so hello everyone welcome charles rayburn i am a customer success advocate here at servicenow we have these office hours and i've been doing them since the start of this year this is office hour number 16 and it's due to the topics that you as customers bring up in your conversations with your success advocates in your check-ins quarterly or monthly so just remember as you bring up specific needs make sure to remind them in your conversations how well did you like the office hour if there's other topics you want to see we'll try to make that happen um but today's office hour is going to be a two-part mini-series so session number one all about grc um planning and lining for grc implementation we have two rockstar subject matter experts here rick smith and jorgen who are going to go dragon road who's going to go over a couple of key areas they are practitioners in this area some of them we have already talked with them due to some special setups that we had like one-on-one sessions things like that so the goal of these office hours is to cover the topic during the first 20 minutes where the subreddit expert will talk about the topic the remaining time in the phone call is all about questions you as customers may have in that topic to either other customers who are leveraging the area in particular or just to those subject matter experts so feel free to chime up as questions start coming in we'll start with you just go ahead and start asking the question within uh the conference or you can raise your hand and just submit it via the chat and i'll moderate it for you guys we do record these sessions so if there were people that you had invited that were unable to attend you can send that reporting to the rest of your family if there are any other questions that you may have thought about after the call just go ahead and ping me and i'll send those over to the subject matter to try to get some answers for you but this is the first session and we are going to have a second section afterwards all right so without further ado i'm going to hand the uh ball over to rick and jogging go ahead rick you guys okay well good morning everyone um i did not know these sessions are so popular so we congratulations to uh the success that charles has been having on this uh and we're so honored to be part of this today um this is really not about learning your the product this is really pre-talking on better improvements of your implementing your grc overall or overall architecture so um what we'd like to do is focus on how to prepare for ahead of time but i'd like to introduce you also to what we do first of all product success managers for the secops and risk it's where we support the client and the partners when they have technical issues or challenges with the product we are with the client through the entire journey if we can and we're here to let them know that if they have an issue or a high ticket and then they can put us on it but i'd like to introduce you also to my good friend jargon who actually manages most of the grc seca uh product uh success as well so jogging rick hi good morning all as rick said you know happy to be part of the team i've been with the grc industry for last around 18 years now joint service now around eight months back but uh working closely with customers and product management we are also happy to take if there is any product feedback specifically so today's topic that we are going to talk about specifically on you know what we have seen one of the the most of the ask from customer about you know how do we set up and we'll talk about that and thanks uh for the intro thanks charlie so jaya and i are collaborating through this whole thing so um i'm going to be asking if he has input and vice versa so we're just going to get through this as soon as we can and again this is not about the product learning that's not the objective here is to have a really understanding of setting up good grc practices before you put it into the tool so um everybody can see my deck yes i'm assuming okay um so usually we give our little uh spiel on you know understand people's maturity model and one of the things that we want to make sure is that when they come into our you know into uh utilizing our tool anyways is where are they in their overall maturity you know are they still doing spreadsheets where they're at the manual process um do they have some of their things in place maybe they do have some automation so they're between one and two you know and of course everybody wants to get to two to three that's the reason you know why we uh uh have provided good value to customers like you um so as you come into here usually all this is green but the areas that we kind of focus and help you is to learn uh the the business case so we want to say what's your roadmap uh are you just going to be doing governance type of uh documentation are you going to do assessments are you just doing vendor risk you know we we just need to understand the business case right but then in in the middle of all that the road mapping is so important to understand what you need uh so the preparation planning is more important than the other uh two at the end this is where you make or break uh your implementation process and that everything is going to work out the way that you're planning to be you have to say that you got to do it the right the first time but there are some fundamental ideas and items that you're going to have to be reviewing and hopefully your partner uh your your company that is helping you and also your leadership has an idea where you're going um jogging do you have anything add for going definitely right it is like a foundation block and also as rick said i have seen in my experience also this is a place where you want to really set up your foundation in terms of you know the expectation and preparation of data it's a crawl walk ramp phase and