---
sourceDocument: Xanadu Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# RMF step 3 - Implement controls

# RMF step 3 - Implement controls {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 6, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

After you have selected controls for implementation and performed any of the possible actions on them, you can implement the controls.

## Before you begin

Role required: sn_irm_cont_auth.information_type, sn_irm_cont_auth.information_owner,
or sn_irm_cont_auth.admin

## About this task

When approval was received on the Authorization Package form, a Percentage of controls implemented field and a Controls related list appeared on the form.

The
Controls related list contains all of the controls
created from the control objectives within the selected authorization boundary.

## Procedure

1. From the list of controls, select the control number (with a CTRL prefix) to open the control.  
2. The implementation process performed by your system owner and other technical or security personnel employs the control management workflow inherent in the base GRC system.  
   For details, see the following:
   * [Manage controls](https://www.servicenow.com/docs/mZkUjfR5eG9gb9TxVvEEOA "Controls are specific implementations of a control objective. Retired controls do not appear in the list. Before defining controls, take time to rationalize, consolidate, and define the important controls in your organization.")
   * [Manage control attestations](https://www.servicenow.com/docs/P2Y_KXYeOG03Dt1JK6F0zA#c_Attestations "Attestations are surveys that gather evidence to prove that a control is implemented. Attestations document how the control is measured. This method is frequently used during the Draft and Monitor state.")
   * [Manage control indicators](https://www.servicenow.com/docs/hDhFupcnUq5tFqRc46CsTQ#manage-indicators-policy-comp "Continuous monitoring involves activities related to identifying and creating key risk and controls indicators. The Compliance Overview is available to compliance administrators and compliance managers, providing an executive view into compliance requirements, overall compliance, and compliance breakdowns.")
   {#implement-controls__ul_agt_lqz_2nb}
3. The Percentage of controls implemented field keeps track of your progress while you implement the controls.
4. After you have completed the implementation process for all controls, select Assess to transition the package to the Assess state.  
   To send the package back to the Select state, select Back to previous step. All active controls will be retired and the package must get approval to
   advance again to the Implement state.