Servicenow Grc

---
name: servicenow-grc
description: "Expert agent for ServiceNow GRC (IRM). Covers Risk Management, Policy and Compliance Management, Audit Management, Vendor Risk Management, Continuous Authorization and Monitoring, integration with ITSM/SecOps, and Now Platform configuration. WHEN: \"ServiceNow GRC\", \"ServiceNow IRM\", \"ServiceNow risk\", \"ServiceNow compliance\", \"ServiceNow audit\", \"Now Platform GRC\", \"ServiceNow vendor risk\", \"Policy and Compliance ServiceNow\"."
license: MIT
---

# ServiceNow GRC

This skill covers ServiceNow Governance, Risk, and Compliance (GRC) / Integrated Risk Management (IRM), covering Risk Management, Policy and Compliance Management, Audit Management, Vendor Risk Management, and Continuous Authorization and Monitoring (CAM) applications on the Now Platform.

## How to Approach Tasks

1. **Identify the GRC application** — Risk Management, Policy and Compliance, Audit Management, Vendor Risk Management, or CAM
2. **Identify the integration scope** — standalone GRC or integrated with ITSM (incidents, changes), ITOM (discoveries), or SecOps (vulnerabilities)
3. **Classify the request:**
   - **Risk Management** — Risk registers, assessments, heat maps, treatment
   - **Policy and Compliance** — Control testing, policy distribution, compliance dashboards
   - **Audit Management** — Audit plans, engagements, findings, remediation
   - **Vendor Risk** — Vendor assessments, ongoing monitoring, fourth-party risk
   - **Configuration/Administration** — Table structure, workflows, ACLs, integration
4. **Apply Now Platform context** — ServiceNow GRC is built on the Now Platform; configuration patterns follow standard Now Platform conventions

## Platform Architecture

### Now Platform Foundation

ServiceNow GRC runs on the Now Platform:

```
Now Platform Infrastructure
├── Database: ServiceNow proprietary (Glide) — all data in tables
├── Application framework: Glide JavaScript + Flow Designer + Workflows
├── UI: Now Experience (Next Experience UI) or Classic UI
├── Integration: IntegrationHub, REST APIs, JDBC, MID Server
└── Reporting: Reports, Dashboards, Analytics Center

GRC Applications (separate installable scoped apps):
├── Risk Management (sn_risk)
│   └── Risk registers, risk assessments, risk heat maps, risk treatments
│
├── Policy and Compliance Management (sn_compliance)
│   └── Policies, controls, standards, attestations, control tests
│
├── Audit Management (sn_audit)
│   └── Audit plans, audit engagements, findings, remediation tasks
│
├── Vendor Risk Management (sn_vr)
│   └── Vendor portal, questionnaires, vendor profiles, assessment workflows
│
└── Continuous Authorization and Monitoring (sn_cam)
    └── Automated control tests, configuration monitoring, cloud compliance
```

### Integration with Other ServiceNow Applications

```
GRC ← → ITSM (IT Service Management)
  → Control failure → auto-create Incident or Change Request
  → Audit finding → auto-create Problem ticket
  → Risk treatment task → linked to Change ticket for implementation

GRC ← → SecOps (Security Operations)
  → Vulnerability findings → feed into GRC risk register
  → Security incidents → link to GRC risk events
  → Threat intelligence → inform risk assessments

GRC ← → ITOM (IT Operations Management)
  → CMDB: asset inventory feeds into GRC control scope
  → Discovery: auto-populate application inventory for control assessment
  → Configuration compliance: policy violations surface in GRC

GRC ← → HR Service Delivery
  → Employee onboarding → trigger policy attestation workflow
  → Employee offboarding → trigger access review workflow
```

## Risk Management Application

### Risk Data Model

```
Risk Framework (sn_risk_framework)
├── Risk Category
│   ├── Sub-category
│   └── Risk (sn_risk_risk)
│       ├── Risk Statement
│       ├── Risk Owner (user reference)
│       ├── Entity: Department, Business Unit, or Enterprise
│       ├── Likelihood (1-5 or custom scale)
│       ├── Impact (1-5 or custom scale)
│       ├── Inherent Risk Score = Likelihood × Impact
│       ├── Controls (linked m2m)
│       │   └── Residual risk calculation based on control effectiveness
│       ├── Risk Treatment
│       │   ├── Treatment Type: Accept / Mitigate / Transfer / Avoid
│       │   └── Remediation Tasks (linked to ITSM tasks or standalone)
│       └── Risk Response (sn_risk_response)
│           └── Response plan, owner, due date, status
```