depending on where you want to go and what your maturity level these two phases becomes very critical and this will as rick said this phase will either make or break the implementation and we have seen very good structures recent past people are you know understanding that what is the importance of preparation and planning either in terms of data project management governance of the data and you know understanding stakeholders so on and so forth thanks john all right moving on so when you come into these areas and they break it down further right um it's really this section right here define planning for testing this is almost a reverse engineer approach where you're looking for the type of reports you're trying to provide to your leadership currently not to say that these are going to be all reports because i think once you implement you know our our tools and our platform you're going to find other things that you're going wow i didn't know i could do that right so you'll be adding more but in order to really understand this you is you start from what are you what have you been reporting to your leadership or in order to be effective in what you're doing once you understand that then we reverse it back to then building your architecture around it so hopefully anybody that's implementing should be asking you what is it that you're producing today and that's going to let us know sometime how mature you really are as to what are you doing are you just doing you know your policies are you just doing procedures are you doing uh monitoring where you're validating those procedures are being done you know the metrics most people don't even get that far they're just saying well i made the policy i made the procedures and and now it's been validated we're doing it right but there's no checking and balances so questions anybody okay jargon anything on your end definitely right now there are two states in this right typically what we say is as easy state and future state now every state is important to evaluate and understand where you are in your process or journey future state is where you want to go now that will give you the delta and that will give you a good good planning of you know what kind of work that is required what is the journey that you're going to take what we talk about to talk to many customers here here is to put your implementation journey when you talk about implementation it involves the project management which group that you want to go what kind of data sources that are required and what kind of artifacts that you want to collect it will give a clean white space in in those areas where you have data where you want to go i think this is again as we said uh people gone in these steps are seeing lot of success in recent past and even in the earlier days it's a it's a it looks like a standard uh you know kind of a program management but when it comes to grc it's little more advanced the reason being every company every department looks just in a different lens and the requirements are different although it looks like a normal standard practice of sdlc but when it comes to grc it has more value thanks john all right so everybody knows the collaboration handover and the reason we're just showing these slides is this it is the normal way of thinking there's a consecutive way there's a best practice approach but what we really and i have sat together and we were we found some gaps of things that are being done outside that that are not being done that's outside the tool and that's what we're really focusing on and we're going to get into that a couple minutes so um i just drew this slide just because i really think the success is still back to what everybody sees is always the technology your process your people and your definitely your strategies so if if you don't have all these things aligned then you're not quite ready to really get a grc implementation you know most people do want to try and do it but you got to make sure the organization is aligned and that things are in place so i'll give you for instance so you say i'm going to do a grc because i've got to have an iso certification in order to um bid for this contract and so then you go through the iso and you start realizing man um we don't have half of these procedures written right we just came in we're using google email for our business um we're we're encrypting stuff i guess you know like we're supposed to um but in our own you know share drive we're not just sharing things and and we start realizing there's there's things that are not safe right so um once they've gone through that type of iso review they realize that the people are there right uh the technology is is there they just use it every day but what's not there's a process because if this thing got broken if the office broke down or something you know not available then there's no continuity and that's where you start realizing some challenges so want to have these four strategies in place so that way at least you know that you're going to be able to sustain business and that's really what what grc is about is to ensure that you have some integrity of the of the data uh your continuity to ensure your business keeps moving if you do have a type of business that is a 24 7 or an eight to five and and your availability right of the email your calendar to your customers all those things okay john area i think uh that is like typical right people process technology and strategies yeah all right so where we're getting to the crutch of this is we're pre-planning the work outside the information process so it's this is the part that a lot of a lot of folks just for some reason they skip it or they think about it but they really don't do a lot of it and then when they get into our our tool they realize man we didn't put some of this in place so what i did was i sat with jogging and i said hey let's do something small