Grc Common Functions

Reach issue workflow configuration from within a product workspace, such as Risk Workspace, instead of navigating to the base GRC admin console.

You must activate agentic workflows that contain a set of LLM instructions with one or more AI agents to execute tasks.

Activate a skill before you can use the generative AI capabilities for the ServiceNow Otto for Integrated Risk Management (IRM) application.

You can activate the GRC: Regulatory Agency Library application if you have the admin role. This application includes demo data and provides you access to regulatory body profiles.

Configure and activate the report a GRC issue AI agent to guide employees in reporting GRC issues from the Employee Center with clarity and context.

Add a state to a GRC state model and configure its stepper display, transitions, and attributes.

Add a standalone issue as a child of an existing parent issue directly from the parent record.

Add an authority document to a regulatory agency in Compliance Workspace to maintain traceability between regulations and their source documents.

Add a regulatory agency in Compliance Workspace to identify the relevant regulatory authorities that are responsible for overseeing the industries or sectors within each jurisdiction.

Add a regulatory contact to a specific regulatory agency or within a jurisdiction in Compliance Workspace. By mapping a regulatory contact to a specific agency, this contact is notified about your case reporting, case audit, and case closures as they occur.

Add a jurisdiction to a regulatory agency in Compliance Workspace to define the geographical scope for regulatory applicability.

Attach a layout, state model, and playbook to a workflow to define what it captures, its lifecycle, and how users are guided through it.

GRC administrators can now configure the Tasks and Issues overview landing pages in the workspaces by using the GRC Landing Page Configurations module in the classic user interface. The role required to configure the tasks, issues, and other items in the Landing Page Configurations module is the sn_grc_workspace.task_admin role. GRC administrators are assigned the sn_grc_workspace.task_admin role by default.

The AI for document designer uses prompts to generate reports from ServiceNow instance data directly in a Microsoft Word document.

Within the NIST CSF application, the Framework Profiling section is used to help an organization to align and prioritize its cybersecurity activities with its requirements, risk tolerances, and resources.

Fields used in the activities of the Analyze state in an issue's lifecycle.

Use the Approval Configuration New Record form to create an approval configuration record.

The GRC: Approver Configurator application provides you with capabilities to define multiple levels of approvals based on the business assignment rule configurations.

Use the Approval Level New Record form to create an approval configuration on a policy record.

Use the Approval Rule form to create an approval rule.

Use the Approval Rule New Record form to create an approval rule for the approval level for a policy record.

Use the Assignment Configuration new record form to create auto-assignments for regulatory events of the type regulatory alert.

Assignment rules help in automating organization’s task records such as action tasks, and non-task records such as issues, incidents, regulatory alerts, and so on.

The ServiceNow Brazil release supports breadcrumb navigation for all GRC modules including workspaces. Breadcrumbs provide a browser path to navigate a hierarchy of linked pages with related content.

Provide an entity class for multiple entities where the class field is empty. Entity classes are used to add a conceptual information about the entity and classify the entities. As an administrator, you can update the entity classes for multiple entities with a single click.

Update the functional domain for multiple records at once to save time and ensure efficiency.

Entity scoping is permitted in each of the core GRC applications. Scoping provides a way to allocate risks and controls at different levels. Dependencies are created using the dependency map in the GRC Workbench.

Withdraw a pending approval request that is no longer needed so the approval can be requested again.

Create a copy of an existing workflow to use as a starting point for a new workflow.

Each Governance, Risk, and Compliance application has unique features and capabilities. Additionally, there are many features that are common to all GRC applications.

Complete playbook activities to progress an issue through the stages defined in its workflow.

Reference topics provide additional information about components that are installed with the activation of the GRC plugin. These components include tables, user roles, and properties.

Several types of components are installed with the item generation process, including tables, scheduled jobs, and action handlers.

Compose and send an email about a regulatory agency record to multiple stakeholders within or outside your organization by using the Compliance Workspace.

