GRC / IRM — Governance, Risk & Compliance (Zero → Pro)

اقرأ أولاً: ../MASTER_ALL_IN_ONE_SUMMARY.md · ../html/MASTER_ALL_IN_ONE_SUMMARY.html
الدليل الشامل: ../MASTER_ALL_IN_ONE.md · ../html/MASTER_ALL_IN_ONE.html
ممارسة الشاشات: ../html/MASTER_PRACTICE_GUIDE_ALL_TOPICS.html
Australia · Scope x_786686_hr_leave

Australia Instance — نسخة أستراليا

Direct Navigation URLs — روابط التنقل المباشرة

Platform target: ServiceNow Australia (Sep 2026) · next EA: Brazil
URLs: ../../SERVICENOW_DIRECT_URLS_CATALOG.md · 1-week: ../../SERVICENOW_ONE_WEEK_STUDY_DEPLOY_AUSTRALIA.md
HR Leave: Scope x_786686_hr_leave

CIS-RC (Risk & Compliance) Professional Implementer Guide
الأسلوب: عربية + إنجليزية تكمّلان بعضهما — بدون ترجمة حرفية لأسماء الشاشات.

ملخص ووصف بالعربية (Arabic Summary)

ملخص في سطر: من Profile وضابط وIndicator حتى Issue ومخاطr ومورد وBIA — حزمة IRM (~37 تطبيق في Application Manager).

وصف مختصر: يفرّق GRC عن IRM، يشرح كل تطبيق (Compliance، Risk، Audit Workspace، Metrics، CCM، Vendor Risk، BCM)، Application Manager، وتنفيذ 25 خطوة. الأعمق في المجلد — CIS-RC.

1) Overview & Business Value

GRC is the industry discipline (Governance, Risk, Compliance).
IRM is ServiceNow’s product name for the same capability on one platform. — GRC = مجال الأعمال (حوكمة + مخاطر + امتثال). IRM = اسم منتج ServiceNow — ليس منتجًا منافسًا لـ GRC، بل طريقة ServiceNow لتنفيذ GRC.

Read first: §1B GRC vs IRM vs Modules · §1C IRM All Apps & Implementation

ServiceNow delivers IRM as several licensed applications that share Profiles, Issues, and the GRC Workspace — not one monolithic “GRC table.”

Full IRM product catalog & per-app implementation: §1C IRM Product — All Applications

Core applications (IRM suite — see §1C for complete list):

1B) GRC vs IRM vs Modules — Clear Map

Use this section in workshops, CIS-RC study, and when the client asks: “Do we need GRC or IRM?”
الأسلوب: عربية + إنجليزية تكمّلان بعضهما في نفس السياق.

1B.1 GRC vs IRM — not “either/or”

You do not buy “GRC instead of IRM.” The client wants GRC outcomes; you implement them with ServiceNow IRM apps. — العميل يريد نتائج GRC (امتثال، مخاطر، تدقيق). أنت تُنفّذ ذلك بتطبيقات IRM على ServiceNow — الاسمان ليسا بديلين لبعض.

┌─────────────────────────────────────────────────────────┐
│ GRC (business discipline — what the board cares about) │
│ Governance · Risk · Compliance │
└──────────────────────────┬──────────────────────────────┘
 │ implemented on
 ▼
┌─────────────────────────────────────────────────────────┐
│ IRM (ServiceNow product suite — how you configure it) │
│ Shared: Profiles · Issues · Workspace · Integrations │
└─────────────────────────────────────────────────────────┘

Old vs new naming (don’t confuse the client):

1B.2 “Modules” inside IRM — each app answers a different question

These are separate Store applications / plugins with different menus, roles, and tables — but they integrate via Profiles and Issues.

العربي — سؤال واحد لكل موديول:

1B.3 How modules connect (integration — not silos)

 Profile (entity in scope: BU, app, vendor)
 │
 ┌─────────────────────┼─────────────────────┐
 ▼ ▼ ▼
 Policy & Compliance Risk Management Vendor Risk (TPRM)
 Controls · Indicators Risks · Treatment Tier · Assessment
 │ │ │
 └──────────┬──────────┴──────────┬──────────┘
 ▼ ▼
 sn_grc_issue Audit findings
 (shared remediation) (may become issues)
 │
 ▼
 BCM (critical services tied to same entity)

Without Profiles, modules feel disconnected. Profiles are the hub. — Profile = الكيان (فرع، نظام، مورد). بدون Profiles كل موديول يبدو منفصلًا.

1B.4 IRM vs other ServiceNow modules (boundaries)

ITSM = تشغيل يومي · IRM = حوكمة ومخاطر وامتثال · يتكاملان (مثلاً: Issue مرتبط بتغيير IT).

1B.5 Which modules to license first (consultant guidance)

Compliance is the most common first app (controls + attestations). Risk and TPRM often phase 2. — ابدأ بـ Policy & Compliance غالبًا، ثم Risk و TPRM حسب الأولوية.

1B.6 Quick interview answers

1C) IRM Product — All Applications, Functions & Implementation

Application Manager: When you opt into Integrated Risk Management as a ServiceNow Product, the instance installs a bundle of licensed apps (often 30–40+ apps — exact count depends on release and entitlements).

