---
sourceDocument: Xanadu Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Policy and Compliance Management mandatory setup

# Policy and Compliance Management mandatory setup {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

After you have assigned roles to your users and set Policy and Compliance Management
properties, proceed with the mandatory setup steps.

The flow of mandatory steps in the checklist are illustrated here.

When you have completed the mandatory steps outlined above, other [optional setup procedures](https://www.servicenow.com/docs/DxJHEdTQYp8HVOEBG_hqew "After you have set up the Policy and Compliance Management base system, you can perform the procedures listed in the following sections to enhance the functionality of the application.") are available.
* **[Create a policy](https://www.servicenow.com/docs/t9VHs6HzpTp4cCyBcHsxFg)**   
  A policy defines an internal practice that processes must follow. Policies are defined as policies, procedures, standards, plans, checklists, frameworks, and templates.
* **[Create a control objective](https://www.servicenow.com/docs/Dav_g1VZM~m0nOE6_osVKA)**   
  A control objective is an objective, direction, or standard that acts as guidance for company interactions and operations. Control objectives can be categorized, classified, and related to policies.
* **[Relate a control objective to a policy](https://www.servicenow.com/docs/bkvH~K_vtdjdM7SSfk_h2w)**   
  Associate the control objective to a policy individually when the policy is in the review or draft state by clicking the edit button in the Control Objective related list.
* **[Create a control attestation using the Attestation Designer](https://www.servicenow.com/docs/P2Y_KXYeOG03Dt1JK6F0zA#create-attestation-using-attestation-designer)**   
  Use the Attestation Designer to create and edit metric types. Use different metric types for different controls. Select multiple respondents for an attestation, as well as change scoring parameters.
* **[Create a control indicator](https://www.servicenow.com/docs/hDhFupcnUq5tFqRc46CsTQ#create-control-indicator)**   
  Indicator data for controls, risk, and audit evidence are measured differently depending on the GRC application.