K20 LAB3015 - Scale Trust and Resilience for your Third Parties with Vendor Risk Management

[Paul Jensen2]

This article is for questions and answers for LAB3015 - Scale Trust and Resilience for your Third Parties with Vendor Risk Management.

This lab is being presented multiple times throughout the live K20 event May 5 - 7, 2020. During the live event, post your questions in the comments of this article, and one of our lab gurus will be happy to answer it.

[Lena Laughlin]

Test question for Paul.

[Lena Laughlin]

Test response

[Paul Jensen2]

Is this the 2nd question?

[Lena Laughlin]

Response

[Lena Laughlin]

Test question

[Paul Jensen2]

New answer

[Paul Jensen2]

Not sufficient

[Paul Jensen2]

Questions and Answers for the EMEA Session

[Paul Jensen2]

2nd

[Paul Jensen2]

Here is the first question that someone has.

[Greg Conn]

Welcome to K20!!!

[manojp]

Welcome everyone to K20! Pl. post your questions related to this lab (K20 LAB3015) here. Thank you and have a great, successful lab!

[Adam Kouba]

Do these questionnaire's allow a user to save part way through answering then come back later to finish or do they require someone to complete the whole assessment in one go?

[manojp]

Am on it

[Dan Minter]

I got this one

[manojp]

Yes, you can save it and come back to any section, any time to continue your work.

[manojp]

Furthermore, you also can assign different team members to work on one assessment

[briantschantz]

Are the assessment templates simply groups of questionnaires, or is there a way to view the template as a combined assessment?

[Dan Minter]

I have this one

[Dan Minter]

The assessment is a group of one or multiple questionnaires and/or one or multiple document requests.  Many of our customers love this approach because they can divide up their assessment by things like: Business Continuity Readiness, InfoSec readiness, Financial Risk, etc.  Then the vendor can route those separate questionnaires to different subject matter experts in their company.

[Dan Minter]

You can see a consolidated view of all questionnaires and document requests within the assessment record in ServiceNow

[Dan Minter]

You can see a consolidated view of all questionnaires and document requests within the assessment record in ServiceNow

[Dan Minter]

Brian - did that help you?

[briantschantz]

Yes, thank you.

[briantschantz]

I noticed that vendor contacts are automatically added as active users in the sys_user table - is this why Vendor Risk Management uses the Explicit Roles plugin? Are there any risks associated (e.g. system access, licensing)?

[Dan Minter]

I'll take this one too

[manojp]

WIP for @briantschantz 

[Dan Minter]

Hi Brian.  Once the Vendor contacts are provisioned they are locked down via ACL to only be able to see the specific questionnaires and/or document requests that are assigned to them in the Vendor Portal.

[manojp]

...Add-on: and security then prevents to access anything else, they are not allowed to see... or have a particular role for.

[briantschantz]

Thank you.

[Adam Kouba]

I can't chat back, but I ran into issues with the lab instance around creating my vendor as an entity for the GRC integration.  I know there is a filter and it won't let me link a new entity to the vendor record, but that prevented me from generating controls.  Not sure it that's a timer job creating those that's not available/setup for the instances. Not sure if anyone else ran into that issue.

[briantschantz]

Sorry if this was answered during the session, but are any of the labs being recorded, or is this exclusive to registered participants?

[Paul Jensen2]

All of the sessions presented will eventually be recorded and made available on demand through Now Learning.

[Paul Jensen2]

Questions and Answers for the AMS Session

[Paul Jensen2]

Here is my ????

[Paul Jensen2]

Answer

[Paul Jensen2]

another answer

[JM9]

The hand-raise isn't an option for the web client, just FYI.  Some of us are on work laptops that block the installation of unapproved software like Zoom.

[JM9]

By leaning so heavily on features of the software Zoom client, you've made it impossible for me to ask for help, indicate when I'm done with a step, or anything else.  PLEASE fix this for future labs!

[Nikunj Bambhar1]

Hi,

Our ServiceNow instance is IP restricted- which means you cant access ServiceNow outside of network - can we just expose Vendor portal to our Vendors for assessments and not access to whole Instance?

[swindgassen]

Like the designer and the dependancies. Makes me wonder: will this also be available for building Catalog Forms?

[Dan Minter]

The Vendor portal does have a different url so I guess that might be possible.  I guess that depends on your firewall rules.

[Dan Minter]

@swindgassen. Could you clarify that question?  Do you mean do you build assessments the same way that you build catalog items/record producers in the portals?  If so, the process is similar, yes.

[Christen Ketcha]

Glad to hear you like the Designer and use of dependancies. I have built several assessment types very quickly with this. Ease of use/user experience is a critical aspect for ServiceNow, where ever  functionality exists that can be leveraged across the platform we always try to leverage and re-purpose. Functionality improvements are always welcome from our customers. 

[swindgassen]

I know about the role a Vendor contact gets 9snc_external), but did anyone think about Vendors, being Customers as well or even working in Servicenow (one system of record, even for Vendor/ Partner activities) as part of the Service delivery?

We have quite a few of these situations where now need two records a user: one for doing the Assessment via VRM and one for raising tickets against /working as a fulfiller (not itil, but custom role)

[swindgassen]

no just the technique of the designer. Now if we have dependencies in a Service request we have to script a lot, whereas here it is no-code design with same effect (if answer to a specific is yes than show yet another field)

[dwilcher]

We also have this restriction in place for our instance. It would be great to hear specifics from SN our the lab team if it's possible to expose the vendor portal when you have IP restrictions on your instance (to be clear, these are not IP restrictions in our firewalls but in our SN instance using IP Address Access Control).

Is there a way to make the Vendor portal available outside our company network if we are using ServiceNow's IP Address Access Control to limit access to our instance only to company networks?

[Dan Minter]

Vendors are in the company table.  The records in that table can be classified as Vendors with a checkmark. Scroll to the right ----->

[Dan Minter]

Also there are many different views of the same company record:

[dwilcher]

We also have IP restrictions in place for our instance (SN hosted) to limit the instance to our company networks.

Is there a way to make only the Vendor portal available outside our company network if we are using ServiceNow's IP Address Access Control module to limit access to our instance only to company networks?