Risk and Compliance Dashboard reports and solutions
The Risk and Compliance dashboard is a unified dashboard that provides a comprehensive analytical data of reports available from the major GRC applications for the chief information security officer to understand the compliance and risk posture of the organization. The dashboard consolidates data from various products within the ServiceNow GRC suite of applications.
Note: All reports are available only when the corresponding workspaces are installed.
Image omitted: ced-risk-compliance-grc-db-washingtondc.gif
Video showing the reports available in the different tabs of the Risk and compliance dashboard.
Video showing the reports available in the different tabs of the Risk and compliance dashboard.
Required ServiceNow AI Platform roles
For Compliance related reports
User must have sn_grc_dashboards.grc_ciso_user role and sn_bod.ciso role.
For Risk related reports
User must have sn_grc_dashboards.grc_ciso_user role and sn_bod.ciso role.
For Business Continuity Management related reports
User must have sn_bcm.viewer role and sn_bod.ciso role.
For Third-party risk related reports
User must have sn_vdr_risk_asmt.vendor_assessment_reviewer role and sn_bod.ciso role.
For Privacy related reports
User must have sn_privacy.analyst role and sn_bod.ciso role.
For Audit related reports
User must have sn_audit_ws.auditor role and sn_bod.ciso role.
Access the Risk and Compliance Dashboard
To open the dashboard, navigate to All > Cybersecurity Executive Dashboard > Cybersecurity Executive Dashboard.
Indicators
- Compliance posture
- Compliance percentage: Formula indicator that depicts compliance posture.
- All Controls: Automated indicator that supports the formula indicator.
- Compliant Controls: Automated indicator that supports the formula indicator.
Privacy compliance posture
PA indicator: Processing activity compliance score percentage.
Breakdowns
Functional Domain.
Reports
Note: All reports are available only when the corresponding workspaces are installed.
| Title | Type | Source table | Description |
|---|---|---|---|
| Compliance posture | Line chart Image omitted: line-icon.png Line icon. | Control \[sn\_compliance\_control\] | Provides cybersecurity and risk, and IT risk and compliance posture based on data analysis to the compliance managers. |
| Risk posture | Donut chart Image omitted: donut-icon.png Donut icon. | The source tables are as follows: - Risk \[sn\_risk\_risk\] - Detailed aggregated risk \[sn\_risk\_advanced\_risk\_assessment\_result\] \(When the Advanced Risk application is installed and Advanced Risk Assessment is enabled | Provides the risk count based on the risk ratings. |
| Ongoing crisis events | Single Score Image omitted: single-score.png Single-score icon. | Recovery event \[sn\_recovery\_event\] where event type is actual | Displays the total number of ongoing crisis events that are neither approved nor closed. |
| Assets by recovery status | Donut chart Image omitted: donut-icon.png Donut icon. | Assets \[sn\_recovery\_event\_asset\] | Provides the total number of assets for ongoing crisis events grouped by their recovery status, including assets that have been recovered and those that have not. |
| Recovery tasks by status | Donut chart Image omitted: donut-icon.png Donut icon. | Recovery tasks \[sn\_recovery\_event\_task\] | Provides the status of recovery tasks in various states for ongoing crisis events. |
| Title | Type | Source table | Description |
|---|---|---|---|
| Authority documents | Donut chart |
Image omitted: donut-icon.png
Donut icon.|Authority Document \[sn\_compliance\_authority\_document\]|Provides data of compliant and non-compliant authority documents in the chart. The list provides details of the authority documents, their individual compliance score in percentage, count of high priority issues and high risk exceptions on the authority documents, and the count of compliant cases.|
Donut icon.|Authority Document \[sn\_compliance\_authority\_document\]|Provides data of compliant and non-compliant authority documents in the chart. The list provides details of the authority documents, their individual compliance score in percentage, count of high priority issues and high risk exceptions on the authority documents, and the count of compliant cases.|
|Policies|Donut chart
Image omitted: donut-icon.png
Donut icon.|Policy \[sn\_compliance\_policy\]|Provides the count of compliant and non-compliant policies in the chart. The list provides details of the policies, their individual compliance score in percentage, count of high priority issues and risk exceptions raised on each policy, and the count of compliant cases.|
Donut icon.|Policy \[sn\_compliance\_policy\]|Provides the count of compliant and non-compliant policies in the chart. The list provides details of the policies, their individual compliance score in percentage, count of high priority issues and risk exceptions raised on each policy, and the count of compliant cases.|
| Title | Type | Source table | Description |
|---|---|---|---|
| Risk posture | Donut chart Image omitted: donut-icon.png Donut icon. | The source tables are as follows: - Risk \[sn\_risk\_risk\] - Detailed aggregated risk \[sn\_risk\_advanced\_risk\_assessment\_result\] \(When the Advanced Risk application is installed and Advanced Risk Assessment is enabled\) | Provides the risk count based on the risk ratings. |