Navigate: All > System Applications > Application Manager → Integrated Risk Management — Open direct

Status on your instance: In product · Will be installed (until setup completes).

الأسلوب: عربية + إنجليزية تكمّلان بعضهما في نفس السياق.

1C.1 How IRM is installed (Application Manager vs classic activate)

Product opt-in installs many apps at once (Metrics, Audit Workspace, accelerators, integrations). You still configure each domain via Guided Setup and §12 build order.

Application Manager يثبّت حزمة IRM دفعة واحدة — التفعيل ≠ التنفيذ — تحتاج Guided Setup وترتيب §12.

Application Manager → IRM Product (opt-in)
 │
 ├─ Installs ~37 included apps (licensed bundle)
 │
 ▼
Guided Setup (GRC / IRM) + §12 implementation phases
 │
 ▼
Go-live per track: Compliance · Risk · Audit · TPRM · BCM

1C.2 IRM application catalog (by function group)

Note: App names and scope IDs vary slightly by release (Yokohama, Xanadu, etc.). Use Application Manager on your instance as source of truth. Below is the implementer map CIS-RC and projects need.

Group A — Platform & shared services (install first — foundation)

Profiles + Issues + Metrics = أساس كل IRM — لا تبدأ الضوابط قبل Profiles.

Group B — Policy & Compliance (core compliance / CCM)

Key functions (Compliance):

Group C — Risk Management

Key functions (Risk):

Group D — Audit Management

Key functions (Audit):

Group E — Vendor Risk (TPRM)

Key functions (TPRM):

Group F — Business Continuity (BCM)

Key functions (BCM):

Group G — Privacy, resilience & ESG (optional in bundle)

قد لا تكون كل هذه مرخّصة — راجع Application Manager على مثيلك.

Group H — Workspaces & executive experience

Group I — Integrations & platform features (cross-cutting)

1C.3 Apps visible in Application Manager (example from IRM product page)

Your instance Integrated Risk Management product includes licensed apps such as:

Scroll the full Included Applications (37) list in Application Manager and export/screenshot for your project’s scope document. — افتح قائمة Included Applications كاملة على مثيلك — العدد والأسماء قد تختلف — وثّقها في charter المشروع.

1C.4 Implementation order (all IRM functions — recommended)

Phase 0–1: Application Manager + Profiles (nothing else works without this)
Phase 2–3: Compliance + CCM (audit readiness)
Phase 4–5: Risk + Issues (board reporting)
Phase 6: Audit Workspace (internal audit)
Phase 7–8: TPRM + BCM (regulatory / resilience)
Phase 9–11: Dashboards + optional + go-live

1C.5 Function → app quick lookup (consultant cheat sheet)

1C.6 Post-install verification checklist

After Application Manager completes IRM install:

• [ ] All > Guided Setup > GRC / IRM opens and shows phases — Open direct
• [ ] All > Policy and Compliance menu visible — Open direct
• [ ] All > Risk menu visible — Open direct
• [ ] All > Audit menu visible (if licensed) — Open direct
• [ ] All > Vendor Risk Management visible (if licensed) — Open direct
• [ ] All > Business Continuity visible (if licensed) — Open direct
• [ ] sn_grc_metric / Metrics app functions (indicators/metrics admin)
• [ ] Audit Workspace (sn_audit_ws) opens for audit role
• [ ] /now/grc workspace loads for GRC admin
• [ ] Create test Profile → test Control → test Issue (smoke test)
• [ ] Update Set IRM Product Install captured for prod promotion

2) Architecture & Data Model

Key tables:

The GRC engine concept:

Authority Document (لائحة/معيار خارجي)
 → Citation (بند)
 → Policy / Policy Statement
 → Control (ضابط)
 → Control Test / Indicator (هل يعمل الضابط؟)
 → Issue (إن فشل) → Remediation
Profile (الكيان: تطبيق/قسم/مورد) ← يربط كل ذلك بالمخاطر
Risk → Assessment → Treatment

Profile و Profile Type أساس الربط بين كل شيء في GRC.

3) Plugins & Activation

Recommended (modern instances): §1C.1 Application Manager — opt into Integrated Risk Management product (~37 apps).
Alternative: activate individual apps below.

How to activate:

Option A — Application Manager (product):

1. Navigate: All > System Applications > Application Manager — Open direct
2. Select Integrated Risk Management → Get started
3. Wait for included applications to install (check progress %)
4. Continue: Guided Setup All > Guided Setup > GRC / IRM — Open direct

Option B — Individual apps:

1. Navigate: All > System Applications > All Available Applications > All — Open direct
2. Activate Policy and Compliance, Risk, Audit, VRM, BCM as licensed
3. Guided Setup: All > Guided Setup > GRC / IRM — Open direct

Post-install verification: §1C.6 checklist

4) Guided Setup & All Options

Sections:
- Foundation — profiles, profile types, entities.
- Authority Documents & Citations — اللوائح والبنود.
- Policies & Controls — السياسات والضوابط.
- Control Attestations & Tests — الشهادات والاختبارات.
- Risk Framework — registers, statements, assessments.
- Indicators & Continuous Monitoring — المؤشرات والمراقبة.
- Issues & Remediation — المشكلات والمعالجة.
- Audit — engagements, tasks, findings.