and and let's see if we can put a real scenario in place so what you're seeing right now is this right here are the um the controls that you want to use now some of you are using cobit some might be using this some are using iso so i these are so your actual controls you're going to try and use but you want to tie it to this categorization called asset management right so um so as you're working through this you have to think okay what do i do in my asset management right and then the subcategories are either asset manager's physical side the software organization so this is setting up your matrix for your procedures and for your policies right but then to the right you have to look at to the roles and say i gotta say so i've got an issm you know an isso that manages the policies procedures i've got the engineers to do the vulnerability assessments and and to do the patching for me i've got an application admin to making sure that there's proper access and i definitely get the user i mean so these are your just normal level roles right and then you've got your business units where you got your hr finance uh manages your portal internet uh that's definitely physical security in your enterprise architecture right and then you have the particular applications whether they be payroll human resource you know it knowledge base video surveillance and access management right so we said to ourselves if this is what we usually hear from the client is that hey this type of business i have and i'm sure every one of you all have something like this in your business somewhere has a normal infrastructure which i hope jargon yeah definitely right here we are talking about one specific example but if you look at both business and id side setting up this data and relating that this data is very critical and this will decide your success of the program how you want to get the reports outputs and you know tagging of the data i think we have gone through one specific example but same example can be expanded across you know multiple business use cases and this is where the mapping starts okay so then what we do is we took our um i'll try to blow this up a little bit more so you can see it so here is what most business comes out and say i need this to get into this right and now you can so the servicenow folks that are helping and the partners understand this better even though you know they they don't probably do have the experience in this but it's really figuring out where are all your parts like you're doing risk framework your policy procedures your authority and then once you build start implementing you start seeing how all the data flows the area we're focusing today is on the scoping because without this you're not going to be able to do any of these even though you you're going to have to tie in your controls your controls your deck jokes your indicators for monitoring and everything else but without setting this key area proper everything else is going to be a challenge and this is where we always come back and helping customers and trying to understand what happened and why things aren't creating properly things aren't rolling up properly for them at all it's because some reason the entity wasn't built correctly uh or may has to be modified a little bit higher this is true there's a really quick question to the team that's out there all the customers are you guys actually able to see the slide pretty well does rick need to zoom in a little bit are you guys good to go i'm going to take silence as you you guys are golden okay um and they they have a copy of the slides too charms right uh i'll send them after the after the call okay and i can zoom in just to make sure yeah but everybody to see that you got your entity type and your your entity classes you have to build jogging you have anything you want to add to this one yeah definitely right i think one thing uh that's that's a big differentiator for service now is if you set up this entity types and classes properly when you associate this risk framework and control objectives the instance of controls or the individual controls and the risk statements will be automatically created based on the way that you associate that's where this becomes very critical just imagine that you have some access management control and you have around you know 500 applications in a normal grc tool people have to go and associate each of those risks to each of those applications if you will in service now that is the speciality if you set it up entry type and entity filters properly if you associate control objective at entity level and system will automatically create those instances of controls for those individual applications that's the power of service now and the power of scoping entity in the right way so i i know maybe i should have put this slide out first to you guys uh but this is just a reference for y'all to see i wanted to try to tie in you know our overall scenario to what we have to do here but i've also given you a larger one of this in case you just want to see that okay now uh going to next this is a more simplified version of how to build our grc foundation model right where you have your objective your applications you're going to be having the type of organizations you can have multiple organizations with your company as well the type of services that you provide the process uh and all so you can see that the entity tank has to be built at the top level with entities in order to then everything else ties into this so without this i guess then you won't have your roll-up so this is a more simple version of looking how entity plays as a major role against all your type of assessments and control uh information to be uh connected into your whole rgrc ecosystem yeah i think one point i want to add here that it is not that you have to always associate list statements and control objective entity