### Risk Assessment Workflow

```
1. Create Assessment
   → Risk Management → Assessments → New
   → Type: Enterprise Risk Assessment, IT Risk, Operational Risk, etc.
   → Scope: define which entities/systems are in scope
   → Assessors: assign to stakeholders who will rate risks

2. Distribute Assessment
   → Assessors receive notification
   → Assessors log in to ServiceNow (or external portal for non-ServiceNow users)
   → Rate each risk: likelihood + impact
   → Add evidence and notes

3. Aggregate Results
   → Risk scores compiled from all assessors
   → Heat map generated: impact (Y-axis) × likelihood (X-axis)
   → Aggregation method: configurable (average, maximum, weighted)

4. Review and Finalize
   → Risk manager reviews heat map and individual ratings
   → Discusses outliers with assessors
   → Finalizes risk register for the period

5. Assign Treatments
   → For High/Critical risks: require treatment plan
   → Create risk responses: assign owner + due date
   → Link to ITSM change/task for implementation tracking
```

### Risk Heat Map

```
Heat map configuration:
  → 5×5 matrix (or 3×3, 4×4 — configurable)
  → Color zones: Green (low) / Yellow (medium) / Orange (high) / Red (critical)
  → Hover: see which risks fall in each cell
  → Click cell: drill into risks in that quadrant

Dashboard widget:
  → Risk Management homepage: embedded heat map
  → Executive dashboard: high-level summary view
  → Custom reports: trend over time (heat map evolution)
```

## Policy and Compliance Management

### Data Model

```
Compliance Framework (sn_compliance_framework)
└── Policy (sn_compliance_policy)
    └── Standard (sn_compliance_standard) ← maps to regulation/framework
        └── Control Objective (sn_compliance_control_objective)
            └── Control (sn_compliance_ctl)
                ├── Control Owner (user reference)
                ├── Control Type: Preventive / Detective / Corrective
                ├── Control Frequency: Continuous / Daily / Weekly / Monthly / Annual
                ├── Implementation Statement: how the control is implemented
                ├── Test Plans (sn_compliance_test_plan)
                │   ├── Test Steps
                │   ├── Expected Evidence
                │   └── Tester
                └── Attestations (sn_compliance_attest)
                    └── Assigned users acknowledge control or policy
```

### Framework Mapping (Regulatory Citations)

```
Map one control to multiple standards simultaneously:

Control: "MFA required for privileged accounts"
  Citations (regulatory mappings):
    → SOC 2 CC6.1 → Standard: AICPA Trust Service Criteria
    → ISO 27001 A.8.5 → Standard: ISO/IEC 27001:2022
    → PCI DSS Req 8.4.2 → Standard: PCI DSS v4.0
    → HIPAA §164.312(d) → Standard: HIPAA Security Rule
    → NIST SP 800-53 IA-2 → Standard: NIST SP 800-53

Evidence collected once → satisfies all mapped frameworks
Auditors see: which framework requirements this control addresses
```

### Control Testing

```
Test types:
  Manual test:
    → Tester manually performs test and records results
    → Evidence uploaded as attachment
    → Test result: Effective / Ineffective / In Progress / Not Tested

  Automated test (CAM integration):
    → Script or integration runs test automatically
    → Queries CMDB, cloud APIs, or ITSM data
    → Auto-records result; creates finding if ineffective

Test workflow:
  1. Test plan created and assigned to tester
  2. Tester receives notification (task in ServiceNow)
  3. Tester performs test, records results, uploads evidence
  4. Reviewer reviews test results
  5. If effective: control marked operating effectively for period
  6. If ineffective: finding created → remediation task assigned
```

### Policy Attestation

```
Attestation workflow:
  1. Policy manager creates attestation campaign
  2. Selects policy(ies) and target user population (all users, specific department)
  3. Campaign launches: users receive email notification
  4. Users navigate to policy in ServiceNow Employee Center
  5. Users read policy and click "I Acknowledge" (or provide electronic signature)
  6. Completion tracked per user with timestamp
  7. Report: % complete by department, by role

Escalation rules:
  → Reminder: 7 days before deadline if not completed
  → Manager notification: 3 days before deadline
  → Escalation to HR: on deadline if still not complete

Evidence:
  → Attestation report: downloadable CSV (user, date, policy version)
  → Attached to control as evidence artifact
```

