CIS-RC: Certified Implementation Specialist - Risk and ComplianceDemo

The Risk Statement table, sn_risk_definition, extends the ServiceNow Content table and stores risk definitions. Risk Framework extends the Document table, while Risk extends the Item table. ServiceNow: Tables installed with Risk Management

A GRC implementation needs ServiceNow platform expertise for configuration, a business analyst to translate process requirements, risk and compliance expertise to define the GRC content and operating processes, and the CMDB process owner to align the implementation with foundational configuration data. Board members and the chief executive provide sponsorship and governance rather than direct implementation participation.

Regulatory Change Management uses an assessment template when a regulatory assessment is initiated. The dedicated Impact Assessment Templates module is where that template is configured; Risk Assessment Methodologies and Risk Assessment Templates apply to risk assessments, while Flow Designer controls automation rather than template definition.

Indicator templates can use source and supporting-data tables in the customer instance. ServiceNow does not limit them to GRC tables, custom tables, or baseline tables; basic indicators collect from a source table, and scripted indicators can collect from multiple source tables.

ServiceNow permits policy creation for Compliance Managers and explicitly permits users with the Compliance User role to create policies. Audit User, Risk User, and Compliance Reader do not grant this policy-creation permission.

A control objective can be referred to as a policy statement or a control requirement. ServiceNow’s Policy and Compliance Management data model identifies the control-objective record as sn_compliance_policy_statement, while control requirements represent the requirements associated with compliance controls.

Control compliance status recalculates associated citation compliance scores. Those scores roll up through the compliance hierarchy to authority documents and policies, so the affected record types are citations, authority documents, and policies.

ServiceNow permits entity types to be created and edited by users with either the Compliance Manager (sn_compliance.manager) role or the Risk Manager (sn_risk.manager) role. Administrator roles also have access but are higher-privilege roles, so they are not the minimum required roles.

The ServiceNow External Auditor role (sn_audit.external_auditor) allows external auditors to view published policies and controls when Policy and Compliance Management is installed. It is designed for external audit access while limiting access to the audit work relevant to them.

Risk criteria define the likelihood and impact scoring values and their thresholds. ServiceNow Risk Management allows administrators to customize risk criteria so the matrix’s scoring thresholds reflect the organization’s risk methodology and tolerances.

The Risk Assessment Methodology (RAM) record controls Advanced Risk Assessment configuration and process behavior, including whether a risk response is required. Group factors define assessment criteria, and inherent or residual risk assessments hold assessment results rather than response requirements.

The GDPR’s territorial scope covers processing of personal data of individuals in the European Union, including certain processing by organizations not established in the EU. GDPR, Article 3

Annualized Loss Expectancy is calculated as Single Loss Expectancy multiplied by the Annual Rate of Occurrence. A $1,000,000 loss expected at a 20% annual occurrence rate produces an ALE of $200,000.

GRC properties exposed through Policy and Compliance are configuration records owned by the GRC: Profiles scoped application. ServiceNow’s GRC properties documentation identifies applicable properties as being in that scope.

Access to policy redlining document tables requires the mp_document_user role; it provides the document-user access needed for those tables.

A ServiceNow Advanced Risk RAM can enable inherent-risk, control-effectiveness, residual-risk, and target-risk assessments. Therefore, the listed supported types are Inherent Assessment, Control Assessment, and Residual Assessment.

GRC suites centralize risk, compliance, and control information to improve efficiency, provide integrated reporting and transparency, and support standardized workflow-driven processes. ServiceNow describes GRC as providing centralized dashboards and reporting, while workflow automation helps complete compliance tasks consistently and on time.

ServiceNow’s policy lifecycle includes the Review state, where designated reviewers evaluate and update the policy, and the Published state, where the approved policy becomes active. Policy acknowledgement is a separate process rather than a policy lifecycle state.

In ServiceNow Advanced Risk, the setting that mandates a risk response is configured on the Risk Assessment Methodology (RAM) record, within its risk-response configuration. The methodology controls the assessment workflow and response requirements.

GRC Business User Lite users can update GRC issues assigned to them or their group and can approve advanced risk assessments. Advanced-risk-assessment approval requires the appropriate approver role to be added to the Lite role configuration.

The Technology Controls Monitoring Accelerator provides predefined indicator templates mapped to CIS Controls. The associated Cybersecurity Controls content includes CIS citations and CIS control objectives, establishing CIS Controls as the citation set directly associated with the indicator templates.

ServiceNow GRC Risk Management includes the Risk Reader, Risk User, and Risk Manager roles. “Risk Developer” is not a standard installed Risk Management role.

In ServiceNow Policy and Compliance Management, control objectives are mapped many-to-many to citations through the Control Objective to Citation table. Control objectives can also be associated with policies through a many-to-many relationship, allowing a policy to contain multiple control objectives and a control objective to support multiple policies.

A workflow defines and automates approval stages, including a second, sequential layer of approval for each policy.