Important options:

5) End-to-End Process Cycle

Compliance flow:

Adopt Authority Document (e.g. ISO 27001)
 → Map Citations to Policy Statements
 → Define Controls
 → Create Profiles (entities in scope)
 → Generate Control attestations/tests
 → Run Indicators (automated checks)
 → Failures → Issues → Remediation tasks → close

Risk flow:

Identify Risk → Assess (likelihood × impact)
 → Score (inherent → residual)
 → Treatment (accept/mitigate/transfer/avoid)
 → Monitor via indicators

Audit flow:

Plan Engagement → Scope → Audit Tasks → Findings → Issues → Report

6) Development

Business Rule — auto-create issue on failed indicator

(function executeRule(current, previous) {
 // on sn_pc_indicator_result when failed
 if (current.result == 'fail') {
 var issue = new GlideRecord('sn_grc_issue');
 issue.initialize();
 issue.short_description = 'Failed control indicator: ' + current.indicator.getDisplayValue();
 issue.state = 'open';
 issue.insert();
 }
})(current, previous);

Development topics:
- Risk scoring methodologies (qualitative/quantitative).
- Indicators + Data sources (continuous monitoring).
- Assessment Designer (metrics, scales).
- Flow Designer for attestation & remediation.
- Mapping engine (authority → policy → control).

7) Administration

Key roles:
- sn_compliance.admin / manager / user.
- sn_risk.manager / user.
- sn_audit.admin / manager.
- sn_grc.* shared roles.

8) Hands-on Labs

Lab 1 — Foundation:
1. Create a Profile Type and Profiles (entities).
2. Adopt an Authority Document.

Lab 2 — Policy & Control:
1. Create a Policy with statements.
2. Create Controls and map to citations.

Lab 3 — Indicator (automated test):
1. Create an Indicator with a condition/data source.
2. Run it; observe pass/fail.

Lab 4 — Issue & Remediation:
1. From a failed control, create an Issue.
2. Add remediation tasks; close it.

Lab 5 — Risk:
1. Create a Risk, assess likelihood × impact.
2. Define treatment; track residual risk.

9) Best Practices & Common Mistakes

Best practices:
- Build Profiles first — everything links to them.
- Reuse controls across multiple authority documents.
- Automate with Indicators (continuous monitoring) vs manual attestation.
- Keep inherent vs residual risk distinct.

Common mistakes:
- إهمال Profiles فينكسر الربط بين الضوابط والمخاطر.
- خلط Policy و Control و Indicator.
- نسيان معالجة Issues فتبقى عدم المطابقة مفتوحة.

10) CIS-RC Exam Focus

High-yield:
- GRC vs IRM vs modules — see §1B (exam favorite).
- IRM Application Manager product + app groups — see §1C.
- Audit Workspace sn_audit_ws · GRC Metrics sn_grc_metric · CCM / Tech Controls Accelerator.
- GRC engine: Authority Document → Citation → Policy/Statement → Control.
- Profiles & Profile Types (scoping).
- Controls, attestations, control tests, indicators.
- Issues & remediation lifecycle.
- Risk: inherent vs residual, likelihood × impact, treatment options.
- Continuous Monitoring (indicators + data sources).
- Audit engagements, tasks, findings.
- IRM apps and their roles.

Exam tip: — احفظ سلسلة المحرّك (Authority → Citation → Policy → Control → Indicator → Issue) ودور Profile.

11) Portals, Workspaces, Role Hierarchy & Feature Catalog

ملاحظة عن الروابط:
URLs الـ Workspaces قد تختلف حسب الإصدار والـ App Config.

11.1 Portals & Self-service

11.2 Workspaces (risk/compliance/audit teams)

11.3 Role Hierarchy

admin
└─ sn_grc.admin
 ├─ sn_compliance.admin → sn_compliance.manager → sn_compliance.user
 ├─ sn_risk.admin → sn_risk.manager → sn_risk.user
 ├─ sn_audit.admin → sn_audit.manager → sn_audit.user
 ├─ sn_vdr_risk_asmt.* (Vendor Risk)
 └─ sn_grc.reader (read-only)
control_owner / risk_owner / issue_owner (ownership على السجلات)

11.4 Full Business Cycle

Adopt Authority Document (ISO/NIST/SOX...)
 → Citations → Policies → Policy Statements → Controls
 → Profiles (entities in scope: apps, depts, vendors)
 → Control attestations + Indicators (continuous monitoring)
 ↳ pass → evidence stored
 ↳ fail → Issue → Remediation tasks → re-test → close
Risk path:
 Identify Risk → Assess (likelihood × impact) → inherent→residual
 → Treatment (accept/mitigate/transfer/avoid) → monitor (indicators)
Audit path:
 Plan Engagement → scope → audit tasks → findings → Issues → report
Output → Executive risk/compliance dashboards

11.5 Feature Catalog

Maps to Application Manager apps — detail in §1C

Process features (by IRM app):
- Policy & Compliance Management (authority docs, citations, controls).
- Continuous Controls Monitoring + Technology Controls Monitoring Accelerator.
- GRC: Metrics (sn_grc_metric) — metric collection for posture dashboards.
- Risk Management (register, assessments, inherent/residual, treatments).
- Audit Management + Audit Management Workspace (sn_audit_ws).
- Vendor Risk Management (assessments, tiering).
- Business Continuity Management (BIA, plans, exercises).
- Operational Resilience / Privacy Management.
- Issue & Remediation Management.
- Regulatory Change Management (regulatory impact).
- Microsoft 365 reporting integration (sn_esg_msoff_intg) — if in bundle.