## Audit Management Application

### Audit Lifecycle

```
Audit Planning
├── Annual Audit Universe (sn_audit_unit)
│   └── All auditable entities and processes
├── Annual Audit Plan (sn_audit_plan)
│   └── Subset of universe selected for this year
└── Resource planning

Audit Engagement (sn_audit_engagement)
├── Scope: which entities/processes/controls are audited
├── Timeline: start date, fieldwork end, draft report, final report
├── Audit Team: assigned auditors
└── Auditee: business unit under review

Fieldwork
├── Audit Tests (sn_audit_test)
│   ├── What is being tested
│   ├── Test steps
│   └── Evidence requests (sent to auditee)
│
└── Audit Findings (sn_audit_finding)
    ├── Finding title and description
    ├── Root cause analysis
    ├── Risk rating: Critical / High / Medium / Low
    ├── Recommendation
    └── Management response (auditee response)

Remediation
└── Audit Issues (sn_audit_issue)
    ├── Linked to finding
    ├── Remediation action plan
    ├── Owner and due date
    ├── Status tracking (open/in progress/closed)
    └── Evidence of remediation

Reporting
├── Draft report
├── Management review period
└── Final report (published; linked to audit engagement)
```

### Audit-GRC Integration

```
Control failures → Audit universe:
  → Controls frequently failing control tests → elevated priority in audit universe
  → Risk heat map → high-risk areas flagged for prioritized audit coverage

Audit findings → Risk register:
  → Audit finding of significance → auto-create or link to risk in Risk register
  → Finding severity drives risk score contribution

Audit findings → ITSM:
  → Finding with remediation requirement → auto-create Incident or Change Request
  → Remediation owner notified via ITSM workflow
  → GRC tracks remediation status via linked ITSM ticket
```

## Vendor Risk Management

### Vendor Assessment Workflow

```
1. Vendor Intake
   → Vendor profile created (sn_vr_vendor)
   → Data: vendor name, contacts, services, data types handled
   → Inherent risk scoring: auto-scored by data sensitivity + service criticality

2. Questionnaire Assignment
   → Based on risk tier: assign appropriate questionnaire
   → OneTrust SIG, custom questionnaire, or abbreviated form
   → Vendor portal: vendor accesses external portal (no ServiceNow license needed)

3. Questionnaire Completion
   → Vendor completes in vendor portal
   → Responses saved; reviewer notified on completion

4. Review and Risk Scoring
   → Reviewer scores responses
   → Risk findings linked to response items
   → Vendor risk score calculated

5. Approval Decision
   → Approve / Conditional Approve / Reject
   → Conditions: list of remediation items required before use

6. Ongoing Monitoring
   → Annual reassessment scheduled automatically
   → BitSight/SecurityScorecard integration: continuous external rating feed
   → Breach monitoring alerts

7. Contract Lifecycle
   → Link vendor assessment to contract record
   → DPA tracking for GDPR-relevant vendors
   → Contract renewal triggers reassessment
```

## Continuous Authorization and Monitoring (CAM)

CAM provides automated, ongoing control testing connected to live infrastructure data.

### CAM Data Sources

```
CMDB (Configuration Management Database):
  → Asset inventory: servers, databases, applications, network devices
  → Configuration items (CIs): track configuration attributes
  → ServiceNow Discovery: auto-discovers assets and updates CMDB

Cloud integrations (via IntegrationHub):
  → AWS, Azure, GCP: pull configuration state
  → Compare against baseline configuration policies
  → Flag deviations as control failures

Vulnerability management:
  → Tenable, Qualys, Rapid7 integrations
  → Vulnerability findings → map to risk/control failures in GRC

ITSM:
  → Change Management: unapproved changes = control deviation
  → Incident data: incident categories → risk indicator trends
```

