Policy And Compliance Management

Accept, reject, or cancel an evidence request when you receive the evidence you requested. After requesting an evidence request, when the requester receives the evidence, the requester can accept, reject, or cancel the evidence request.

After a policy has been published, you can create an acknowledgement campaign to define a group of your employees who must provide an acknowledgement that a particular policy is in compliance. When the campaign has been defined, you can submit the request to the audience.

After you have received a request to provide acknowledgement for a policy, you have the option of working with the request in the ServiceNow AI Platform, or you can perform your actions in the ServiceNow Service Portal.

After you have been identified as a member of an audience to provide a policy acknowledgement, you must open and review the record, and then acknowledge it.

When activating the common control objective creation skill, the system uses generative AI to analyze the accepted duplicate control objectives and to generate a common control objective.

You can activate the Digital Operational Resilience Act (DORA) framework from the unified content management landing page and install the associated citations into your compliance library.

The GRC: Compliance UCF (com.sn_comp_ucf) plugin is available as a separate subscription.

Enable the Control Objective Change Agent in AI Agent Studio to automate compliance workflows using generative AI.

Enable the Control Objective Impact Analyzer skill from Now Assist Skills page. When this skill is activated, the system uses Generative AI to identify control objectives that should be updated based on the modified citation details.

Activate and then configure the recommendation for a similar control objective skill under rationalization.

Add related citations to a control manually.

Add related controls to a citation manually.

Starting with Version 10.1, you can leverage new policy exception capabilities in Policy and Compliance Management from within other applications.

You can access the batch records in the content integration batch table that is displayed in the GRC: Policy and Compliance integrator application UI. By accessing these records, you can import the data into the Policy and Compliance Management application.

The Application Risk and Compliance Overview dashboard provides the current view of risk and compliance posture for the business applications that are used in an enterprise. You can now view the dashboard in Next Experience UI Framework.

Approve the evidence being provided before the requester views the evidence. When evidence is provided in response to an evidence request, the evidence may need an approval before the evidence is sent back to the requester. This ability ensures security and confidentiality of the evidence.

Approve the library import task by using the Library import task form in the GRC: Policy and Compliance integrator application.

Assign a library import task to the compliance managers assignment group by using the library import task form in the GRC: Policy and Compliance integrator application.

Before you can successfully implement or use the Policy and Compliance Management application, you must assign roles to your users.

Attestations are surveys that gather evidence to prove that a control is implemented. If the control attestation and respondents fields are selected, when the control moves from the Draft state to the Attest state, a notification is sent to the attestation respondents.

Controls are specific implementations of a control objective. Retired controls do not appear in the list. Before defining controls, take time to rationalize, consolidate, and define the important controls in your organization.

Compliance administrators can download content from Network Frontiers Unified Compliance Framework (UCF) to use as GRC authority documents, citations, controls, and control objectives. The documents can be updated on pre-defined intervals. You must have a UCF Common Controls Hub account to create shared lists and import them into the ServiceNow instance.

A direct citation-to-control mapping feature that improves compliance score accuracy and provides flexibility to manage associations between controls and citations without relying on control objectives.

Use the playbook available with Compliance Workspace to complete the publishing checklist before you request approval. If approvals are complete, then the policy is automatically published.

Two methodologies determine a citation's compliance score. The previous method averaged child citations and associated control objectives. The current method averages child citations and directly linked controls.

UCF integrates with your ServiceNow instance through an authentication process which validates your subscription.

Before you can request policy exceptions from applications other than Policy and Compliance Management, you must add a UI action for making the request and, optionally, create a new list view to see policy exception target records on the Policy Exception form.

Set up dynamic approval configuration on a policy. Based on the configured approval levels, the Policy and Compliance Management application configures one or more approval rules on the policy record.

Set up dynamic approval configuration on a policy for which redlining is enabled.

Set up the Compliance Data Source Registry (CDSR) that provides the ability to associate policies in other ServiceNow products with control objectives in Policy and Compliance.

Compliance administrators can download content from Network Frontiers Unified Compliance Framework (UCF) to use as GRC authority documents, citations, controls, and control objectives.

Connect a document that exists in your Google Drive folder to a policy that you created. Use this existing document and enable redlining in the policy text instead of creating a document.

Enable redlining in a policy document that is existing in your Microsoft OneDrive instead of creating a document in Microsoft OneDrive.

Connect a document that exists in your Microsoft SharePoint folder to a policy that you created. Use this existing document and enable redlining in the policy text instead of creating a document.

The Microsoft OneDrive Spoke connection and credential alias controls how policy authoring operations authenticate with Microsoft SharePoint and Google Drive. Understanding the alias structure helps you configure and switch between system and personal authentication.