type level many times if you want to have localization you can still create individual controls and risks at the entity level that is still possible here what we are showing is the automation the possibility of automation of associating risk statement and control object view at the end type level which will automatically create a instance of controls and risks so both are possible uh but uh the power of you know service now when you have a cmdb if you write if there's a maturity automatically those entities will be created automatically the lists will be associated and controls will be associated automatically without having to do any administrative work this this keeps your grc governance are pretty simple and you know straight forward thanks so then the next slide what it does for you is it lets you see all the tentacles where the entities are going to be uh provided so that's why entities is so important as you see they are such an integral part of this process of the whole grc uh ecosystem uh so that's why we believe this is a really important subject to talk about today uh because most of the controls and the attestation and everything else they're pretty self-explanatory um but uh this can be a challenge for most people you know for most people to try to get their grips around it so all right so what we did was um we took the overall um template here right and we said okay let's go ahead and make some entities out of it and what it would look like if we were to tie it in so this chart gives you that this whole area is focusing on here so i do that out for you all and then what we did was uh we create two entity types smith and road business unit and smith enroll application right but then under the application is is uh and that and that's not an application like like a system but it's a placeholder for any application and then the business unit it could be business unit a business even b whatever you like right then you can put under here so you have a placeholder like a folder and then think of it like as a big folder and then you can have many folders under it uh so that way you can aggregate so at home i have a folder called um you know house improvement right i i got a subfolder for windows uh air conditioner you know plumbing you know all the things that i have to fix in the house but it's all my my family knows that always needs the home improvement phone right so a big phone and f40 gets bigger and bigger the longer i stay at my house too and i think you all understand that and then we have um a class we built because we want to apply the nist controls because we're going to be doing the nest assessments against it so we made an organization nist class and we made a system one so the organization is to say we're going to be using nist controls overall as this but specifically for the system uh we have one as a placeholder definitely right this one we created manually again like if there's a cmdb you can link any of the service now tables automatically and this data many times your application could be in some of the cmdb tables and there are options to create called entity filters you do not need to create individual applications moment that table gets a new record system automatically gets created now all of these things are our part of grc community you know charles we can assign one pdf deck where if the customers are not part of the grc community i would definitely suggest for you to go and register it's a free community where there's a lot of discussion that is happening you'll also get a lot of videos and discussions happening around the setting of your entity types entity classes so on and so forth i would highly encourage for you to go and register into glc service no gst community there and and at the end of this i'll put a summary one together with all those links and and and i also will provide the pdfs to charles uh so that he can send that out to the entire group okay all right so so far we took the sample scenario we did and we have now provided you that the information so when you go and overlay it back to you know the chart that we have shown before our entity types are sitting up here the control objectives are sit down here because that's what's been provided to us and then the application right which is a human resource app so you can see that these things are already been set up and put in place to prepare for when you go and implement it into our tool at all all right um and then the next picture is to show you that um we did create these entities in here so here's the two entities that we had put in and then i'll show you in the demo too as well and then the two uh entity uh type tied to the entity classes so let me switch over to my uh thing here so the entity types here so here's our two entity types and if we go inside the type here you can see that um the hr application uh is is inside here as well along with the uh um the control objectives won't be here for this one and then if you go inside the actual application we put the human resource one in here that we provided and if we go inside here sorry let's try and get to the controls there are downstream controls in the relation tab the downstream okay thanks so we then added the two controls that have been uh inside the spreadsheet there for cm 8 and pm5 so those were the two that were inside of this spreadsheet right here this is where you get the cm8 and the pm5 for this one particular uh item right and when you go inside of here what you'll see on the control is we provided all the information like this and then that way you can go and do all your attestation and all your exception rules against those items so having this set up properly provides you the ability then to reuse some of these items when you go and try to apply other applications in here as well so i hope that made sense [Music] so what you're seeing now is once you have your