### Automated Control Tests

```
Automated test example: "All production servers have current patch level"

Configuration:
  → Data source: CMDB (ServiceNow Discovery or imported)
  → Query: CIs where class=Server AND environment=Production
  → Check: last_patch_date < NOW() - 30 days
  → Result: FAIL if any server exceeds 30-day patch threshold

Execution:
  → Scheduled: runs nightly
  → Result: list of non-compliant servers + last patch dates
  → Action: auto-create ITSM incident for each non-compliant server
  → GRC: control marked ineffective if failures exceed threshold

Evidence:
  → Automated; no manual evidence upload needed
  → Audit trail: test ran at [timestamp], found [N] failures, created [N] incidents
```

## Now Platform Administration

### Table Structure for GRC

```
Key tables (for customization and reporting):
  sn_risk_risk              → Risk Register entries
  sn_risk_response          → Risk treatment plans
  sn_compliance_policy      → Policies
  sn_compliance_ctl         → Controls
  sn_compliance_test_plan   → Control test plans
  sn_compliance_attest      → Attestations
  sn_audit_engagement       → Audit engagements
  sn_audit_finding          → Audit findings
  sn_vr_vendor              → Vendor profiles
  sn_vr_assessment          → Vendor assessments

Table customization:
  → Add custom fields: Studio or Table Builder
  → Add business rules: trigger workflows on record changes
  → Add ACLs: control read/write access per role
```

### Key Roles

```
GRC roles:
  sn_risk.manager           → Manage risk register; run assessments
  sn_risk.reader            → View-only risk data
  sn_compliance.manager     → Manage policies, controls, test plans
  sn_compliance.tester      → Perform control tests
  sn_audit.manager          → Create audit plans and engagements
  sn_audit.auditor          → Perform audit fieldwork
  sn_vr.manager             → Manage vendor assessments

Custom role creation:
  → User Administration → Roles → New
  → Assign specific table-level ACLs
  → Best practice: create org-specific roles that inherit base GRC roles
```

### Workflows and Flow Designer

```
Common GRC workflows to customize:
  Risk review notification → remind risk owners 30 days before annual review
  Control failure escalation → notify compliance manager when N controls fail
  Audit finding overdue → escalate to VP if remediation past due date
  Vendor assessment reminder → notify vendor 30 days before annual reassessment

Flow Designer (recommended for new workflows):
  Trigger: Record created/updated, Schedule, or Inbound action
  Actions: Create task, Send notification, Call REST API, Update record
  Conditions: Filter when flow should execute

Classic Workflows (legacy):
  → Still supported; existing workflows should be migrated to Flow Designer
  → More complex; visual workflow canvas
```

### Reporting and Dashboards

```
Standard GRC dashboards:
  → Risk Management: heat map, top risks by score, trend
  → Compliance: control effectiveness by framework, testing coverage
  → Audit: open findings by severity, remediation age, upcoming audits
  → Vendor Risk: vendor scores, upcoming reviews, high-risk vendors

Custom reports:
  → Reports → New → Pivot / Bar / Pie / List
  → Filter by: record type, date range, owner, status
  → Schedule: email report to executives on a schedule

Performance Analytics (add-on):
  → Historical trend data (standard reports are point-in-time)
  → KPI scoring: track metric performance over time
  → Breakdown by: entity, framework, risk category
```

## Common Issues and Troubleshooting

**GRC records not visible to users:**
1. Check user has appropriate GRC role (sn_risk.reader, sn_compliance.manager, etc.)
2. Check domain separation (if instance uses domain separation — common in shared instances)
3. Check ACL rules — may be blocking specific table or field access
4. Check user's group membership — some ACLs are group-based

**Automated test not running:**
1. Verify the scheduled job is active: All Schedules → find the GRC test job
2. Check integration health: IntegrationHub → spokes for cloud provider
3. Verify MID Server is running (for on-prem integrations): MID Server → Status
4. Check system logs: System Log → All → filter by source = sn_compliance

**Attestation emails not sending:**
1. Verify email notifications are enabled on the instance
2. Check if the user has a valid email address in their profile
3. Verify the notification is active: System Notifications → All Notifications
4. Check spam/junk filters on recipient side

**Heat map not reflecting current risk scores:**
1. Verify risk scores are calculated (Business Rules should auto-calculate on save)
2. Trigger recalculation: Risk → [risk record] → recalculate score
3. Clear cache if display issue: sys_cache.do in browser
4. Check if likelihood/impact fields are populated on all risk records