Platform features used:
- Assessment Designer (metrics, scales, scoring).
- Indicators + Data sources (automated control tests).
- Flow Designer (attestation/remediation workflows).
- Mapping engine (authority ↔ policy ↔ control).
- Performance Analytics (risk posture, compliance scores).
- Now Assist for IRM.
- Advanced Risk add-on.

12) End-to-End Implementation (Post-Activation)

اقرأ هذا بعد تفعيل Policy & Compliance + Risk + Audit.

12.1 Application Menus map

All > Policy and Compliance
 ├─ Authority Documents / Citations
 ├─ Policies / Policy Statements
 ├─ Controls / Control Objectives / Control Tests
 ├─ Indicators / Indicator Results
 ├─ Attestations
 └─ Scoping (Profiles / Profile Types)
All > Risk
 ├─ Risk Register / Risk Statements / Risk Assessments
 ├─ Risk Framework / Methodologies
 └─ Key Risk Indicators
All > Audit
 ├─ Engagements / Audit Tasks / Findings
 └─ Audit Plans
All > GRC
 ├─ Issues / Remediations
 └─ Advanced Risk / Continuous Monitoring
All > Vendor Risk Management (assessments / tiering)

12.2 Core tables to know

12.3 End-to-end build order

1. Foundation:
   - Profile Types + Profiles (entities in scope).
   All > Policy and Compliance > Scoping. — Open direct
2. Content:
   - Adopt Authority Documents → Citations.
3. Policy framework:
   - Policies → Policy Statements → Controls → map to citations.
4. Risk framework:
   - Risk methodology, registers, statements, scales.
5. Monitoring:
   - Indicators + data sources (automated control tests).
   - Attestation schedules for manual controls.
6. Issues:
   - Issue + Remediation workflow (Flow Designer).
7. Audit:
   - Audit plans → engagements → tasks → findings.
8. Vendor Risk:
   - VRM assessments + tiering (if licensed).
9. Self-service:
   - Attestation/policy-ack via /sp and /esc.
10. Workspace + Dashboards:
    - IRM/GRC Workspace /now/grc, executive dashboards.
11. Test + Deploy.

12.4 All configuration pages

Study path note: — للدراسة من الصفر اتبع: STUDY_ROADMAP.md

13) Options & Instance Notes

14) Implementation Scenarios, Options, Best Practices & Customizations

Playbook: MODULE_IMPLEMENTATION_PLAYBOOK.md → GRC

14.1 Scenarios

14.2 Options matrix

14.3 Plugins

GRC/IRM suite, Risk, Audit, Policy Compliance — Store + Guided Setup GRC/IRM

14.4 Roles

GRC admin, risk manager, compliance officer, control owner, auditor (read-heavy).

14.5 Common developments

Profile hierarchy, control libraries, indicator data sources, attestation campaigns (SP/ESC), risk remediation tasks, integration to ITSM for issues.

14.6 Best practices

Profiles mirror org structure; control owners must be named people; test indicator queries before CCM go-live.

14.7 Go-live

• [ ] Profile scope signed off
• [ ] Attestation pilot campaign
• [ ] Risk heat map validated

15) Zero-to-Hero End-to-End Implementation (Scratch → Go-Live)

Framework: MODULE_ZERO_TO_HERO_CONSULTING.md · Playbook: MODULE_IMPLEMENTATION_PLAYBOOK.md → GRC

هذا القسم يمشيك من لا تعرف GRC/IRM حتى مشروع مكتمل على ServiceNow، ويشمل IRM + BCM + TPRM.

15.1 Business goals — لماذا يشتري العميل GRC/IRM؟

Stakeholders you meet as consultant:

15.2 What is IRM vs GRC vs BCM vs TPRM? (business language)

Full map with module boundaries: §1B GRC vs IRM vs Modules

GRC — industry umbrella (Governance + Risk + Compliance). — GRC = مجال الأعمال — ليس اسم تطبيق ServiceNow فقط.

IRM — ServiceNow’s integrated platform for GRC (multiple apps, shared Profiles/Issues). — IRM = تنفيذ GRC على ServiceNow — عدة تطبيقات مترابطة.

BCM — Business Continuity: BIA, recovery plans, exercises (after disruption). — BCM = استمرارية الأعمال — BIA + خطط + تمارين.

TPRM — Third-Party Risk: vendors, SaaS, outsourcers (own app: Vendor Risk / VRM). — TPRM = مخاطر الموردين — تطبيق Vendor Risk منفصل عن Risk الداخلي.