entity you've got your human resource down to the controls and then once you open the control up it already created a control area for you in here so i know this looks pretty simple but as you can see if any one of you all have gone through this this is not a simple task to do there's a lot of conversations back and forth you know to understanding how to build this properly but we simplified it to try to build something um to make things a little more sense to you guys uh to that when you're thinking your way through from a matrix that looks like this and trying to create it down to something that is easily understood is what we uh where the scope of our our talk today was johnny you have anything you want to add sure i think uh one one one one more kind of point here right you know if if people are using ucf as a data source ucf provides a lot of content and we have the no relationship with ucf if you subscribe to ucf all of these incense and policies procedures everything will be automatically created your work is to just map and those individual control instances will be created and uh you know if you are want to do a manual data set up that also can be done now what you have seen i want to just give an example right last week two three weeks back we were working with one customer myself and rick right they understood the power of entity but the you know discussion took almost a week the reason being if you set it up right each and every department that can be of take the benefit of grc and the power of entity setup right you know you have to talk to compliance department raise courage security depending on how large or how small is your team so getting this consensus is very important and it does not mean that you can you have to wait for long you can set up start setting up simple our approach for all of you started top down approach instead of bottom up many of the areas many of the customers started bottom up saying that i want to convert my current setup into the system that's not a good idea right you can start with top down start with you know departments you know types of servers you know if you do not have individual applications in idea example id as an example you can start with windows as one type linux has one that start from that and go down that's where your entity type starts setting up and same thing is applicable if you are talking about your department of line of business you can start from top or regions or you know states so on and so forth that will give you your you will see how is your maturity whether there are gaps you can start setting up from there and system provides that flexibility starting from top also entity has hierarchy we can you know you can look into the data you can set up hierarchical entity types you can start with regions regions will have you know countries or maybe in the countries will have states so on and so forth province you can go down to that level that also is one more way of setting up data here right all right so charles looks like we kind of met our halfway point i guess we did pretty good uh getting up to uh that way we can start having conversations with people on the phone here is that your goal yeah definitely is if there's any other items or questions that you guys wanted to just kind of clarify right now rick and you're driving you guys can um outside of that we could open a floor up to customers or any questions about what was covered so far any points of clarification even if there's a particular area that you kind of wanted to just kind of recover i know there's a lot of good information there so but we do have the two experts here so um give you guys that chance there but i see that rick you're on slide number 13 did you have a couple more that you want to go through before you open up you can keep going if you want no no this was just an overall just what what our goal was today i just wanted to leave it open in case somebody want to refer to something here from the matrix okay all right so we're going to open up the floor to the customers here so any questions from the field out there anyone who's getting started with grc have some key questions for rick and jordan here the floor is all yours and also too rick you guys can ask some key questions too of the customers as a as interesting areas that you guys may think that you want to get some answers or kind of help from there yep yep anybody yeah my question would be charles and rick to all of you right you know sometimes what happens is in a hurry of you know trying to meet a deadline you would not have started signing up entities you would have directly started upsetting policies and directly associating controls to that that is fine you can still go back and start doing some of this work uh if you are in a specific area or journey i would suggest definitely to the look the other important aspect here is this is very critical when you want to start rolling up like tomorrow if you want to use risk management and yes the risk is a big topic nowadays like resiliency risk and so on and so forth this setup is going to be really really helpful for rolling up of the wrist and as servicenow as we are releasing new new products our kind of enhancement will depend on some of this data setup if you will i just want to highlight that point and you can start thinking around and even outside this call right now if anybody wants to discuss little bit more detail we are happy to get on it paul you know you can work with charles we will talk about you know if you want to have some special discussion around this topic or any of the data set up point of view we are happy to discuss that you know that's a very good point too um one of the things i like about working with rick and jagged is that if there's some complex uh conversation needs to be had and you guys have some particular use cases as a customer and may not feel so comfortable