Composite entity in Governance, Risk, and Compliance is a combination of two or more entities created from different entity classes. The Composite Entity Management application enables you to create multidimensional entities and manage them in a more granular level.

You can set up confidentiality inheritance in the tables that are already configured in the confidentiality configuration module. In the GRC application, whenever a parent record is marked or unmarked as confidential, its related table records are also marked or unmarked as confidential.

You can mark sensitive GRC records as confidential. You can then make sure that the right people have access to these records.

The Confidentiality configuration form is used for the configuration of the confidential records for your GRC tables.

Use the Confidentiality Inheritance Configuration form in the GRC application to create the inheritance configuration record.

Create confidentiality inheritance in the tables that are already configured in the confidentiality configuration module. In the GRC application, whenever a parent record is marked or unmarked as confidential, its related table records are also marked or unmarked as confidential, if an inheritance record is also set up.

GRC administrators can configure the tasks for the individual users and user groups in the GRC Landing Page Configurations module. Based on these configurations, the workspace users can view the individual user tasks, user group tasks, my items, and watchlist on the Tasks page in the workspace view.

Create a user hierarchy configuration record for a table so that you can enable your managers to view the records of the users who report to them.

Attach approvals to a workflow so issues or remediation tasks require approval before certain actions can be completed.

Assignment configuration rules help in automating organization’s task records such as action tasks, and non-task records such as issues, incidents, regulatory alerts, etc.

Configure an entity filter to automatically update entity owner and class when source data changes or an entity moves between filters.

Configure role mappings on a business domain to control which users can select the domain when importing data into a Microsoft Word document.

Create a record and mark it as confidential so that you can make sure that only the users with a specific role can access it.

You can create a confidentiality configuration record in your GRC tables.

Configure entity-based record access rules on record types to apply access restrictions to new records automatically.

Configure data columns to include table fields or scripted content in your report. Format scripted content as text or HTML.

Create notification routing rules that automatically direct users to workspace view or classic view based on their access permissions.

Specify which types of entity changes require review before they take effect.

Set up filters for intermediate data relationship nodes based on the selected data relationship in the content configuration. This ensures only relevant information is displayed, making reports clear and actionable.

Improve the accuracy of AI for document designer results when querying ServiceNow instance data by configuring knowledge graph tags. Knowledge graph tags provide table-level and column-level instructions that the AI for document designer uses internally when querying ServiceNow instance data.

Configure and monitor the tasks that are related to an assigned user in the workspace. Configure the landing pages and the widgets that are displayed in the workspaces using the GRC Landing Page Configurations module. The configurations performed using the Landing Page Configurations module help you to filter the data that is displayed in different workspaces.

If you have the admin role, you can configure ServiceNow Otto for IRM so that your agents can use the generative AI skills in the IRM workspace.

Create a recommendation context to define a configuration that builds a template for recommending relevant records.

Configure the template to specify the fields from which data must be obtained and displayed on the audit report.

You can configure and customize your workspaces so that all the GRC applications have a similar appearance.

Configure the audit report templates using the ServiceNow Document Designer with Word add-in.

You can add tags to virtually any type of record defined in GRC applications that reference GRC content packs, integrations, use case accelerators, or any new regulations that use those records. After the records have been tagged, you can filter the content reference tags to identify which records are used within each application.

The entity-based record access rules let admins apply restrictions automatically to new and changed records. This configuration ensures that access settings stay enforced. No manual updates are needed when records are created, modified, or when users are added to user fields or user group fields.

Set access restrictions for the existing records in bulk by using the Entity based record access update utility guided-experience. Use the workflow to enable or disable access to record types.

Create a business domain to define the context in which data is imported into a Microsoft Word document using Document designer.

You can create a domain by creating a record in the [domain] table.

Create a GRC state model to define the states a table's records move through so an issue workflow can use it to control its lifecycle.

Entities can be created manually, rather than generating them from the entity types. Entities can also be created without needing to refer to an existing ServiceNow table, like assets, applications, business services, or processes.