GRC (discipline — what client wants)
 │
 ▼
IRM (ServiceNow suite)
├─ Policy & Compliance → controls, attestations, indicators ← "Am I compliant?"
├─ Risk Management → register, assess, treat ← "What could go wrong?"
├─ Audit Management → engagements, findings ← "Can auditor verify?"
├─ TPRM (Vendor Risk) → tier, assess vendors ← "Are suppliers safe?"
└─ BCM → BIA, plans, exercises ← "Can we recover?"

Do not confuse: Compliance module ≠ Risk module ≠ Audit module — separate licenses, linked by Profile and Issue. — كل موديول ترخيص وقوائم مختلفة — يربطهم Profile و Issue.

15.3 Phase 0 — Discover & scope (Week 1–2)

Workshop outputs:

Questions (Arabic discussion guide):

• ما اللوائح الإلزامية عليكم هذا العام؟
• من يوقّع على السياسات؟ من ينفّذ الضوابط؟
• كيف تُدار مخاطر الموردين اليوم؟ (Excel؟)
• هل لديكم خطة استمرارية مُختبرة؟

Out of scope examples: every vendor globally day one → start with Tier 1 only.

15.4 Phase 1 — Activate apps & environment (Week 2–3)

Plugins checklist:

15.5 Phase 2 — Foundation: Profiles & governance (Week 3–5)

Profile = الكيان الخاضع للحوكمة (تطبيق، قسم، مورد، عملية). بدون Profiles ينهار IRM.

Deliverable: Profile catalog signed by client.

15.6 Phase 3A — IRM track: Policy → Controls → Monitoring (Week 5–10)

Authority Document
 → Citations
 → Policies / Policy Statements
 → Controls (mapped to Profiles)
 → Control Tests / Attestations (manual)
 → Indicators + Data Sources (automated CCM)
 → Pass = evidence | Fail → Issue → Remediation

ServiceNow objects: sn_compliance_control, sn_pc_indicator, sn_grc_issue.

UAT scenario: Control fails indicator → Issue created → Owner remediates → Re-test pass.

15.7 Phase 3B — IRM track: Risk Management (Week 6–10)

Risk identified → Risk Assessment (likelihood × impact)
 → Inherent score → Controls applied → Residual score
 → Treatment: Accept | Mitigate | Transfer | Avoid
 → Monitor via KRI / indicators

Deliverable: Risk heat map for steering committee.

15.8 Phase 3C — TPRM track: Third-Party Risk (Week 8–12)

TPRM = من هم الموردون الحرجون؟ → تقييم → معالجة → إعادة تقييم.

Navigate: Vendor Risk Management menus · tables sn_vdr_*

Business rule: Tier 1 without assessment → no new PO (process decision).

UAT: Onboard vendor → send assessment → fail → issue → remediate.

15.9 Phase 3D — BCM track: Business Continuity (Week 10–14)

BCM = BIA (ما أثر التوقف؟) → Recovery strategies → Plans → Exercises → Lessons learned.

Link to ITSM/CMDB: Critical services = Application Services in CMDB.

UAT: Simulate outage of service X → plan activated → tasks assigned → exercise closed.

15.10 Phase 4 — Integrations & automation (Week 12–16)

15.11 Phase 5 — UAT & evidence (Week 14–18)

Consultant tip: Auditors want traceability — show record history.

15.12 Phase 6 — Go-live & hypercare (Week 18–20)

• [ ] Production plugins active
• [ ] Profiles frozen for wave 1
• [ ] First attestation wave launched
• [ ] Tier 1 vendor assessments live
• [ ] BCM plan owner trained
• [ ] Hypercare 2–4 weeks daily standup

15.13 Phase 7 — Operate & improve (ongoing)

15.14 Master checklist (Scratch → Hero)

• [ ] Phase 0 charter + frameworks
• [ ] Phase 1 apps on sub-prod
• [ ] Phase 2 Profiles + roles
• [ ] Phase 3A controls + indicators
• [ ] Phase 3B risk register
• [ ] Phase 3C TPRM tier 1
• [ ] Phase 3D BCM BIA + one exercise
• [ ] Phase 4 integrations
• [ ] Phase 5 UAT signed
• [ ] Phase 6 go-live
• [ ] Phase 7 KPIs in PA/dashboard

16) Full E2E Practice · Pages · Requirements · Options (AR + EN)

Extended reference: MODULE_FULL_E2E_PRACTICE.md · §12.4 for config pages

دورة استشارة كاملة لـ IRM + BCM + TPRM: متطلبات، كل الصفحات، خيارات A/B/C، ومختبر 25 خطوة على PDI.