Continuous monitoring for controls is a feature integration between the GRC: Policy and Compliance Management product and the Security Operations Configuration Compliance products. This feature integrates the scan results from third-party applications, like Qualys to determine the compliance status for each associated control.

Learn how Control Objective Change Agent automates and streamlines updates to control objectives, ensuring compliance data remains accurate and consistent with user oversight.

Explore the Control objective impact analyzer skill that evaluates citation updates and determines which associated control objectives require attention.

You can create and associate policy text for a policy record with any document that exist in Microsoft OneDrive, Google Drive, or in Microsoft SharePoint. You can sync the policy text and the document in cloud and get the latest version attached to the policy for publishing.

Attestations are surveys that gather evidence to prove that a control is implemented. Attestations document how the control is measured. This method is frequently used during the Draft and Monitor state.

When you set up a policy acknowledgement request, you must identify an audience responsible for providing the acknowledgement.

Continuous monitoring involves activities related to identifying and creating key risk and controls indicators. The Compliance Overview is available to compliance administrators and compliance managers, providing an executive view into compliance requirements, overall compliance, and compliance breakdowns.

When you are setting up the Policy Exception Integration Registry, you can define configurable questions that can be included in risk assessments created from templates. The Policy Exception Integration Registry can be associated with one template at a time.

After establishing your UCF CCH account, use the Now Support Service Portal to initiate the account integration process.

Use the Employee Center to request exceptions for policies, control objectives, controls, or issues by specifying the reason of exception on a particular list of the systems, applications, networks, or entities for which the exception applies.

Create a policy text document in Google Drive and enable document editing with the approvers, reviewers, and contributors. You can share the document with your stakeholders and collaborate on the document editing in real-time.

Create a policy text document in Microsoft OneDrive and enable document editing with the approvers, reviewers, and contributors. You can share the document with your stakeholders and collaborate on the document editing in real-time.

Enable redlining in a policy document that exists in your Microsoft SharePoint location instead of creating a document in Microsoft SharePoint and associating the document with the policy record.

Your employees and business users within your company can self-identify an issue and submit it via the ServiceNow Service Portal. Following submission, a triage issue is automatically created.

Approval rules define the criteria (risk rating, policy or control objective) that is used for sending approval requests for an exception. Rules can be configured for an application and you can identify multiple levels of approvers, as needed.

You can filter policies by specific criteria to limit the number of policies displayed when you are creating policy exceptions.

Configure granular approval rules for policy exceptions and extensions using the GRC Approval Configurator.

Enable the GRC Approval Configurator from the Policy and Compliance Properties page to allow multiple approvers for policy extension approvals, replacing the single default approver (Compliance Manager).

You can define reason choices to be available to any user who requests an exception.

The verification rule is used to verify the accuracy and completeness of a policy exception request prior to sending it out for approvals. You can define multiple levels of approvers for an application.

GRC: DevOps Accelerator is an application that enables your customers to evaluate the compliance for DevOps policies and GRC control objectives integrating with Policy as a Code Engine (PaCE).

Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

In order for compliance managers to download UCF authority documents from the UCF CCH, the list must be marked as Shared. When updating Authority Documents or adding new ones, you must update all your authority documents to ensure that the common controls framework remains in sync with the authority documents you are using.

A policy is a set of guidelines and rules established by a business organization to govern its operations. Creating an approval configuration record for a policy enables you to define one or more approval levels and approval rules based on various dynamic conditions.

Enable associations of citation to controls mapping. Enable the Citation to Control Mapping feature for more accurate compliance scoring and management.

Enable the GRC Approval Configurator from the Policy and Compliance Properties page.

Enable other applications to request policy exception from any table such as Problem or Incident and so on. The applications must be added and configured in the Integration Registry.

Configure the integration type on the Microsoft OneDrive Spoke connection credential to enable policy authoring operations to run under the logged-in user's personal credentials instead of the system account.

Compliance scores for citations dynamically change based on changes to controls and control objectives.

Connect integrates with Policy and Compliance Management providing an overlay to the standard interface, allowing users to participate in conversations while they work and collaborate on the control record.

Use the Policy as Code Engine (PaCE) policy related list in the Compliance Workspace to map the control objective with a PaCE policy. Compliance managers have the ability to map the control objectives with PaCE policies.

Generate recommendations by identifying, deduplicating, and rationalizing similar control objectives within the compliance library. This enables identification of redundant control objectives, making it easier to maintain a clean and efficient compliance library.