Create a recommendation template to train the AI models with a data set for identifying your key business operations. Key business operations include managing regulatory changes, assessing risks, and adhering to compliance guidelines.

Create a cybersecurity activity for a target.

Use the template configurations to create placeholders for an audit report template tailored to your needs.

Configure access to an entity for your users or user groups so that they can access the entity's related records.

Configure an entity class for a linked object by using the Entity Based Access application. You can define an entity class, such as Business Process, Business Service, or Database, and manage the object access for the entity that is linked to that entity class.

Configure an entity type by using the Entity Based Access application. You can specify an entity type, such as Company or Vendors, and manage the object access for the entity that is linked to that entity type.

Set up a workflow so a specific category of issues, such as vendor risk or compliance issues, follows its own states, layout, and trigger condition.

Create multidimensional entities by combining two or more entities from different entity classes using the Composite Entity Management application. In Governance, Risk, and Compliance, entities can be people, processes, departments, applications, or objects.

Establish an SFTP or REST API connection for the GRC integration with Thomson Reuters Regulatory Intelligence application. You can create an SFTP or REST API connection with the SFTP server by using the Connection & Credential aliases that are shipped with the Thomson Reuters platform.

Define the data that you want to view or fetch, whether it's a list of records or an aggregation when creating an audit report. For example, specify if you want to see a list of remediation tasks or the list of the top five high priority issues. A maximum of 200 records can be fetched from any table.

Create a path to go from a record in the template configuration to any table that you require. When you create these paths, you can get the necessary data from each of these paths in your audit report template.

Create an entity filter under an entity type in the classic user interface. The entity filter defines the table from which data is pulled into each entity type for display. If the entities belong to an application, the users who have access to the entity class that is associated with the entity can only view those entities.

Use the Create New Agency form in Compliance Workspace to create a regulatory agency. The regulatory agency is a new record type that handles regulatory changes or compliance case management.

Use the Create New Entity form to create a composite entity by combining two or more entities from different entity classes using the Composite Entity Management application.

You can create an entity class rule filter to assign classes at the filter level on the same table that is defined on the class rule.

Create a rule for an entity class. Entity class rules provide the classification of the entities at the class level. You can create a new entity class rule for an entity class that is associated with a table. After creating the new entity class rule, the Entity class rules table is updated with the new record.

Create an entity class that is associated with an entity. Entity classes are used to add a conceptual information about the entity and classify the entities. They represent a collection of entities that have the same attributes such as Department, Business Unit, or Business Service. You can gather data about the entities based on the entity class.

Create an entity filter under an entity type in the workspace view. Entities in entity type are created based on the conditions set in the Entity Filter. The entity filter defines the table from which data is pulled into each entity type for display.

Create an entity tier for the entity classes in your organization. When you create entity tiers, you can apply a level or hierarchy to the entity classes. The hierarchy level applies to all the entities associated with the entity classes.

Create an entity type for the entities in your system. Entity types enable you to find and create new entities that match a set of filter conditions. You can create a hierarchy of the entity types within the entity classes.

Create an entity for your enterprise. In Governance, Risk, and Compliance, entities can be people, processes, departments, applications, or objects. These entities have controls that are defined to mitigate their exposure, and their audits must be completed.

Create a new issue page configuration record in the Issue Page Configuration module in the classic user interface. The Issue Page Configuration module displays the configurations related to the Issues section in the landing pages of the workspaces. The newly created issue is displayed in the Issue overview landing page in the selected workspace.

Use the Create New Regulatory Contact form in Compliance Workspace to create a regulatory contact to either a regulatory agency or a jurisdiction.

Create a user with the sn_grc_cim.admin role to perform the tasks that are related to the content integration and import process.