16.1 Business goals & regulatory drivers

Stakeholder map (consulting):

16.2 Requirements backlog (functional)

16.3 Full consultation cycle (IRM + BCM + TPRM)

16.4 All options (A / B / C) by domain

16.5 All pages & navigation (complete map)

Policy & Compliance (IRM)

Risk

Audit

TPRM (Vendor Risk)

BCM

Cross-cutting

16.6 Full PDI practice lab (25 steps — three tracks)

Prerequisites: IRM apps installed · Update Set GRC Lab 16 · test users: control owner, risk manager, auditor (read)

Track A — IRM (steps 1–10)

Track B — Risk (steps 11–14)

Track C — TPRM (steps 15–18)

Track D — BCM (steps 19–22)

Close (steps 23–25)

16.7 UAT & sign-off scenarios

16.8 Consulting sign-off checklist

• [ ] Framework list approved (ISO/NIST/local)
• [ ] Profile list = org structure wave 1
• [ ] Every control has named owner (not group-only)
• [ ] Indicator queries tested on prod-like data volume
• [ ] Tier 1 vendor list signed by Procurement
• [ ] BIA RTO/RPO signed by business + IT
• [ ] Attestation wave 1 dates in calendar
• [ ] Training deck AR+EN for control owners
• [ ] §16.5 every page opened once in sub-prod

§17 — Power User Playbook (GRC / IRM)

17.1 Personas

17.2 Day-in-Life — Control Owner

1. Email “You have 3 attestations due in 7 days”.
2. Open Employee Center / GRC Workspace → Attestations.
3. Each attestation: review control description, upload evidence (screenshot, policy doc), answer questions, sign.
4. Submit; system validates and updates control state.

17.3 Day-in-Life — Risk Owner

1. Open Risk Register → My Risks.
2. Update inherent score after incident.
3. Add new mitigation; assign to control owner.
4. Re-score residual; if above appetite, escalate.

17.4 Top 20 GRC Scripts

1. Auto-create issue when indicator fails

// Business Rule on sn_grc_indicator (after, update)
(function (current, previous) {
 if (current.last_result.changes() && current.getValue('last_result') === 'fail') {
 var issue = new GlideRecord('sn_grc_issue');
 issue.initialize();
 issue.setValue('short_description', 'Indicator failure: ' + current.getValue('name'));
 issue.setValue('description', 'Indicator ' + current.getValue('number') +
 ' returned failure. Investigate root cause and remediate.');
 issue.setValue('source_indicator', current.getUniqueValue());
 issue.setValue('control', current.getValue('control'));
 issue.setValue('priority', _priority(current));
 issue.setValue('owner', current.getValue('control.owned_by'));
 issue.insert();
 }

function _priority(ind) {
var ctrl = new GlideRecord(‘sn_compliance_control’);
if (!ctrl.get(ind.getValue(‘control’))) return 3;
return ctrl.getValue(‘classification’) === ‘key’ ? 1 : 3;
}
})(current, previous);

2. Vendor risk score calculator

var GRCVendorScorer = Class.create();
GRCVendorScorer.prototype = {
 initialize: function {},

/* Computes vendor inherent risk based on data access, criticality, location /
score: function (vendorSysId) {
var v = new GlideRecord(‘sn_vdr_risk_asmt_vendor’);
if (!v.get(vendorSysId)) return 0;

var dataSensitivity = parseInt(v.getValue(‘data_sensitivity’), 10) || 0; // 1-5
var businessCrit = parseInt(v.getValue(‘business_criticality’), 10) || 0;
var geoRisk = this._geoRisk(v.getValue(‘country’));
var spendTier = this._spendTier(parseFloat(v.getValue(‘annual_spend’)));

var score = (dataSensitivity * 0.35) + (businessCrit * 0.30) +
(geoRisk * 0.20) + (spendTier * 0.15);
var tier = score >= 4 ? 1 : (score >= 2.5 ? 2 : 3);

v.setValue(‘inherent_risk_score’, score.toFixed(2));
v.setValue(‘tier’, tier);
v.update();
return { score: score, tier: tier };
},

_geoRisk: function (cc) {
var high = [‘AF’, ‘IR’, ‘KP’, ‘SY’, ‘YE’];
var med = [‘IN’, ‘CN’, ‘RU’, ‘BR’];
if (high.indexOf(cc) > -1) return 5;
if (med.indexOf(cc) > -1) return 3;
return 1;
},

_spendTier: function (amt) {
if (amt >= 1000000) return 5;
if (amt >= 100000) return 3;
return 1;
},

type: ‘GRCVendorScorer’
};

3. Attestation campaign launcher

function launchAttestationCampaign(frameworkSysId, dueDate) {
 var ctrl = new GlideRecord('sn_compliance_control');
 ctrl.addQuery('content.framework', frameworkSysId);
 ctrl.addActiveQuery();
 ctrl.query();

var count = 0;
while (ctrl.next()) {
var att = new GlideRecord(‘sn_compliance_control_attestation’);
att.initialize();
att.setValue(‘control’, ctrl.getUniqueValue());
att.setValue(‘attestor’, ctrl.getValue(‘owned_by’));
att.setValue(‘due_date’, dueDate);
att.setValue(‘state’, ‘pending’);
att.insert();
count++;
}
return { campaign: frameworkSysId, count: count };
}

