanette]

@Markus1 and @Hayo Lubbers - As I understand confidentiality tagging in a way is for hiding away info, but hierarchy is for containing info within a organizational structure - right?

[Hayo Lubbers]

Hi @SN_Jeanette ,

Correct, that is also my interpretation of the functionality.

[Amit Gujarathi]

HI @SN_Jeanette ,
I trust you are doing fine.

1. Role-Based Access Control (RBAC): Utilize RBAC in ServiceNow to define and assign roles to users based on their organizational responsibilities and access requirements. This helps ensure that users only have access to the information they need to perform their tasks.

2. Access Controls: Implement access controls at the table and field level to restrict access to sensitive information. Use ACLs (Access Control Lists) to define who can read, write, or modify specific records and fields. This ensures that only authorized individuals can access and modify sensitive data.

3. Data Classification: Classify your data based on sensitivity levels and confidentiality requirements. ServiceNow provides the ability to apply data classifications to records and fields, allowing you to enforce stricter access controls on highly sensitive information.

4. Incident Management: Set up an incident management process in ServiceNow to track and manage security incidents. This helps in identifying and addressing any potential breaches or unauthorized access to confidential information.

5. Encryption: Utilize encryption features provided by ServiceNow to protect sensitive data at rest and in transit. Enable encryption for communication channels and configure encryption settings for data storage to enhance data security.

6. Audit Trails: Leverage the audit module in ServiceNow to track and monitor activities related to sensitive data. Enable auditing on critical tables and fields to capture changes and access attempts. Regularly review audit logs to identify any suspicious activities.

[SN_Jeanette]

Thank you @Amit Gujarathi 🙂 This for sure is helpfull information!

[Amit Gujarathi]

Thanks for your kind words. IF so please mark the answer correct so that it will guide the other developers also