Request a bulk exception using GRC: Policy and Compliance Management
Select a group of vulnerable items and submit a bulk exception.
Before you begin
Before you can use the Policy Exception Integration to request bulk exceptions, you must download the GRC: Policy and Compliance Management application from the ServiceNow Store.
Note: To use this feature, you must upgrade GRC: Policy and Compliance Management before upgrading Vulnerability Response. If you have already upgraded Vulnerability Response before GRC: Policy and Compliance Management, and want to use this feature, you must perform the upgrade procedures again in the correct order.
Persona and granular roles are available to help you manage what users and groups can see and do in the Vulnerability Response application. For an initial assignment of the persona roles in Setup Assistant, see Assign the Vulnerability Response persona roles using Setup Assistant. For more information about managing granular roles, see Manage persona and granular roles for Vulnerability Response.
Role required: sn_vul.remediation_owner
You can also request exceptions in the classic environment in Vulnerability Response.
Procedure
Navigate to All > Vulnerability Response > Vulnerable Items > All and select the items that you want to request an exception for.
The selected items must be in Open, Under investigation, or Awaiting implementation state.
Click Bulk Edit.
On the form, fill in the fields.
Field Description Record selection Records that you selected for a bulk edit. State State of the vulnerable item. Select the Deferred state to request an exception for the selected items. Short description Name of the task that you are creating. Preferred solution Solution that you are targeting for remediating all the vulnerable items that you selected for bulk edit. Assignment group Assignment group for the VI. You can select a group manually or use Assignment Recommendations if that feature is enabled. Work notes Notes to be added. Click OK.
A remediation task is created with the selected vulnerable items.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Policy | Vulnerability Management policy that you are requesting an exception for. |
| Control objective | Control objectives that are associated with the policy that you selected. If a policy is not selected, all the control objectives are listed. |
| Valid from | Date when the exception will start. The default value is the current date. This date cannot be in the past. |
| Valid until | Date that the policy exception expires and the state of the vulnerable item or group changes from Deferred to Open.Note: The number of days that the policy exception is valid cannot exceed the Maximum exception duration (days) that you set for the policy in GRC: Policy and Compliance Management. For more information, see Create a policy. |
| Reason | Reason for requesting an exception. |
| Justification | Details that are related to the reason why this request is being made. This mandatory field must be filled in by the remediation owner. |
Click Submit.
For more information on the Policy Exception Integration and the hand-off between the remediation owner and the compliance manager, see Policy and Compliance Management optional setup.