The contains various reports. The NIST Cybersecurity Framework (CSF) Use Case Accelerator contains a variety of reports displayed on different dashboards, available within each of the sections in the NIST CSF process:

If you have the admin role, you can customize a ServiceNow Otto for Integrated Risk Management (IRM) skill so that agents can use the generative AI skills in Service Operations Workspace for ServiceNow Otto for IRM and in Core UI.

If you have the admin role, you can customize the issue summarization skill so that users can use the generative AI skills in Risk Workspace and in Core UI.

Configure properties that control the chart color palette and table size for content generated by the AI for document designer.

The Cyber Risk Institute (CRI) is focused to collaborate with the financial sectors and regulators to streamline standardization across risk management. For better cyber compliance management, CRI provides a CRI Profile with the financial sector consensus.

The Cybersecurity Controls Accelerator enables users to easily adopt the CIS Controls from The Center for internet Security to enhance their overall security preparedness and cyber-defense posture.

Stop an active workflow from being evaluated for new issues on its table.

Deactivate an entity-based access (EBA) configuration to disable access restrictions from associated records, confirming only active and relevant configurations control data access.

Deactivating entity-based access (EBA) not only disables the configuration but also streamlines admin workflows by automating record-level access evaluation.

Define data for the scripted variables using the Template Configurations module for creating a report template in the Audit application. You can configure the data in either text or HTML format.

The Microsoft Word based audit report is accessible and user-friendly for audit administrators. Even users without technical expertise can easily configure the template to meet their specific needs.

Before you run the Technology Controls Monitoring Accelerator application in your instance, you must download it from the ServiceNow Store.

Entity-based access configuration states represent the defined permissions and control settings.

Modify an entity filter condition and preview the revised impact before saving the filter and accepting the entity changes.

When you receive notifications for GRC records, you're directed to either the workspace view or classic view based on your access permissions and role. This feature enables you to work directly in the appropriate interface without manual navigation.

Enable or disable an issue relationship configuration record so that you can automatically link an issue with its related objects in the GRC application.

You can configure some functionality enhancements for the entities as part of the GRC updates.

When you download the GRC: Technology Controls Monitoring Accelerator application, all indicator templates are available, but they are not yet active. Before activating them, you need to ensure that you have the necessary applications activated and can access the tables that are mapped to the indicator templates.

The Entity form in the workspace provides a complete view of an entity across your organization. The Entity form is listed under the Library menu of the List view in the workspace. Select an entity in the list view so that you can display its overview, details, hierarchy, entity types, or downstream risks.

The entity based record access update utility is a guided assistance, designed to simplify the application of enabling or disabling access restrictions across large volumes of records.

Entity-based access restriction can be applied on some GRC tables.

The Entity Based Access (EBA) application enables you to segregate data on the records that are based on entities. Entity-based access administrators can use this tool to set up secure, controlled access to various objects.

Review entity changes and their impact on associated risks and controls before the changes take effect.

Use the Entity Class Configurations form to set up access control to all the entities that are linked to the entity class.

Entity classes are used to add a conceptual information about the entity or to tag the entity. They are used to classify the entities and they represent a collection of entities that have the same attributes.

You can create an entity class rule filter by filling out the fields that display after you click the New option in the entity class rule filters related list.

Entity class rules help to assign classes to the entities at the table level. Any new entity created on the table gets that entity class automatically. Entity classes are used to tag your entities.

Use the Entity configurations form to configure access to the objects through an entity.

Descriptions of the fields displayed in the Entity filters related list under Entity type.

Entity owner and entity class derivation settings determine how the system selects owner and class values when one or more entity filters apply to an entity.

When you create entity tiers, you can apply a level or hierarchy to the entity classes. This level applies to all the entities that are associated with the entity classes. Entity tiers enable you to select and view the status of the most critical items in the business.

Use the Entity Type Configurations form to create an entity type configuration within the Entity Based Access application.

Entity type is a grouping of the entities that match a set of filter conditions. You can create a hierarchy of the entity types within the entity classes. The Entity types option is displayed under the Lists view in the workspace. Click an entity type to display its details.

