Vulnerability Response Exception Management through GRC

[Cheryl ODell]

 When we setup VulnResp Management, our GRC module wasn't working the way we wanted.  So we have exception management setup through VRM.  When we migrated to USEM, we wanted to move our policy exception management to GRC.  Unfortunately, I found for that to occur correctly, the requester has to have a GRC Business User license.  Are there any plans for allowing people to submit a policy exception or even do a policy acknowledgement without having a GRC Business User license?

Thanks,

Cheryl O'Dell

[Aravind2799]

Hi Cheryl,

I haven't seen anything public from ServiceNow about changing licensing so requesters can submit policy exceptions without a GRC Business User license. Roadmap and licensing details aren't usually shared on the Community, so your ServiceNow account executive is the right person to ask. They can also check whether anything is on the IRM roadmap under NDA.

That said, a few things are worth checking before you decide this blocks the move to GRC.

1. Confirm what your contract actually covers

Depending on which SKUs you have, you may already be licensed for more users than you think. A ServiceNow response on an older thread explained that GRC user-based SKUs follow an all-employee licensing model, so every employee (full-time, part-time, contractors) counts as a GRC user, not just people holding a GRC role. Whether that applies to the Business User tier specifically depends on your contract, so it's worth asking your account exec to walk through your entitlements line by line. servicenow

2. Understand what the Business User roles are for

A practitioner on another thread noted that neither GRC Business User nor GRC Business User Lite is part of GRC Operator licenses. They're treated as fulfiller-style roles for task-based work (attestations, assessments, remediation tasks) performed in Employee Center, without access to the GRC Workspaces. If your goal is broad employee participation, the conversation with your account exec should be about Business User Lite versus Business User coverage, and whether an all-employee option fits your organization. servicenow

3. Look at the Employee Center intake path

ServiceNow's documentation includes procedures for creating a policy exception from Employee Center and submitting a policy acknowledgement request. It's worth confirming with your account team exactly which role and license each of those flows requires on your release, since that's the user population you're trying to reach. servicenow

4. Interim option: keep intake in VR/USEM

If the licensing answer doesn't work for you yet, you can keep exception intake in VR/USEM where it works today, and run policy exceptions in GRC only for licensed users (control owners, compliance staff). It's not the end state you want, but it avoids forcing a license purchase before you have a clear answer.

One caution: avoid designs where a licensed user submits GRC exceptions on behalf of unlicensed requesters just to work around the license requirement. That can create compliance issues with your subscription agreement. Run any proxy pattern by your account exec first.

If you do get clarity from ServiceNow, please share back here. You're definitely not the only one hitting this after the USEM migration.

Thanks

Aravind Panchanathan