talking about it within an open forum they've always been willing to jump on a call to kind of have a good dialogue around that piece and kind of help you figure it out like what's the best way to kind of approach x so i definitely appreciate that so any questions that you guys may have right now for the team well i i do i have a couple questions for the team then anybody doing uh something called cmmc coming up soon as far as 171 that's in the audience today no okay okay so looks like jane raised her hand all right can you elaborate a little bit why you're even looking at it um i don't have those kind of details but i understand from our management that that's going to be our next control framework that we're going to be using through the ucf so so i i'm going to go ahead and take a uh a brave approach on explaining that uh challenge everybody's going to have and if no one you know has a thought about i i'm going to show you why this can be a really a challenge um what's happening is that if you've got let's say today you've got your matrix built like this and you're going to need another one over to the side here just for the defaults 171 or they call it now cmmc right and the thing is this thing um is a moderate level of assessment now if anyone's not doing any of this of the nist stuff today there the mapping of this is going to be quite challenging because every one of the items by the way i got this from the cyber security framework csf today and that is still at a 10 000 feet level but the assessment of a deforest is at a 5 000 feet and below so it gets down inside of like this even though we see the iso isa these items these are still very high level questions it is only when you get down to this area is when they say so i'll give you example iso usually says do you have an access control procedure in place the answer is yes this will say well give me the three uh procedures to ensure that you're meeting access control so now you're having to spell out everything down to the t so to try to now b bring the d fars 171 or cmmc control objectives into it will will mean you have to sit and map what you've already done whether it's iso down to the level of the nist uh requirements for the defaults but then your attestation and your indicators are going to have to be updated because it's going to go a lot deeper so then that means you're going to have to add more indicators or add deeper uh attestation uh documents to validate but you have to also add in those predict particular nist items that's going to be inside of whether your asset management your configuration management access to management you know all of the 18 major families of cyber you know is what you're going to have to complete put in there and then not everyone in your organization is going to have to do it now because most of the dfars out of the 18 families uh 14 of them are being asked the other four are not being used and most of them are technical requirements so you're going to be focusing toward a lot of your i.t systems because really it's about ensuring your data at rest and your data in transit that's being protected at all times and you have to validate that so when an assessor comes in to review your defaults they're going to want to see those particular controls the particular artifacts and evidence with the attestation and if you're doing any monitoring which is continuous monitoring you're going to have to show them through your indicators right so to to try to uh bring that framework into your existing architecture um it's going to be you know it can be done but it's going to be a challenge and so why this is why we sit back and we try to talk about the entity because you're going to have to go back and bring your old blueprint app back out and see if there's going to be any changes have to be made you know to your entity as you can see once you touch something then other things can be affected so um this is one thing that's been coming up a lot in ours is now people are starting to bring the rmf process into it or the defaults 171 slash cmmc compliance requirement into their existing items we had one a big audit firm called us the other day and said we we we have to bring in you know these items in we've been doing it really at a governance level but how do we get down to the lower level anybody seeing this as a challenge or uh or preparing this already or you can share your maybe you're doing it and it's working well for you uh be nice to hear how well it is doing for you if you are implementing this anybody any comments on this okay quiet audience today all right sounds like uh maybe we hit a good point or or maybe items that were just refreshing for you guys which is uh that would be good if you're already doing it okay all right um i don't have anything on this end for right now jogging i think from my side i think uh looks like uh this may be level making very well but you know as i said if there are any other questions even outside this call please make sure to charles happy to discuss around some of these topics okay i think i was going to ask rick is if he could show you guys talked about the community section could you just navigate there really quick and just kind of highlight that yep let's do that so if you're not in my community a day please join it right and of course i have slow internet so here um if you guys are able to join them there's a lot of which data can come in here and you can even type what we've been doing today and you can see that a lot of things show up about entity um talking about profiles the entity uh the objectives and all and sometimes when you click inside you'll see what people's conversations are and sometimes you actually see the the um the videos on them as well uh in here along with that is what i did was i went out to youtube right and i type entity for servicenow right and then it came up with these