Create and customize audit report templates using a Word template. You can configure this template to match your specific needs. Once the template is set up, it can be applied to one or more audit engagements, automatically generating audit reports in Word format.

With the ServiceNow Otto for Integrated Risk Management (IRM) application, you can use generative AI to support key IRM tasks such as summarizing issues, identifying risks, and reviewing controls. These capabilities are integrated into IRM records and help streamline how you work with issues, risks, controls, policy exceptions, and more.

Entities are one of the most fundamental and crucial elements for using Governance, Risk, and Compliance. Entities can be people, processes, departments, applications, or objects that are examined for risks.

Use extension points to extend the functionality of an application without altering the original application code. Recommendation contexts use extension points to enable additional functionality while configuring the recommendation contexts or templates.

Manually fetch the latest Unified Content Management (UCM) content from the Continuance Delivery System (CDS) to bring new content and updates to your content library.

The Financial Services Control Accelerator gives customers an operational head-start when adopting the Financial Services Control. When the accelerator is downloaded and activated in the GRC applications, pre-configured authority documents, citations, and control objectives.

The functional domain feature enables users to efficiently filter and sort records within a workspace based on domain-specific tags. For instance, when working in the Privacy Workspace, users can exclude records that are not tagged with privacy, allowing for a more focused view and reducing potential confusion.

Optimize a GRC issue resolution plan by using the Optimize GRC issue resolution agentic workflow in the Now Assist panel. This agentic workflow generates an action plan for the issue and suggests remediation tasks to resolve the issue.

Generate a target record for a profile to track NIST RMF attributes.

Generate a target record for an entity to track NIST CSF attributes for that entity.

The NIST RMF Use Case Accelerator gives customers an operational head-start when adopting the NIST RMF. When the accelerator is downloaded and activated in the GRC applications, pre-configured policies, scopes (profile, profile type recommendations), indicators, risks and other GRC elements appear.

The Anonymous Reporting Center (ARC) enables employees to submit compliance, privacy, or AI‑related concerns without revealing their identity. Employees are automatically signed out of the Employee Center when ARC opens.

The Cybersecurity Executive Dashboard gives the Chief Information Security officer a comprehensive overview of the security posture score of an organization. However, the compliance and risk users can use the risk and compliance page to get an all-inclusive picture of all the GRC metrics.

Certain common roles are used in multiple GRC modules.

Content packs may include pre-defined scopes, specific policies, controls, risks, audit, test plans, dashboards, and reports that provides customers an operational head-start when adopting various regulations and frameworks.

The NIST CSF Use Case Accelerator gives customers an operational head-start when adopting the NIST CSF. When the accelerator is downloaded and activated in the GRC applications, pre-configured policies, scopes (profiles, profile type recommendations), indicators, risks, and other GRC elements appear.

This is an overview of domain separation and the Governance, Risk, and Compliance applications. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

Check the status of your case on the Anonymous Reporting Center using the Report key and Report number. You must download a copy of your anonymous report after submitting a case to record these values.

Integrations enhance the ServiceNow GRC product offering, providing users the ability to integrate with third-party applications.

Use the GRC licensing summary dashboard to track license usage trends and next month's projected usage. You can see the aggregated counts of license consumption across different product families. You can also search for roles to identify their combined GRC license treatment when these roles are assigned to a user.

Familiarize yourself with these concepts, developed from the NIST CSF guidance.

Familiarize yourself with these concepts, developed from the NIST RMF guidance.

The following are the common GRC properties under Policy and Compliance and Risk Management.

Reference topics provide information about tables, roles, and properties installed with the GRC application.

The Shared Assessments Standardized Information Gathering Questionnaire (SIG) is used to obtain required assessment documentation from a third party. The third party contact can upload a pre-filled SIG spreadsheet or take a form-based questionnaire that gets imported to the instance.

The SOX Content Pack dashboards display multiple SOX reports on a single screen. Various GRC roles have read or edit access to these dashboards.