Users can now manage policy exceptions and extensions with granular, multi-level approval flows using the GRC Approval Configurator.

Use the Employee Center Home page to view all your requests, raise issue requests and policy exceptions, and complete all your GRC assessments.

The Compliance Overview dashboard provides an executive view into compliance requirements, overall compliance, and compliance breakdowns so areas of concern can be identified quickly.

The GRC Attestation Overview dashboard provides views attestations assigned to you, as well as pending and overdue attestations.

Platform Analytics Solutions contain preconfigured dashboards. These dashboards contain actionable data visualizations that help you improve your business processes and practices.

When you launch the 360° view from a particular compliance record, you can instantly explore the relationship between the selected record and all its associated objects in a distinctive visualization.

The Policy Exception Overview Performance Analytics dashboard provides views into the number, severity, and source of policy exceptions. It also shows exempted controls.

Set up the Governance, Risk, and Compliance Virtual Agent to request an exception to a policy or a control objective from the Service Portal.

Group the assessments that have the same entity or control objective based on metric type, and additionally the same entity, control objective, or category to provide response to similar assessments.

When you are creating an issue, you have the option of grouping the issue with other similar issues as part of an existing parent issue group.

When you are creating an issue, you have the option of grouping the issue with other similar issues.

Identify and manage control objectives impacted by latest citation updates by using the Control Objective Impact Analyzer generative AI skill.

Import the policy text as an attachment if you’re unable to do the word editing.

Install the Digital Operational Resilience Management application from the Application Manager to enable DORA framework management and compliance workflows in the Compliance Workspace.

Install the Unified Content Management application from the Application Manager to access regulatory frameworks.

You can use the GRC: Policy and Compliance integrator application module to display the details of the batch records and to import tasks. For example, you can see the content integration batch records, library import tasks, staging records, and recommendations for the records.

You can install the GRC: Policy and Compliance integrator application from the ServiceNow Store and execute the workflow to complete the data import process.

Network Frontiers Unified Compliance Framework (UCF) integrates with your ServiceNow instance through an authentication process that validates your subscription. On the UCF Configuration form, you select the type of authentication, and then enter a UCF-provided API key or a ServiceNow – provided Oauth2 client and secret.

Evidence request is used by audit and compliance teams for requesting supporting documents during an audit. Auditors and compliance teams require these documents from the first line of defense.

You can measure the effectiveness of your company's risk management program by how quickly and completely it identifies and reacts to compliance issues.

Employee Center is designed for enterprise services based on employee needs. The employee center is also called as Business user service portal as the portal is exclusively for GRC business users to request an issue triage or raise a policy exception.

Policy exceptions and extensions provide temporary relief for non-compliant controls.

Reassign overdue attestations to a member of your assignment group.

Reassign overdue issues that are assigned to your assignment group. Navigate through the record to view more details about the Control Objective, the Control record, and Remediation Tasks that are associated with an overdue issue.

Assign unassigned Policy and Compliance Management issues to a member of your assignment group. Navigate through the record to view more details about the Control Objective, the Control record, and Remediation Tasks associated with an issue.

Open the GRC Mobile application and add a ServiceNow AI Platform instance with Policy and Compliance Management to your mobile device.

Assign unassigned Policy and Compliance Management indicator tasks to a member of your assignment group. An indicator task is related to a Control record that is assigned to your compliance group.

Set additional filters to limit the number of records that are displayed on a screen. Filtering records in the mobile app works like filtering with a condition builder on the ServiceNow AI Platform.

Approve or reject pending policy approval requests that are submitted to you.

As a policy and compliance manager, use your Android or iOS mobile device to manage your work.

Approve or reject pending policy exceptions and policy exception extension requests that are assigned to you.

Assign an unassigned remediation task to a member of your group. Edit the fields including the Extend by days field. Navigate through the record to view more details about the Control Objective, the Control record, and the Issues associated with a Remediation Task.

The following checklist includes the set up tasks that you are required to complete in your ServiceNow AI Platform instance and on your mobile device prior to using the GRC Mobile application. Complete these set up tasks prior to using the GRC Mobile application to view the Policy and Compliance Management application on your mobile device.

The Assessment Overview dashboard displays various assessment reports, such as Assessable Records by Type, Total Metrics by Metric Type, and Assessments by State. You can now view the dashboard in the Next Experience UI Framework.

NIST Cybersecurity Framework Overview dashboard contains a variety of reports displayed on different dashboards, available within each of the sections in the NIST CSF process.

NIST Framework Profiling Overview dashboard contains reports within each of the sections in the NIST RMF process: Categorize, Select, Implement, Assess, Authorize, and Monitor. You can view these reports in the Next Experience UI Framework.

