ServiceNow GRC Expert

Platform Architecture

Now Platform Foundation

ServiceNow GRC runs on the Now Platform:

Now Platform Infrastructure
├── Database: ServiceNow proprietary (Glide) — all data in tables
├── Application framework: Glide JavaScript + Flow Designer + Workflows
├── UI: Now Experience (Next Experience UI) or Classic UI
├── Integration: IntegrationHub, REST APIs, JDBC, MID Server
└── Reporting: Reports, Dashboards, Analytics Center

GRC Applications (separate installable scoped apps):
├── Risk Management (sn_risk)
│   └── Risk registers, risk assessments, risk heat maps, risk treatments
│
├── Policy and Compliance Management (sn_compliance)
│   └── Policies, controls, standards, attestations, control tests
│
├── Audit Management (sn_audit)
│   └── Audit plans, audit engagements, findings, remediation tasks
│
├── Vendor Risk Management (sn_vr)
│   └── Vendor portal, questionnaires, vendor profiles, assessment workflows
│
└── Continuous Authorization and Monitoring (sn_cam)
    └── Automated control tests, configuration monitoring, cloud compliance

Integration with Other ServiceNow Applications

GRC ← → ITSM (IT Service Management)
  → Control failure → auto-create Incident or Change Request
  → Audit finding → auto-create Problem ticket
  → Risk treatment task → linked to Change ticket for implementation

GRC ← → SecOps (Security Operations)
  → Vulnerability findings → feed into GRC risk register
  → Security incidents → link to GRC risk events
  → Threat intelligence → inform risk assessments

GRC ← → ITOM (IT Operations Management)
  → CMDB: asset inventory feeds into GRC control scope
  → Discovery: auto-populate application inventory for control assessment
  → Configuration compliance: policy violations surface in GRC

GRC ← → HR Service Delivery
  → Employee onboarding → trigger policy attestation workflow
  → Employee offboarding → trigger access review workflow

Risk Management Application

Risk Data Model

Risk Framework (sn_risk_framework)
├── Risk Category
│   ├── Sub-category
│   └── Risk (sn_risk_risk)
│       ├── Risk Statement
│       ├── Risk Owner (user reference)
│       ├── Entity: Department, Business Unit, or Enterprise
│       ├── Likelihood (1-5 or custom scale)
│       ├── Impact (1-5 or custom scale)
│       ├── Inherent Risk Score = Likelihood × Impact
│       ├── Controls (linked m2m)
│       │   └── Residual risk calculation based on control effectiveness
│       ├── Risk Treatment
│       │   ├── Treatment Type: Accept / Mitigate / Transfer / Avoid
│       │   └── Remediation Tasks (linked to ITSM tasks or standalone)
│       └── Risk Response (sn_risk_response)
│           └── Response plan, owner, due date, status

Risk Assessment Workflow

1. Create Assessment
   → Risk Management → Assessments → New
   → Type: Enterprise Risk Assessment, IT Risk, Operational Risk, etc.
   → Scope: define which entities/systems are in scope
   → Assessors: assign to stakeholders who will rate risks

2. Distribute Assessment
   → Assessors receive notification
   → Assessors log in to ServiceNow (or external portal for non-ServiceNow users)
   → Rate each risk: likelihood + impact
   → Add evidence and notes

3. Aggregate Results
   → Risk scores compiled from all assessors
   → Heat map generated: impact (Y-axis) × likelihood (X-axis)
   → Aggregation method: configurable (average, maximum, weighted)

4. Review and Finalize
   → Risk manager reviews heat map and individual ratings
   → Discusses outliers with assessors
   → Finalizes risk register for the period

5. Assign Treatments
   → For High/Critical risks: require treatment plan
   → Create risk responses: assign owner + due date
   → Link to ITSM change/task for implementation tracking

Risk Heat Map

Heat map configuration:
  → 5×5 matrix (or 3×3, 4×4 — configurable)
  → Color zones: Green (low) / Yellow (medium) / Orange (high) / Red (critical)
  → Hover: see which risks fall in each cell
  → Click cell: drill into risks in that quadrant

Dashboard widget:
  → Risk Management homepage: embedded heat map
  → Executive dashboard: high-level summary view
  → Custom reports: trend over time (heat map evolution)

Policy and Compliance Management

Data Model

Compliance Framework (sn_compliance_framework)
└── Policy (sn_compliance_policy)
    └── Standard (sn_compliance_standard) ← maps to regulation/framework
        └── Control Objective (sn_compliance_control_objective)
            └── Control (sn_compliance_ctl)
                ├── Control Owner (user reference)
                ├── Control Type: Preventive / Detective / Corrective
                ├── Control Frequency: Continuous / Daily / Weekly / Monthly / Annual
                ├── Implementation Statement: how the control is implemented
                ├── Test Plans (sn_compliance_test_plan)
                │   ├── Test Steps
                │   ├── Expected Evidence
                │   └── Tester
                └── Attestations (sn_compliance_attest)
                    └── Assigned users acknowledge control or policy

Framework Mapping (Regulatory Citations)

