---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Risk and Compliance Dashboard reports and solutions

# Risk and Compliance Dashboard reports and solutions {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Risk and Compliance Dashboard reports and solutions

The Risk and Compliance Dashboard in ServiceNow provides a unified, comprehensive view of the organization's compliance and risk posture by consolidating analytical data from major Governance, Risk, and Compliance (GRC) applications.
It is designed for chief information security officers and compliance managers to monitor cybersecurity, IT risk, privacy, third-party risk, audit activities, and business continuity management.
Access to specific reports requires the corresponding ServiceNow GRC workspaces to be installed and appropriate roles assigned.
Show full answer Show less  

## Access and Roles

* Compliance reports: Roles **sngrcdashboards.grccisouser** and **snbod.ciso**
* Risk reports: Roles **sngrcdashboards.grccisouser** and **snbod.ciso**
* Business Continuity Management reports: Roles **snbcm.viewer** and **snbod.ciso**
* Third-party risk reports: Roles **snvdrriskasmt.vendorassessmentreviewer** and **snbod.ciso**
* Privacy reports: Roles **snprivacy.analyst** and **snbod.ciso**
* Audit reports: Roles **snauditws.auditor** and **snbod.ciso**

Navigate to **All \> Cybersecurity Executive Dashboard \> Cybersecurity Executive Dashboard** to open the dashboard.

## Key Indicators

* **Compliance Posture:** Displays overall compliance percentage based on control assessments.
* **Privacy Compliance Posture:** Shows processing activity compliance score percentage.
* **Functional Domain Breakdowns:** Allows detailed analysis by specific compliance or risk domains.

## Dashboard Tabs and Reports

### Overview Tab

* **Compliance Posture:** Line chart showing cybersecurity and IT risk compliance status.
* **Risk Posture:** Donut chart illustrating risk counts by rating, including detailed aggregated risk data if Advanced Risk application is enabled.
* **Ongoing Crisis Events:** Shows total active recovery events that are unresolved.
* **Assets by Recovery Status:** Donut chart grouping assets involved in crisis events by recovery status.
* **Recovery Tasks by Status:** Displays recovery task states for ongoing crisis events.

### Compliance Overview Tab

* **Authority Documents:** Donut chart and list presenting compliant and non-compliant authority documents with compliance scores, high priority issues, and risk exceptions.
* **Policies:** Donut chart and list showing compliant and non-compliant policies with detailed compliance metrics and issues.

### Risk Overview Tab

* **Risk Posture:** Donut chart showing risk counts by rating and list providing detailed risk ratings, risk appetite, high priority issues, overdue tasks, and Key Risk Indicator breaches.
* **Third-party Risk Posture:** Donut chart displaying risk ratings for third parties or vendors, including risk criteria, tier, intelligence rating, and overdue tasks.

### Privacy Overview Tab

* **Privacy Compliance Posture:** Line chart of monthly processing activity compliance scores.
* **Overdue High Priority Issues:** Focused list of critical overdue privacy issues for timely resolution.
* **Privacy Risk Heatmap:** Visual risk assessment heatmap showing aggregated privacy risk scores by processing activity.

### Entity Overview Tab

* **Entities List:** Summary of risks and compliance scores by entity, including high priority issues and risk exceptions from non-compliant controls.

### Audit Overview Tab

* **Open and Upcoming Audit Engagements:** Lists audit engagements with details such as lead, planned dates, priority issues, fieldwork completion, and milestones.

## Filters

Risk criteria filters enable focused analysis by selecting specific risk domains, which dynamically update the visualization of third-party or vendor risk data on the dashboard.

## Practical Benefits for ServiceNow Customers

* Gain a consolidated, real-time view of organizational risk and compliance status across multiple GRC domains.
* Utilize role-based access to control visibility and ensure security appropriate to job functions.
* Leverage detailed, actionable reports and visualizations to prioritize risk mitigation, compliance efforts, and audit activities.
* Identify and address high priority and overdue issues promptly to maintain regulatory compliance and reduce risk exposure.
* Integrate data from various ServiceNow GRC applications for comprehensive governance management.  
The Risk and Compliance dashboard is a unified dashboard that provides a comprehensive analytical data of reports available from the major GRC applications for the chief information security officer to understand the compliance
and risk posture of the organization. The dashboard consolidates data from various products within the ServiceNow
GRC suite of applications.  
Note:  
All reports are available only when the corresponding workspaces are installed.  
Figure 1. Risk and compliance dashboard

## Required ServiceNow AI Platform roles {#grc-ced-risk-compliance-db-reports__section_b2x_gsh_mbc}

For Compliance related reports
:   User must have sn_grc_dashboards.grc_ciso_user role and sn_bod.ciso role.

