question Re: Automated Scripted Factor for Non-Compliant Controls in GRC forum

Automated Scripted Factor for Non-Compliant Controls

Trey7 — Tue, 24 Sep 2024 01:55:13 GMT

I have created a group factor to assess individual controls on a risk assessment. The group factor contains a manual factor (manual selection of control effectiveness) and an automated scripted factor (to check if the associated control is non-compliant). The score is then averaged to output the control effectiveness score.

It is my understanding that the control sys_id should be predefined in the script's control variable (see attached screenshot), however the variable is null. Any idea how I can retrieve the associated control sys_ID so that the script can check the sn_compliance_control table for the control status? Or is there a better way I should be handling this?

Draft script so far (not working):

/*************************************************************************************/

/* 1. Use the predefined variables from the Variables field.

/* 2. You can define your own script variables within the script itself. For example, var x = 1;

/* 3. Factor response must be set to variable result.score;

/*************************************************************************************/

try {

/***Start of Custom Code. Please write your scoring formula below. */

var controlScore = 3; //Default score to 3 for 'Effective' control status

var controlGR = new GlideRecord('sn_compliance_control');

controlGR.addQuery('sys_id', current.control);

controlGR.query();

if (controlGR.next()) {

var controlStatus = controlGR.getValue('status');

if (controlStatus == 'non_compliant') {

controlScore = 1; //Assign score of 1 for non-compliant controls

} else {

}

result.score = controlScore;

/***End of Custom Code. Do not modify anything below. */

if (isNaN(result.score)) {

throw 'Not a number.';

} else if (result.score == Infinity) {

throw 'Divide by zero error.';

}

} catch (ex) {

result.error = ex;

}

Re: Automated Scripted Factor for Non-Compliant Controls

jaikishan1 — Tue, 24 Sep 2024 08:00:32 GMT

Hi @Trey7 ,
Based on the screenshot provided. the control sys id is stored in the variable "control". You can use this directly in your query instead of current.control.
current line = "controlGR.addQuery('sys_id', current.control);"
updated line = "controlGR.addQuery('sys_id', control);"

Regards,
Jai

Re: Automated Scripted Factor for Non-Compliant Controls

Trey7 — Tue, 24 Sep 2024 14:45:39 GMT

Tried that as well, but it is the same result. control is null

Re: Automated Scripted Factor for Non-Compliant Controls

jaikishan1 — Tue, 24 Sep 2024 15:53:55 GMT

It should not be null. Please review the following:
1. RAM configuration to verify that the factor is mapped to the correct assessment(control) and published.
2. Verify the assessment if controls are properly associated and are being assessed.

Re: Automated Scripted Factor for Non-Compliant Controls

Trey7 — Tue, 24 Sep 2024 20:44:48 GMT

Confirmed both of those are true. Does it have anything to do with the automated scripted factor being within a group factor?