You can link Policy and Compliance Management content and items to Performance Analytics indicators, breakdowns, and thresholds. You can associate Performance Analytics indicators with control objectives and controls to view scorecards and trends and analyze current conditions and trends.

Policies ensure compliance and reduce exposure to risks. A policy can be of any type – it can be a policy, procedure, standard, plan, checklist, framework, or template. Publishing a policy is within its approval process.

The structural overview of Policy and Compliance Management enables you to understand how the different modules that make up the Policy and Compliance Management application of ServiceNow integrate and interact with one another.

Prior to performing application-specific setup, you need to prepare the system. This involves assigning user roles and setting properties.

Policy authoring now supports a hybrid authentication model that combines a shared system account with personal user credentials to enable document operations in Microsoft SharePoint and Google Drive.

You can view all the Knowledge base (KB) articles related to the published policies in Employee Center.

The Policy Acknowledgement dashboard gives you the acknowledgement status of the policies. It includes count of policy acknowledgements that have been accepted, declined, pending, past the due date of acknowledgement, exemptions requested, and those that are exempted.

Policies are effective when they’re carefully monitored and revised periodically. By reviewing and updating them at regular intervals, organizations can maintain updated policies to avoid audit and compliance risks.

This checklist includes the setup tasks that you are required to complete in your ServiceNow AI Platform instance. When you have completed these tasks, the base system is ready for operation. Optional setup procedures are also included to enhance GRC: Policy and Compliance Management functionality.

Use the steps in the GRC: Policy and Compliance Management application checklist to download the Policy and Compliance Management from the ServiceNow Store, and get it ready for operation. Mandatory and optional setup steps, as well as an implementation checklist are provided to simplify the setup.

The GRC: Policy and Compliance integrator application provides a common framework so that your content providers can push their content into the GRC applications. The application also enables you to review, approve, and import the data into the Policy and Compliance Management tables.

After you have assigned roles to your users and set Policy and Compliance Management properties, proceed with the mandatory setup steps.

After you have set up the Policy and Compliance Management base system, you can perform the procedures listed in the following sections to enhance the functionality of the application.

After an acknowledgement request has been sent to an audience, different reminder notifications are sent based on the timeliness and state of the response. Properties allow you to configure the notifications.

The ServiceNow Policy and Compliance Management product provides a centralized process for creating and managing policies, standards, and internal control procedures that are cross-mapped to external regulations and benchmarks. Additionally, the application provides structured workflows for the identification, assessment, and continuous monitoring of control activities.

Policies Overview dashboard provides an executive view into compliance requirements, overall compliance, and compliance breakdowns so areas of concern can be identified quickly. Users with the compliance administrator and compliance manager roles view the Policies Overview dashboard.

Certain configurations are required to be set up for policy collaborators to use the policy redlining feature in the Compliance Workspace.

Compliance managers can map the control objective with the Policy as Code Engine (PaCE). PaCE calls GRC passing the document reference and the PaCE policy for which exceptions need to be determined. Control owners can view the PaCE logs to understand the compliance or non-compliance instances.

Grant access to the users who have assigned roles to collaborate on the redlining-enabled policy.

Provide evidence when you are requested. When evidence is requested, the person who must provide the evidence receives an email. The process to provide the evidence begins.

Validate that GRC: Policy and Compliance Management still works after you make any configuration change, such as apply an upgrade or develop an application. Copy and customize these quick start tests to pass when using your instance-specific data.

Reference topics provide additional information about components that are installed with the activation of the Policy and Compliance Management plugin. These components include tables, user roles, and properties.

The Policies and Procedures module contains overview and detailed information related to policy approvals, policies, and control objectives.

The ServiceNow Policy and Compliance Management product provides a centralized process for creating and managing policies, standards, and internal control procedures that are cross-mapped to external regulations and benchmarks. Additionally, the application provides structured workflows for the identification, assessment, and continuous monitoring of control activities.

Reference topics provide information about tables, roles, and properties installed with the GRC: Policy and Compliance Management application.

After an issue has been identified, triaged, and investigated, you can remediate it.

Use the employee portal to review and work on the action plan related to the observation which is confirmed as an issue that as an auditee or issue owner you need to remediate.

Inform the audit and compliance user about the evidences that are already existing for the related items of an engagement. You can add such an evidence, if it is already existing for any of the related item table of an engagement for which you are requesting an evidence.

Request evidence at any stage during an audit. The details about the items for which evidence is requested are also provided to the person responsible for providing the evidence.