For Risk related reports
:   User must have sn_grc_dashboards.grc_ciso_user role and sn_bod.ciso role.

For Business Continuity Management related reports
:   User must have sn_bcm.viewer role and sn_bod.ciso role.

For Third-party risk related reports
:   User must have sn_vdr_risk_asmt.vendor_assessment_reviewer role and sn_bod.ciso role.

For Privacy related reports
:   User must have sn_privacy.analyst role and sn_bod.ciso role.

For Audit related reports
:   User must have sn_audit_ws.auditor role and sn_bod.ciso role.

## Access the Risk and Compliance Dashboard {#grc-ced-risk-compliance-db-reports__section_d2x_gsh_mbc}

To open the dashboard, navigate to AllCybersecurity Executive DashboardCybersecurity Executive Dashboard.

## Indicators {#grc-ced-risk-compliance-db-reports__section_g2x_gsh_mbc}

Compliance posture
:
    * Compliance percentage: Formula indicator that depicts compliance posture.
    * All Controls: Automated indicator that supports the formula indicator.
    * Compliant Controls: Automated indicator that supports the formula indicator.
    {#grc-ced-risk-compliance-db-reports__ul_hmb_bms_pbc}

Privacy compliance posture
:   PA indicator: Processing activity compliance score percentage.

## Breakdowns {#grc-ced-risk-compliance-db-reports__section_h2x_gsh_mbc}

Functional Domain.

## Reports {#grc-ced-risk-compliance-db-reports__section_j2x_gsh_mbc}

Note:  
All reports are available only when the corresponding workspaces are installed.  
{#grc-ced-risk-compliance-db-reports__table_omn_21q_mbc__entry__4}

| Title | Type | Source table | Description |
|-|-|-|-|
| Compliance posture | Line chart![Line icon.]() | Control \[sn_compliance_control\] | Provides cybersecurity and risk, and IT risk and compliance posture based on data analysis to the compliance managers. |
| Risk posture | Donut chart![Donut icon.]() | The source tables are as follows: * Risk \[sn_risk_risk\] * Detailed aggregated risk \[sn_risk_advanced_risk_assessment_result\] (When the Advanced Risk application is installed and Advanced Risk Assessment is enabled {#grc-ced-risk-compliance-db-reports__ul_vgn_m1y_pbc} | Provides the risk count based on the risk ratings. |
| Ongoing crisis events | Single Score ![Single-score icon.]() | Recovery event \[sn_recovery_event\] where event type is actual | Displays the total number of ongoing crisis events that are neither approved nor closed. |
| Assets by recovery status | Donut chart![Donut icon.]() | Assets \[sn_recovery_event_asset\] | Provides the total number of assets for ongoing crisis events grouped by their recovery status, including assets that have been recovered and those that have not. |
| Recovery tasks by status | Donut chart![Donut icon.]() | Recovery tasks \[sn_recovery_event_task\] | Provides the status of recovery tasks in various states for ongoing crisis events. |
[Table 1. Overview tab]

{#grc-ced-risk-compliance-db-reports__table_omn_21q_mbc}  
{#grc-ced-risk-compliance-db-reports__table_k2x_gsh_mbc__entry__4}

| Title | Type | Source table | Description |
|-|-|-|-|
| Authority documents | Donut chart ![Donut icon.]() | Authority Document \[sn_compliance_authority_document\] | Provides data of compliant and non-compliant authority documents in the chart. The list provides details of the authority documents, their individual compliance score in percentage, count of high priority issues and high risk exceptions on the authority documents, and the count of compliant cases. |
| Policies | Donut chart ![Donut icon.]() | Policy \[sn_compliance_policy\] | Provides the count of compliant and non-compliant policies in the chart. The list provides details of the policies, their individual compliance score in percentage, count of high priority issues and risk exceptions raised on each policy, and the count of compliant cases. |
[Table 2. Compliance overview tab]