items and then what i did was i just took the title and i would copy them back into the um so if i did this i went back into the community right i think i get close here of course it's not going to show like i want you is it um usually the videos will show up here and then you can get right into it and now when you click in the items but i don't know why i was having a problem here yeah so if there's a video here it actually will show you and then you can actually download if they gave you some things you can download the documents here as well i was able to find this weekend easy i don't know why right now i'm having some challenges um but um but there are some great ones out there as you can see that does talk about them and see scoping this one this one's actually on the profile let me let me see if i can get it um i'd have to have a slow internet don't no i think you're not the only one i always have there's a couple of issues going on i think with centurylink in other areas so it might be yeah there is i saw something on the news about it yeah so i want to get to this one that showed this there it is and usually it matches that title this if it's out there then it should there it is right there so you click on here you can see the videos in here right and then the uh download of the actual uh pdf i mean the uh dot the presentation sitting right here so you can actually download it so this example you know what you see on youtube if it's out here then you can go community and bring this in but at the same time community as you can see they have discussions all the time and if you're on the grc one you'll get really loads of stuff that people are talking about every day so i hope that helps charles you know that's great that that's very perfect um i love the fact that we're starting to put up more and more of those videos and then being able to download some of the material that is created in those videos is great so that basically helps customers tremendously i know from a lot of the customer calls that i've had especially the check-ins there's been an appetite for good easy to use slash digest videos on key topic areas especially to a grc so it helps to build up that foundation so they can do get it done right so thank you thank you thank you for showing that so right now there's about 14 minutes left and i'm gonna kind of open up again for any other questions or comments now if there aren't any questions or comments it's perfectly okay we can end early but just know that if any questions do come up for anyone who either attended today's session or are looking at this video feel free to reach out to me charles uh and i will try to get that information over to rick and the team to try to get some answers for you but i want to make sure that you guys had a chance to answer have asked any of those questions that you guys may have at this time so i'm going to leave it open for next two three minutes to see if anybody wants to either provide a comment or a question if not then we can adjourn early today and then up and uh i'll make a summary uh folder uh i mean uh that with all it says links and then i'll just put it all inside here when i send you an update version charles no i appreciate it thank you guys so much well if there's nothing else i thank you so much for inviting us charles i know that um gaga and i uh you know when you asked us about two months ago i thought what were we able to talk about because you know it's so much you know that we can express that as good but then he and i sat down as what what's been the most issue you know problematic issue that either when we get called in from clients or starting off a new project and and and doing all this is the entity for some reason it's been such a real challenge for folks um of course we'll reach out to partners and ask them and it's funny how everyone have their own approach of doing it too as well right so um we also thought about bringing some of the partners in to the product management team and just have a a level set as to you know let's make sure our messaging is going out clear on entity scoping maybe someone's got a good way approach to doing it you know maybe we can improve our documents maybe our documentation you know as missing some items or or something right so we were intending to get that done and maybe there's ways to improve it um is there any key areas that might be changing or coming up in paris that customers might need to be aware of within as far as i know and john let me know if you're you found something else but exceptions uh entities exceptions are a new item we're going across talking to multiple clients that are using vr and then integrating the exceptions over to the grc when they're doing indicators or monitoring them right right and be able to say well these things don't really apply or these do but except for these items right so exceptions is something that we're building into there today and i think some of the acl things are getting more granular in the grc uh so charles did you hear anything about that on the uh acls or anything no i have not and jargon have you heard anything yeah we are getting into granular entitlements that is going to happen in future but for especially for paris charles to answer your question uh we are releasing one import there are a lot of enhancement that's happening high level if you want me to give we are releasing a lot of enhancement in audits management the other big enhancement is uh around vendor risk we already have under risk management announcement there is something called uh you know typically you know that evidence collection is a challenge for many of these companies spend a lot of money and effort we are releasing a module within some of this right between the news queue called evidence collection which is going to help you for collecting evidence for either external regulators or auditors and