Is there any OOB feature in ServiceNow SecOps SIR that prevents closing a security incident unless assessments are completed? Or do we need to customize this with a business rule/workflow?
You can achieve this with configuration today, as part of the Security Incident Response > Administration > Post Incident Review - Assessment Configuration.
There you can set the triggers for when an Assessment should either be mandatory (e.g. Priority = Critical), or optional.