4. Issue → Risk → Control evidence trail audit

function auditTrail(issueSysId) {
 var trail = [];
 var i = new GlideRecord('sn_grc_issue');
 if (!i.get(issueSysId)) return null;
 trail.push({ type: 'issue', id: issueSysId, num: i.getValue('number') });

if (!i.control.nil()) {
var c = new GlideRecord(‘sn_compliance_control’);
if (c.get(i.getValue(‘control’))) {
trail.push({ type: ‘control’, id: c.getUniqueValue(),
num: c.getValue(‘number’) });
var prof = new GlideRecord(‘sn_grc_profile’);
if (prof.get(c.getValue(‘profile’))) {
trail.push({ type: ‘profile’, id: prof.getUniqueValue(),
name: prof.getValue(‘name’) });
}
}
}

if (!i.risk.nil()) {
var r = new GlideRecord(‘sn_risk_risk’);
if (r.get(i.getValue(‘risk’))) {
trail.push({ type: ‘risk’, id: r.getUniqueValue(),
num: r.getValue(‘number’) });
}
}
return trail;
}

5. Policy acknowledgement bulk-enforcement

// Triggered on policy update or new hire
function enforcePolicyAck(policySysId, audienceSysIds) {
 audienceSysIds.forEach(function (userId) {
 var ack = new GlideRecord('sn_policy_acknowledgement');
 ack.initialize();
 ack.setValue('policy', policySysId);
 ack.setValue('user', userId);
 ack.setValue('state', 'pending');
 ack.setValue('due_date', _addDays(14));
 ack.insert();
 gs.eventQueue('sn_grc.policy.ack.pending', ack, policySysId, userId);
 });

function _addDays(d) {
var gd = new GlideDateTime();
gd.addDaysLocalTime(d);
return gd;
}
}

6. Residual risk = Inherent × (1 - control_effectiveness)

var GRCRiskCalculator = Class.create();
GRCRiskCalculator.prototype = {
 initialize: function {},

calcResidual: function (riskSysId) {
var r = new GlideRecord(‘sn_risk_risk’);
if (!r.get(riskSysId)) return 0;
var inherent = parseFloat(r.getValue(‘inherent_score’));
var ctrlEff = this._linkedControlsEffectiveness(riskSysId);
var residual = inherent * (1 - ctrlEff);
r.setValue(‘residual_score’, residual.toFixed(2));
r.update();
return residual;
},

_linkedControlsEffectiveness: function (riskId) {
var link = new GlideAggregate(‘sn_risk_risk_control’);
link.addQuery(‘risk’, riskId);
link.addAggregate(‘AVG’, ‘control.effectiveness_score’);
link.query();
return link.next() ?
parseFloat(link.getAggregate(‘AVG’, ‘control.effectiveness_score’)) / 100 : 0;
},

type: ‘GRCRiskCalculator’
};

7. Audit engagement workflow — engagement → finding → action → remediation evidence.

8. Continuous Monitoring scheduler — indicators run daily/weekly.

9. SOX 302/404 controls testing — quarterly walkthrough flow.

10. Privacy breach response timer — GDPR 72h notification trigger.

11-20. Quick recipes

§18 — From-Scratch Implementation (Day 0 → Day 30)

18.1 Day-by-day

Day 0 — Strategy
- Frameworks list (ISO 27001, NIST CSF, SOC2, PCI, GDPR, local reg)
- Risk appetite statement
- Lines of Defense map (1: Business, 2: Risk/Compliance, 3: Audit, +cyber, +executive)
- Compliance calendar (annual ISO audit, quarterly SOX, etc.)

Day 1 — Plugins

- com.sn_grc (Core GRC/IRM)
- com.sn_grc_policy_compliance (Policy & Compliance)
- com.sn_grc_risk (Advanced Risk)
- com.sn_grc_audit (Audit Mgmt)
- com.sn_vdr_risk_asmt (Vendor Risk)
- com.sn_bcm (Business Continuity)

Day 2-3 — Profile structure (the org)
- Business Profile (top)
- Sub-profiles per BU/Function/Process
- Each profile = sn_grc_profile record with relationships

Day 4 — Frameworks + Authoritative Content
- Import ISO 27001 content
- Import NIST CSF
- Map your control library to both (crosswalk)

Day 5-6 — Controls library
- Control objectives
- Control owners (named users, not groups)
- Control types: preventive / detective / corrective
- Classification: key / non-key

Day 7-8 — Attestation campaigns
- Annual ISO attestation
- Quarterly SOX attestation
- Monthly key control attestation
- Evidence requirements per control

Day 9-10 — Indicators (Continuous Monitoring)
- “Privileged users with no MFA” (query sys_user + auth profile)
- “Inactive accounts not disabled in 30 days”
- “Vendor without valid contract”
- “Critical asset without owner”

Day 11 — Issues workflow — auto-create from failed indicator (script #1) or attestation rejection.

Day 12 — Policies
- Policy library
- Acknowledgement workflow (mass-enforce, script #5)
- Versioning + supersession
- Exception management

Day 13-14 — Risk Register
- Risk taxonomy
- Inherent scoring (likelihood × impact, both 1-5)
- Risk treatment (Accept, Mitigate, Transfer, Avoid)
- Residual scoring (script #6)

Day 15 — Risk → Control mapping
- N:M relationship table
- Control effectiveness → impacts residual risk

Day 16-17 — Risk appetite + Heat map
- Appetite per risk category
- Heat map dashboard
- Top risks tracker

Day 18-19 — VRM (Vendor Risk)
- Vendor inventory
- Tier classification (script #2)
- Assessment questionnaires (per tier)
- Continuous monitoring (BitSight/SecurityScorecard integration)