Map one control to multiple standards simultaneously:

Control: "MFA required for privileged accounts"
  Citations (regulatory mappings):
    → SOC 2 CC6.1 → Standard: AICPA Trust Service Criteria
    → ISO 27001 A.8.5 → Standard: ISO/IEC 27001:2022
    → PCI DSS Req 8.4.2 → Standard: PCI DSS v4.0
    → HIPAA §164.312(d) → Standard: HIPAA Security Rule
    → NIST SP 800-53 IA-2 → Standard: NIST SP 800-53

Evidence collected once → satisfies all mapped frameworks
Auditors see: which framework requirements this control addresses

Control Testing

Test types:
  Manual test:
    → Tester manually performs test and records results
    → Evidence uploaded as attachment
    → Test result: Effective / Ineffective / In Progress / Not Tested

  Automated test (CAM integration):
    → Script or integration runs test automatically
    → Queries CMDB, cloud APIs, or ITSM data
    → Auto-records result; creates finding if ineffective

Test workflow:
  1. Test plan created and assigned to tester
  2. Tester receives notification (task in ServiceNow)
  3. Tester performs test, records results, uploads evidence
  4. Reviewer reviews test results
  5. If effective: control marked operating effectively for period
  6. If ineffective: finding created → remediation task assigned

Policy Attestation

Attestation workflow:
  1. Policy manager creates attestation campaign
  2. Selects policy(ies) and target user population (all users, specific department)
  3. Campaign launches: users receive email notification
  4. Users navigate to policy in ServiceNow Employee Center
  5. Users read policy and click "I Acknowledge" (or provide electronic signature)
  6. Completion tracked per user with timestamp
  7. Report: % complete by department, by role

Escalation rules:
  → Reminder: 7 days before deadline if not completed
  → Manager notification: 3 days before deadline
  → Escalation to HR: on deadline if still not complete

Evidence:
  → Attestation report: downloadable CSV (user, date, policy version)
  → Attached to control as evidence artifact

Audit Management Application

Audit Lifecycle

Audit Planning
├── Annual Audit Universe (sn_audit_unit)
│   └── All auditable entities and processes
├── Annual Audit Plan (sn_audit_plan)
│   └── Subset of universe selected for this year
└── Resource planning

Audit Engagement (sn_audit_engagement)
├── Scope: which entities/processes/controls are audited
├── Timeline: start date, fieldwork end, draft report, final report
├── Audit Team: assigned auditors
└── Auditee: business unit under review

Fieldwork
├── Audit Tests (sn_audit_test)
│   ├── What is being tested
│   ├── Test steps
│   └── Evidence requests (sent to auditee)
│
└── Audit Findings (sn_audit_finding)
    ├── Finding title and description
    ├── Root cause analysis
    ├── Risk rating: Critical / High / Medium / Low
    ├── Recommendation
    └── Management response (auditee response)

Remediation
└── Audit Issues (sn_audit_issue)
    ├── Linked to finding
    ├── Remediation action plan
    ├── Owner and due date
    ├── Status tracking (open/in progress/closed)
    └── Evidence of remediation

Reporting
├── Draft report
├── Management review period
└── Final report (published; linked to audit engagement)

Audit-GRC Integration

Control failures → Audit universe:
  → Controls frequently failing control tests → elevated priority in audit universe
  → Risk heat map → high-risk areas flagged for prioritized audit coverage

Audit findings → Risk register:
  → Audit finding of significance → auto-create or link to risk in Risk register
  → Finding severity drives risk score contribution

Audit findings → ITSM:
  → Finding with remediation requirement → auto-create Incident or Change Request
  → Remediation owner notified via ITSM workflow
  → GRC tracks remediation status via linked ITSM ticket

Vendor Risk Management

Vendor Assessment Workflow

1. Vendor Intake
   → Vendor profile created (sn_vr_vendor)
   → Data: vendor name, contacts, services, data types handled
   → Inherent risk scoring: auto-scored by data sensitivity + service criticality

2. Questionnaire Assignment
   → Based on risk tier: assign appropriate questionnaire
   → OneTrust SIG, custom questionnaire, or abbreviated form
   → Vendor portal: vendor accesses external portal (no ServiceNow license needed)

3. Questionnaire Completion
   → Vendor completes in vendor portal
   → Responses saved; reviewer notified on completion

4. Review and Risk Scoring
   → Reviewer scores responses
   → Risk findings linked to response items
   → Vendor risk score calculated

5. Approval Decision
   → Approve / Conditional Approve / Reject
   → Conditions: list of remediation items required before use

6. Ongoing Monitoring
   → Annual reassessment scheduled automatically
   → BitSight/SecurityScorecard integration: continuous external rating feed
   → Breach monitoring alerts

7. Contract Lifecycle
   → Link vendor assessment to contract record
   → DPA tracking for GDPR-relevant vendors
   → Contract renewal triggers reassessment

Continuous Authorization and Monitoring (CAM)

CAM provides automated, ongoing control testing connected to live infrastructure data.