| Risk posture | List Image omitted: scorecard-icon.png List icon. | GRC Content Status \[sn\_grc\_content\_reports\] | Provides the risk rating for each organizational risk to understand the overall risk assessment results. These ratings help organizations understand the potential impact and likelihood of various risks, enabling them to prioritize and manage these risks. The Risk posture card also highlights the following information for each risk:- Risk appetite: Risk appetite value defined. - High priority issues: The number of issues with priority is defined as High. - Overdue risk response tasks: Number of overdue risk response tasks. - KRI Breach %: Percentage of Key Risk Indicators (KRIs) that have exceeded their predefined thresholds or limits. |
| Third-party risk posture | Donut chart Image omitted: donut-icon.png Donut icon. | Third-party risks \[sn\_grc\_dashboards\_third\_party\_risk\] | Provides the risk rating for each third party. The risk rating is the overall assessment rating that considers the scores and ratings from all assessments conducted for a third party or vendor. The Third-party risk posture card also highlights the following information for each third party or vendor:- Risk criteria: Group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party. - Risk tier: Value determined based on the responses collected after an inherent risk assessment (IRQ) is completed. - Risk intelligence rating: Aggregate of all the scores collected from Risk intelligence providers. - Overdue risk response tasks: Number of overdue risk response tasks. |
| Title | Type | Source table | Description |
|---|---|---|---|
| Privacy compliance posture | Line |
Image omitted: line-icon.png
Line icon|PA indicator: Processing activity compliance score percentage \[pa\_indicators\]|Provides the compliance posture by month and is plotted by referring to the overall compliance score across all the processing activities.|
Line icon|PA indicator: Processing activity compliance score percentage \[pa\_indicators\]|Provides the compliance posture by month and is plotted by referring to the overall compliance score across all the processing activities.|
|Overdue high priority issues|Single score
Image omitted: single-score.png
Single score|Issues \[sn\_grc\_issue\]|Provides a focused overview of all overdue high-priority privacy-related issues, enabling quick identification and resolution of critical tasks to ensure compliance and data protection.|
Single score|Issues \[sn\_grc\_issue\]|Provides a focused overview of all overdue high-priority privacy-related issues, enabling quick identification and resolution of critical tasks to ensure compliance and data protection.|
|Privacy risk heatmap|Heatmap
Image omitted: heatmap.png
Heatmap icon|Risk assessment methodology \[sn\_risk\_advanced\_risk\_assessment\_methodology\]|Provides the privacy risk assessment data in the form of a heatmap. Privacy risk assessments are detailed assessments that are conducted if the criticality score is high. Assess each risk that is associated with the processing activity and know the aggregated risk score on the processing activity. After you assess the privacy risks, you can view the privacy risk posture on the risk heatmap.|
Heatmap icon|Risk assessment methodology \[sn\_risk\_advanced\_risk\_assessment\_methodology\]|Provides the privacy risk assessment data in the form of a heatmap. Privacy risk assessments are detailed assessments that are conducted if the criticality score is high. Assess each risk that is associated with the processing activity and know the aggregated risk score on the processing activity. After you assess the privacy risks, you can view the privacy risk posture on the risk heatmap.|
| Title | Type | Source table | Description |
|---|---|---|---|
| Entities | List |
Image omitted: scorecard-icon.png
List icon.|Entity compliance status \[sn\_compliance\_entities\_reports\]|Provides the summary of risks directly associated with the entity that contribute to the overall risk rating of the entity. The list also displays the compliance score of entities, and high priority issues and risk exceptions that are raised as a result of the non-compliant controls associated with the entity.|
List icon.|Entity compliance status \[sn\_compliance\_entities\_reports\]|Provides the summary of risks directly associated with the entity that contribute to the overall risk rating of the entity. The list also displays the compliance score of entities, and high priority issues and risk exceptions that are raised as a result of the non-compliant controls associated with the entity.|
| Title | Type | Source table | Description |
|---|---|---|---|
| Open and upcoming audit engagements | List |
Image omitted: scorecard-icon.png
List icon.|Engagement \[sn\_audit\_engagement\]|Provides a list of open and upcoming audit engagements. The list also provides details of the engagement lead for each authority document, each engagement's planned start and end dates, high-priority issues, percentage of fieldwork that is completed, and the milestones in progress.|
List icon.|Engagement \[sn\_audit\_engagement\]|Provides a list of open and upcoming audit engagements. The list also provides details of the engagement lead for each authority document, each engagement's planned start and end dates, high-priority issues, percentage of fieldwork that is completed, and the milestones in progress.|
Filters
| Name | Type | Description |
|---|---|---|
| Risk criteria | Report | Depending on which risk criterias you select, the donut chart and list shows the third parties or vendors that are in those risk areas. |