Starting with Version 10.1, you can request policy exceptions using the GRC policy exception management capability inherent in the Policy and Compliance Management application from within version 10.3 of the Vulnerability Response application.

Your employees and business users within your company can request a policy exception through the ServiceNow Service Portal.

Users can request exceptions for policies, control objectives, or issues by specifying the reason of exception on a particular list of the systems, applications, networks, or entities for which the exception will apply. The user must also specify the duration for which the exception is required.

Request an extension for the policy exception that you created.

From the ServiceNow Portal, anyone who has requested a policy exception can request an extension before the policy deadline.

After acting on the recommendations, such as accepting as duplicate, retaining as primary, or dismissing during the rationalization process, the owner sends them for review to the configured reviewers. The reviewers then analyze the actions taken and either approve or reject them, providing proper justification for their decisions.

After reviewing a policy exception request, a compliance manager can accept or reject the request. However, if the compliance manager doesn't have enough information decide, they can request a risk assessment by the risk manager.

Set properties to control various aspects and behaviors in the software.

A policy campaign is the record used to prepare for a policy acknowledgement request. It defines the audience who must provide an acknowledgement that a particular policy is in compliance. A policy campaign is requested only if the compliance user decides it is needed.

Use generative AI capabilities to support key control objective tasks within Policy and Compliance Management.

After you have created an acknowledgement campaign, you can submit the acknowledgement request to the defined audience.

You can create multiple controls for a unique combination of an entity and a control objective to get granular control information.

Update the document and view the content in the Policy text field.

Before you run GRC: Policy and Compliance Management (com.sn_compliance) in your instance, you must download it from the ServiceNow Store.

When a policy is approved, it is automatically published.

Controls are automatically generated when you associate a policy with an entity type or an entity type with a control objective. A control is created for each entity listed in the entity type for the control objective. Controls can also be manually created.

Authority documents manage a process and citations are created within them to manage points of the process. For example, the process called Building Security contains a citation for Entry Control.

A control objective is an objective, direction, or standard that acts as guidance for company interactions and operations. Control objectives can be categorized, classified, and related to policies.

Policy and Compliance managers can create templates for policy article publishing.

Usually, authority documents, citations, and control objectives are downloaded from a third-party provider. However, citations can be created manually from an authority document. The Active option in a citation indicates whether the citation is active or inactive.

The Active option in an authority document indicates whether the authority documents have been retired.

Deactivate control objectives that are no longer relevant to their citation or parent control objective.

A policy defines an internal practice that processes must follow. Policies are defined as policies, procedures, standards, plans, checklists, frameworks, and templates.

Associate the control objective to a policy individually when the policy is in the review or draft state by clicking the edit button in the Control Objective related list.

A single control objective can be mapped to many citations from different authority documents. This function allows you to test a control objective once while complying with many different citations.

Retiring a policy is part of the policy management process.

Act on the recommendations by identifying, deduplicating, and rationalizing similar control objectives within the compliance library.

After an issue has been identified and submitted by employees or business users via the Service Portal, the issue triage process begins. The actual problem is identified and assigned to the appropriate owner for prioritization and resolution.

You can eliminate duplicate citations associated with the authority documents when you receive citations from UCF content as part of the same Shared list.

The Unified content management application is a centralized library of regulatory frameworks, standards, and citations to help meet compliance requirements.

Use the Control Objective Change Agent to review and update impacted Control Objectives based on latest citation details. Users can interact with the Otto panel to review and finalize the updates.

Upload a Microsoft Word document that exists in your local machine to Google Drive and link the document with the policy. As a user, you can access the document from any device and enable multiple users to collaborate on the policy document.

Upload a Microsoft Word document that exists in your local machine to Microsoft OneDrive and link the document with the policy. As a user, you can access the document from any device and enable multiple users to collaborate on the policy document.

Upload a Microsoft Word document that exists in your local machine to Microsoft SharePoint and link the document with the policy. As a user, you can access the document from any device and enable multiple users to collaborate on the policy document.

Use the features and capabilities of the Policy and Compliance Management to create policies, control objectives, and controls, and map them to authoritative sources so you can assess and monitor compliance with regulations and industry guidelines.

If a user is assigned to an issue or a remediation task, then the manager of the user and the manager above in the hierarchy also get access to the issue or remediation task record.

You can continue to use the Classic environment to perform all Policy and Compliance Management activities.

Use the policy history related list to track the modifications made to the policy document.

The Evidence Request feature includes a related list called Related Evidence, which it not visible by default. This related list provides a list of evidence that is not directly requested for the current record, but is associated to a related record. For example, the Related Evidence list on the Control Objective form shows evidence requested for associated controls.