CAM Data Sources

CMDB (Configuration Management Database):
  → Asset inventory: servers, databases, applications, network devices
  → Configuration items (CIs): track configuration attributes
  → ServiceNow Discovery: auto-discovers assets and updates CMDB

Cloud integrations (via IntegrationHub):
  → AWS, Azure, GCP: pull configuration state
  → Compare against baseline configuration policies
  → Flag deviations as control failures

Vulnerability management:
  → Tenable, Qualys, Rapid7 integrations
  → Vulnerability findings → map to risk/control failures in GRC

ITSM:
  → Change Management: unapproved changes = control deviation
  → Incident data: incident categories → risk indicator trends

Automated Control Tests

Automated test example: "All production servers have current patch level"

Configuration:
  → Data source: CMDB (ServiceNow Discovery or imported)
  → Query: CIs where class=Server AND environment=Production
  → Check: last_patch_date < NOW() - 30 days
  → Result: FAIL if any server exceeds 30-day patch threshold

Execution:
  → Scheduled: runs nightly
  → Result: list of non-compliant servers + last patch dates
  → Action: auto-create ITSM incident for each non-compliant server
  → GRC: control marked ineffective if failures exceed threshold

Evidence:
  → Automated; no manual evidence upload needed
  → Audit trail: test ran at [timestamp], found [N] failures, created [N] incidents

Now Platform Administration

Table Structure for GRC

Key tables (for customization and reporting):
  sn_risk_risk              → Risk Register entries
  sn_risk_response          → Risk treatment plans
  sn_compliance_policy      → Policies
  sn_compliance_ctl         → Controls
  sn_compliance_test_plan   → Control test plans
  sn_compliance_attest      → Attestations
  sn_audit_engagement       → Audit engagements
  sn_audit_finding          → Audit findings
  sn_vr_vendor              → Vendor profiles
  sn_vr_assessment          → Vendor assessments

Table customization:
  → Add custom fields: Studio or Table Builder
  → Add business rules: trigger workflows on record changes
  → Add ACLs: control read/write access per role

Key Roles

GRC roles:
  sn_risk.manager           → Manage risk register; run assessments
  sn_risk.reader            → View-only risk data
  sn_compliance.manager     → Manage policies, controls, test plans
  sn_compliance.tester      → Perform control tests
  sn_audit.manager          → Create audit plans and engagements
  sn_audit.auditor          → Perform audit fieldwork
  sn_vr.manager             → Manage vendor assessments

Custom role creation:
  → User Administration → Roles → New
  → Assign specific table-level ACLs
  → Best practice: create org-specific roles that inherit base GRC roles

Workflows and Flow Designer

Common GRC workflows to customize:
  Risk review notification → remind risk owners 30 days before annual review
  Control failure escalation → notify compliance manager when N controls fail
  Audit finding overdue → escalate to VP if remediation past due date
  Vendor assessment reminder → notify vendor 30 days before annual reassessment

Flow Designer (recommended for new workflows):
  Trigger: Record created/updated, Schedule, or Inbound action
  Actions: Create task, Send notification, Call REST API, Update record
  Conditions: Filter when flow should execute

Classic Workflows (legacy):
  → Still supported; existing workflows should be migrated to Flow Designer
  → More complex; visual workflow canvas

Reporting and Dashboards

Standard GRC dashboards:
  → Risk Management: heat map, top risks by score, trend
  → Compliance: control effectiveness by framework, testing coverage
  → Audit: open findings by severity, remediation age, upcoming audits
  → Vendor Risk: vendor scores, upcoming reviews, high-risk vendors

Custom reports:
  → Reports → New → Pivot / Bar / Pie / List
  → Filter by: record type, date range, owner, status
  → Schedule: email report to executives on a schedule

Performance Analytics (add-on):
  → Historical trend data (standard reports are point-in-time)
  → KPI scoring: track metric performance over time
  → Breakdown by: entity, framework, risk category

Common Issues and Troubleshooting

GRC records not visible to users:

1. Check user has appropriate GRC role (sn_risk.reader, sn_compliance.manager, etc.)
2. Check domain separation (if instance uses domain separation — common in shared instances)
3. Check ACL rules — may be blocking specific table or field access
4. Check user's group membership — some ACLs are group-based

Automated test not running:

1. Verify the scheduled job is active: All Schedules → find the GRC test job
2. Check integration health: IntegrationHub → spokes for cloud provider
3. Verify MID Server is running (for on-prem integrations): MID Server → Status
4. Check system logs: System Log → All → filter by source = sn_compliance

Attestation emails not sending:

1. Verify email notifications are enabled on the instance
2. Check if the user has a valid email address in their profile
3. Verify the notification is active: System Notifications → All Notifications
4. Check spam/junk filters on recipient side

Heat map not reflecting current risk scores:

1. Verify risk scores are calculated (Business Rules should auto-calculate on save)
2. Trigger recalculation: Risk → [risk record] → recalculate score
3. Clear cache if display issue: sys_cache.do in browser
4. Check if likelihood/impact fields are populated on all risk records