Day 20-21 — BCM
- BIA per process
- RTO/RPO
- Recovery plans
- Tabletop exercises

Day 22 — Privacy / DPIA
- PII inventory
- DPIA template
- Breach response playbook
- 72h GDPR notification

Day 23 — Audit Management
- Engagement lifecycle
- Walkthrough → testing → finding → action → remediation
- Auditor portal

Day 24 — Dashboards
- Compliance posture (% controls passing)
- Risk heatmap
- Vendor risk distribution
- Issue burn-down
- Attestation completion

Day 25 — Now Assist for IRM
- Control description draft
- Risk narrative summary
- Audit finding triage suggestion
- Policy violation detection

Day 26 — ATF
- 10 scenarios: attestation, indicator fail → issue, risk treatment, vendor tier change, policy ack

Day 27 — Integrations
- HRIS (employees + departments → profiles)
- SIEM (security events → indicators)
- ITSM (incidents → issues)
- AD/Okta (access reviews)

Day 28 — Training
- Control owners (1h video + 30 min hands-on)
- Risk owners (½ day)
- Auditors (1 day on auditor workspace)
- Executives (board dashboard tour)

Day 29 — UAT — 15 scenarios

Day 30 — Go-live + Hypercare

18.2 KPIs Month 1

§19 — CIS-RC (GRC/IRM) Exam & Z-to-Hero Feature Labs

19.1 Exam bank

Primary: C:\SVCProject\EXAM_BANK_GRC_360.md (~120 Q, 91 KB).

19.2 Z-to-Hero Feature Labs (15 labs)

19.3 Top 15 GRC must-know concepts

1. Profile = scoping unit (BU, Process, System)
2. Authoritative Content vs Internal Policy
3. Control: named owner, classification (key/non-key), preventive/detective/corrective
4. Indicator (CCM): continuous control monitoring → pass/fail
5. Issue: opened from Indicator fail, attestation rejection, audit finding
6. Risk: Inherent vs Residual; Treatment options
7. Risk appetite per category
8. Heat map: Likelihood × Impact (5×5 default)
9. TPRM (Vendor Risk): Tier-based questionnaire frequency
10. Audit Engagement lifecycle (Plan → Field → Report)
11. Finding → Action → Remediation evidence chain
12. Attestation campaign: bulk-launch + due dates
13. Policy lifecycle: Draft → Review → Approved → Acknowledged → Reviewed
14. BCM: BIA (RTO/RPO) → Plan → Exercise → Activation
15. Lines of Defense model (Business / Risk / Audit / +Cyber / +Exec)

19.4 5 sample CIS-RC questions

Q1. Residual risk = ?
A. Inherent × (1 - control effectiveness)
B. Inherent + control effectiveness
C. Inherent / impact
D. Always equal to inherent

Answer: A

Q2. When does an Issue auto-create from an Indicator?
A. When Indicator runs successfully
B. When Indicator last_result = fail (via Business Rule)
C. Always on schedule
D. Manual only

Answer: B

Q3. Profile structure is best modeled as:
A. Flat list
B. Hierarchical aligned to org structure (BU > Function > Process)
C. By risk category
D. By geography only

Answer: B

Q4. Vendor Tier 1 means:
A. Lowest risk
B. Highest risk / most critical
C. Smallest contract
D. Newest vendor

Answer: B

Q5. Control attestation typically uses:
A. Survey table
B. sn_compliance_control_attestation records routed to control owner
C. Email only
D. Manual update to control state

Answer: B

Use EXAM_BANK_GRC_360.md for remaining 115+ questions.

19.5 What “Hero” looks like for GRC

Builds enterprise IRM: multi-framework controls, continuous monitoring with auto-issues, full risk lifecycle, tiered vendor risk, audit engagements, policy acknowledgement, BCM with BIA and exercises, privacy DPIA. Passes CIS-RC with ≥85%.

Hands-on Labs — مختبرات عملية

Step-by-step labs for PDI / Australia instance. Replace {BASE} with your instance URL.
مختبرات خطوة بخطوة — استبدل {BASE} برابط نسختك.

1. Lab 1 — Compliance Profile / ملف امتثال — Create profile at {BASE}/sn_compliance_profile_list.do for ISO 27001 scope.

2. Lab 2 — Control library / مكتبة ضوابط — Import or create controls; map to profile.

3. Lab 3 — Policy attestation / إقرار سياسة — Launch attestation campaign; track responses.

4. Lab 4 — Risk register / سجل مخاطر — Create risk at {BASE}/sn_risk_risk_list.do; score and assign owner.

5. Lab 5 — Audit engagement / تدقيق — Plan engagement at {BASE}/sn_audit_engagement_list.do; record finding.

6. Lab 6 — Vendor assessment / تقييم مورد — Run VRM assessment for critical vendor.

7. Lab 7 — BCM plan / خطة استمرارية — Create BIA and recovery plan at {BASE}/sn_bcm_plan_list.do.

8. Lab 8 — GRC Workspace / مساحة GRC — Navigate unified view at {BASE}/now/grc/home.

Best Practices — أفضل الممارسات

Deployment Checklist — قائمة النشر

Direct URLs Quick Reference