Use Submit a report anonymously on the Anonymous Reporting Center (ARC) landing page to raise suspected compliance, privacy, or AI-related issues confidentially.

The following terms are used within GRC applications and/or within the GRC industry.

The ServiceNow Regulatory Change Management application helps you to gather, monitor, and analyze regulatory data and track developments in a complex regulatory environment.

Use case accelerators may include pre-defined scopes, specific policies, controls, risks, audit, test plans, dashboards, and reports that provides customers an operational head-start when adopting various regulations and frameworks.

Within the NIST CSF application, the Framework Core section is used to identify categories and subcategories as cybersecurity policies and their statement policies.

The Technology Controls Monitoring Accelerator includes 273 indicator templates (94 Basic, 174 Manual, and 5 Scripted) for CIS v7 and includes new 67 indicator templates (64 Basic and 3 Scripted) for CIS v8.

Install the GRC: Entity Based Access (sn_grc_ent_access) application.

The GRC: SIG Questionnaire Integration plugin installs the SIG questionnaire templates for use with the GRC: Third-party Risk Management application.

Install the SOX Content Pack for use with the core GRC applications.

The NIST Cybersecurity Framework (CSF) Use Case Accelerator is used with the GRC core applications: Policy and Compliance Management, Risk Management, and Audit Management applications.

The NIST RMF Use Case Accelerator is used with the GRC core applications: Policy and Compliance Management, Risk Management, and Audit Management applications.

Install the GRC integration with Thomson Reuters Regulatory Intelligence application (com.sn_grc_int_tr). The application includes demo data. It installs related ServiceNow Store applications and plugins if they are not already installed.

You must assign the user roles that are required for the overall integration process that is associated with the GRC: integrations with third-party content and GRC: Policy and Compliance integrator applications.

The GRC: integrations with third-party content application helps you to standardize the content integration process across various GRC applications by providing a common framework for your content providers.

Issue approval flows require review and approval before an issue or remediation task moves past a specific state, or before its due date is extended.

Group issues within your workspaces to organize and manage related issues. Grouping similar issues can streamline your workflow and save time.

The Issue Page Configuration module displays the configurations related to the Issues overview landing pages in various workspaces. The data displayed in the Issues overview landing page is configured using the Issue Page Configurations module in the classic user interface. The Issues overview landing page includes the Issues, Issue triages, Tracking status of the issues, and Audit observations pages.

Use the Issue Relationship Configuration form in the GRC application to automatically link a destination record with an issue when it’s linked to the source record.

If an issue isn't reusable and you know that multiple similar issues were created for different controls, risk statements, or control objectives, you can still configure the issue relationship to reuse the issue in the GRC application.

The report a GRC issue AI agent enables employees to report GRC issues through the Employee Center using a guided, conversational experience. It organizes the information provided by the user, facilitates review, suggests relevant details, and streamlines submission, reducing barriers to reporting issues.

Use the Issue Summarization skill to view a concise summary of an issue based on its life-cycle data. The skill analyzes the issue’s context and generates a short, readable overview that includes key details such as status, actions, and relevant metadata. This helps you quickly understand the issue without reviewing the full record.

Issue workflows define the lifecycle, layout, guided activities, approval requirements, and routing rules for different types of issues.

You can track all your issues or one specific issue from the Workspace. Issues are listed under the Issues module in the list view of the Workspace.

Operational changes are made in item generation mainly because item generation either creates a control or activates an existing standard control. When it comes to associating a control to an entity, then associating a reliant entity to a common control takes precedence over creating a control for that entity.

The ServiceNow GRC suite of applications can automatically generate controls and risks for your organization with the enhanced item generation process. The enhanced item generation process (v2) in version 13.x.x fixes the stalling and performance issues from the item generation process (v1) in version 12.x.x and earlier releases.

Create a new Issue Page Configuration record and link it from the classic user interface to the desired workspace. After linking the Issue Page Configuration record, the workspace view displays the new settings in the Issues overview landing page.