{#grc-ced-risk-compliance-db-reports__table_k2x_gsh_mbc}  
{#grc-ced-risk-compliance-db-reports__table_vgc_gbq_mbc__entry__4}

| Title | Type | Source table | Description |
|-|-|-|-|
| Risk posture | Donut chart ![Donut icon.]() | The source tables are as follows: * Risk \[sn_risk_risk\] * Detailed aggregated risk \[sn_risk_advanced_risk_assessment_result\] (When the Advanced Risk application is installed and Advanced Risk Assessment is enabled) {#grc-ced-risk-compliance-db-reports__ul_h55_5lx_pbc} | Provides the risk count based on the risk ratings. |
| Risk posture | List ![List icon.]() | GRC Content Status \[sn_grc_content_reports\] | Provides the risk rating for each organizational risk to understand the overall risk assessment results. These ratings help organizations understand the potential impact and likelihood of various risks, enabling them to prioritize and manage these risks. The Risk posture card also highlights the following information for each risk: * Risk appetite: Risk appetite value defined. * High priority issues: The number of issues with priority is defined as High. * Overdue risk response tasks: Number of overdue risk response tasks. * KRI Breach %: Percentage of Key Risk Indicators (KRIs) that have exceeded their predefined thresholds or limits. {#grc-ced-risk-compliance-db-reports__ul_jbn_npt_nbc} |
| Third-party risk posture | Donut chart ![Donut icon.]() | Third-party risks \[sn_grc_dashboards_third_party_risk\] | Provides the risk rating for each third party. The risk rating is the overall assessment rating that considers the scores and ratings from all assessments conducted for a third party or vendor. The Third-party risk posture card also highlights the following information for each third party or vendor: * Risk criteria: Group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party. * Risk tier: Value determined based on the responses collected after an inherent risk assessment (IRQ) is completed. * Risk intelligence rating: Aggregate of all the scores collected from Risk intelligence providers. * Overdue risk response tasks: Number of overdue risk response tasks. {#grc-ced-risk-compliance-db-reports__ul_lks_vs1_4bc} |
[Table 3. Risk overview tab]

{#grc-ced-risk-compliance-db-reports__table_vgc_gbq_mbc}  
{#grc-ced-risk-compliance-db-reports__table_vvj_wgq_mbc__entry__4}

| Title | Type | Source table | Description |
|-|-|-|-|
| Privacy compliance posture | Line ![Line icon]() | PA indicator: Processing activity compliance score percentage \[pa_indicators\] | Provides the compliance posture by month and is plotted by referring to the overall compliance score across all the processing activities. |
| Overdue high priority issues | Single score ![Single score]() | Issues \[sn_grc_issue\] | Provides a focused overview of all overdue high-priority privacy-related issues, enabling quick identification and resolution of critical tasks to ensure compliance and data protection. |
| Privacy risk heatmap | Heatmap ![Heatmap icon]() | Risk assessment methodology \[sn_risk_advanced_risk_assessment_methodology\] | Provides the privacy risk assessment data in the form of a heatmap. Privacy risk assessments are detailed assessments that are conducted if the criticality score is high. Assess each risk that is associated with the processing activity and know the aggregated risk score on the processing activity. After you assess the privacy risks, you can view the privacy risk posture on the risk heatmap. |
[Table 4. Privacy overview tab]

{#grc-ced-risk-compliance-db-reports__table_vvj_wgq_mbc}  
{#grc-ced-risk-compliance-db-reports__table_wcq_3hq_mbc__entry__4}

| Title | Type | Source table | Description |
|-|-|-|-|
| Entities | List ![List icon.]() | Entity compliance status \[sn_compliance_entities_reports\] | Provides the summary of risks directly associated with the entity that contribute to the overall risk rating of the entity. The list also displays the compliance score of entities, and high priority issues and risk exceptions that are raised as a result of the non-compliant controls associated with the entity. |
[Table 5. Entity overview tab]

{#grc-ced-risk-compliance-db-reports__table_wcq_3hq_mbc}  
{#grc-ced-risk-compliance-db-reports__table_fp4_33q_mbc__entry__4}

| Title | Type | Source table | Description |
|-|-|-|-|
| Open and upcoming audit engagements | List ![List icon.]() | Engagement \[sn_audit_engagement\] | Provides a list of open and upcoming audit engagements. The list also provides details of the engagement lead for each authority document, each engagement's planned start and end dates, high-priority issues, percentage of fieldwork that is completed, and the milestones in progress. |
[Table 6. Audit overview tab]

{#grc-ced-risk-compliance-db-reports__table_fp4_33q_mbc}

## Filters {#grc-ced-risk-compliance-db-reports__section_l2x_gsh_mbc}

{#grc-ced-risk-compliance-db-reports__table_m2x_gsh_mbc__entry__3}

| Name | Type | Description |
|-|-|-|
| Risk criteria | Report | Depending on which risk criterias you select, the donut chart and list shows the third parties or vendors that are in those risk areas. |
[ ]

{#grc-ced-risk-compliance-db-reports__table_m2x_gsh_mbc}

*[\>]: and then