Review all issues stemming from controls and risks with NIST 800-53.r4 as the source and address them.

Review all remediation tasks stemming from controls and risks with NIST 800-53.r4 as the source and address them.

You can measure the effectiveness of your company's risk management program by how quickly and completely it identifies and reacts to risk and compliance issues.

Map workflow states to playbook stages so that the issue state and guided activities remain synchronized as an issue moves through its lifecycle.

Manage your work, task assignments, requests, approvals, and other follow-up actions for GRC applications directly from your mobile device. Receive timely notifications for current alerts, as well as risk and compliance status for your critical assets, vendors, and impacted essential business services.

Update email notifications to use the notification redirection framework so users are automatically directed to the appropriate view based on their workspace access.

The GRC integration with Thomson Reuters Regulatory Intelligence application includes various modules.

The NIST RMF assess dashboard provides insights into the overall status of the target.

The NIST RMF Authorize dashboard provides insights into the overall status of the target.

The NIST RMF categorization activity dashboard provides insights into the overall status of the target.

The NIST RMF monitor dashboard provides insights into the overall status of the target.

Fields used in the activities of the New state in an issue's lifecycle.

The NIST CSF navigation structure facilitates the management of the NIST cybersecurity through activities of identification and prioritization, as described in the NIST Framework for Improving Critical Infrastructure Cybersecurity version 1.1 and version 2.0 special publications.

A few tables are impacted by the NIST CSF guidance.

The NIST RMF navigation structure facilitates the management of the NIST security controls through activities of categorization, selection, implementation, assessment, authorization, and monitoring. These security controls are described in the NIST 800-37.r1 special publication.

Use the ServiceNow Otto for Integrated Risk Management (IRM) plugin to summarize issue records, identify potential risks, and review controls using generative AI. It helps you quickly understand the context of records, reduce manual effort, and make faster, more informed decisions by delivering relevant insights directly within your existing workflows.

Get a quick overview of the important information that is related to the ServiceNow Otto for Integrated Risk Management (IRM) application.

GRC: Approver Configurator enables you to configure approvals for any record that exists in specific tables.

After you've identified a target, orient the target to use with the NIST CSF framework.

Perform a Gap analysis of cybersecurity activities.

Perform a preliminary risk assessment and impact analysis of the target.

After activating the report for a GRC issue AI agent, the system performs indexing to ensure optimal functionality. Users can also choose to customize the issue definition, enabling the AI agent to provide more tailored suggestions and align with organizational standards.

There are several properties that get installed with the Document designer plugin. These properties help to control the various aspects of how the plugin works.

Change the workflow that an existing issue follows so the issue uses the states, layout, and approval rules of a different workflow on the same table.

Use the recommendation context form to create a configuration.

By using the Governance, Risk, and Compliance recommendations framework, you can use recommendation contexts and templates to deliver AI-driven insights directly to your users within the user interface. With these insights, your users can make informed decisions and take prompt actions.

The table gives you a list of icons configured for the forms in the Audit Workspace and Compliance Workspace.

Regulatory Agency Library is a new application available in the ServiceNow Store for download and activation.

Create relationships between entities to understand how controls and risks affect each other and how they affect the enterprise.

Fields on the remediation task form.

Remove a child issue from its group so it becomes a standalone issue.

Report GRC issues by using the Report a GRC issue AI agent in Employee Center. The AI agent guides you, structures your input, and suggests relevant controls, entities, and policies before submission.

Send an approval request for an issue or remediation task so designated approvers can review and respond to it.

Fields used in the activities of the Respond state in an issue's lifecycle.

If you’re an existing customer and have a customized record page, you can revert to that old page.

Review the remediation tasks created for the controls or risks associated with cybersecurity activities. You can only edit or update action plans if you have sufficient privileges for the GRC suite.

Review the impact of proposed entity changes and accept the changes when the impact is expected.

Review the workflow configuration and activate the workflow so it can be applied to new issues.

Fields used in the activities of the Review and close state in an issue's lifecycle.

Respond to an approval request assigned to you so the issue or remediation task can continue through its workflow.

Review the Framework Core that's activated with the NIST CSF application.

Within the NIST RMF application, the Assess section involves performing security control attestations, evaluating the control effectiveness, managing associated risks and issues, and performing remediation tasks.

Authorize a target record based on the overall security posture determined by the security officer.

Within the NIST RMF application, the Authorize section involves the authorization of targets based on their compliance and risk posture.

Within the NIST RMF application, the Categorize section facilitates the categorization of targets through a preliminary risk assessment and an impact analysis.

The NIST RMF Use Case Accelerator contains various reports displayed on different dashboards, available within each of the sections in the NIST RMF process: Categorize, Select, Implement, Assess, Authorize, and Monitor.

Review and evaluate the effectiveness of the controls through the execution of control tests related to NIST-800.53.r4.

Within the NIST RMF application, the Implement section focuses on the physical implementation of the baseline security controls. The NIST RMF application may also include other standard security controls, already used by the targets or its environment of operation.

Review and manage all risks stemming from risk statements having the content source of NIST 800-53.r4.

From a list of security controls stemming from NIST 800-53.r4 policy statements, review the control tests and update implementation details.

From a list of security controls stemming from NIST 800-53.r4 policy statements, review the controls and update implementation details.

Within the NIST RMF application, the Monitor section involves the on-going monitoring of the security controls for targets documenting changes to them or their environments of operation, conducting security impact analyses of the associated changes, and reporting their security state to designated officials.

Review and perform control attestations relating to NIST RMF security attestations.

Review and execute the risk assessments relating to NIST RMF security assessments.

Review the baseline policy statements and baseline controls.

Review all indicators that are set up for NIST and manage them to track their results.

Within the NIST RMF application, the Select section focuses on the review of the initial set of baseline control definitions. You can also tailor the control definitions, by tagging them based on organizational requirements.

Tailor the baseline policy statements and baseline controls.

The role hierarchy node map displays the relationship between the license contributing roles for role-based users and provides insights into the licensing treatment of a user.

Various roles are installed with the activation of the GRC: Approver Configurator application.

Use case scenarios offer a clear and comprehensive explanation of why you would use the Entity Based Access application.

Scheduled jobs are automated pieces of work that can be performed at a specific time or on a recurring schedule. GRC administrators run the scheduled jobs on demand to automate the tasks such as setting an entity class on the entities depending on the entity class rule.

Define which issues a workflow applies to and determine the order in which it is evaluated relative to other workflows on the same table.

Set up an approval configuration record to enable multiple levels of approvals and select approvers for each level based on approval rules.

Assign one or more approval levels for the approval configuration record to support each step of approval.

Set up an approval rule for the approval level. You can define the source, filter conditions on the source table to which the approval rule is applied, approver type, and approvers in the record.

Enable or disable the Entity Based Access properties to control access to the objects that are associated with an entity.

Set up a target and populate the basic information.

Configure the Entity Based Access application by installing it from the ServiceNow Store and by setting up Entity Based Access properties in the instance.

Set up a target record to use with NIST CSF framework after you've identified a target.

The Sarbanes-Oxley (SOX) Content Pack provides basic SOX content for an organization to commence and manage activities towards attaining operational SOX compliance using the ServiceNow GRC application. A content pack may include pre-defined scope, specific policies, controls, risks, audit, test plans, dashboards, and reports providing users of ServiceNow GRC a head-start in using the applications towards SOX compliance-related activities.

Use AI agents in Governance, Risk, and Compliance to complete IT-related tasks autonomously.

Each state in a GRC state model applied to the Issue table can carry attributes that determine how an issue behaves when it reaches that state.

Summarize an issue by using the ServiceNow Otto for Integrated Risk Management (IRM) application. Use a summary to get quick context and awareness about an issue.