system can automatically schedule the please skip with the product roadmap for evidence collection and that input came from customers like you where people are you know spending a lot of time and effort to collect evidence and you know present it to the regulators on a periodic business selection auditor that's one important aspect also that is being released also you know risk management we have this automatic indicators where you know today risk assessment high level is you have to go and do manually input the data for this case monitor scoring and we are also automating that in terms of you know system can automatically change the risk rating on on the change if there is any change that's going to happen anywhere in the system you can automate that using indicators risk indicators and we are uh releasing some of these uh liters for rms that's also one more thing that's going to come in paris so those are some of the high level items that are going to come with that excels oh great now that sounds like good stuff and then the only other question that i have probably more basic is just are there any key areas that a customer should focus on um and have in place and be leveraging well enough to then take on the grc module are there any kind of order of operations just high level that you guys can think of that just says this is the best path to success in leveraging and using and implementing grc you should have these three basic fundamentals down and down hardcore definitely right you know i that is if you go to the forum there is one uh um kind of a community event that myself and eric did which has a checklist which talks about how where you are it's a self-esteem checklist which can talk about how you are in terms of maturity and where you want to focus but if you ask me two or three areas one is definitely entity is the core as we discussed number one number two is what we call it as you know grc data governance which is again outside the system where you have to have one thing that i've seen customers and myself and eric rick would have seen is customers failing is they will try to focus only on one department they'll just forget that you are going to use the same tool for audits or risk or compliance or security or privacy so keeping that in the idea open having consciousness so that's the second one third one is when you set up you know i would suggest as i discussed during our meeting is think about calm down approach do not think about what amount right bottom up is going to be rework and failure those three would be the high items charles if you ask me that those three topics right and detects thinking of top down approach and getting consensus from other department that will set you up the data is very critical right as you have it's like you know giggle machine right so if you set up the data properly have right governance then you can start using uh using the power of the service now platform and grc as you go further great now for my part charles i think the pre-planning uh looking like start like jogging was saying the overall architecture right sitting down and documenting this on paper walking through scenarios of it doing workflows of it and making sure it matches to what you want because by the time um you know the partner is actually helping you or if you're self-implementing then at least everybody's on the same page many times i hear people discussing things and it wasn't really written down in a way that everybody was agreeing to it i think we all can talk grc level and be very high level talk unless we actually get it down on paper and just draw it out and then render through the scenarios um it's where you can find uh the challenges you might see you know in here because the tool has allowed you to do so many different things you customize it you can change all the configuration which is you know that's fine um and you can do some very imaginative things the way your your your monitoring things right um 300 clients later we started realizing they're all doing it a little bit different which is a good testimonial of our tool is that we're not pitching holding anyone inside here that's why when you look like you know i'll take an easy tool like like microsoft word anybody that does proposal writing and editing and everything i guarantee you they know more about microsoft word than i'll ever use right the merging and everything else about it so there are so many ways that servicenow has allowed the customers to to do it the way they want to do it but at the same time it can be very dangerous too because you know you're doing so much and and maybe you're going down a path you didn't realize that doesn't work that way right because we allowing it it looks simple it looks like it's working the way you want to but then you start putting your performance analytics tools and reporting together and you're realizing it's not aggregating or rolling up like jogging was saying so um i think writing down testing it out before you actually implement it is the real key to your success i love that i love that that really that's the one number one thing i've seen when especially having you speak with some of the customers that i have that you greatly helped them out with and understanding taking that step back and going through that process which also too leads itself up to um how you guys were offering earlier if there was any additional need or questions or need like a separate session um yeah if any of you customers on the phone who are either here or just listening to this recording if you need some assistance in just that basic component in the beginning it'll save thousands of hours and countless nights of just did we really understand what we thought about from this is everyone on the same page and how do we kind of work through that and make sure we get that correctly these two individuals definitely have had some really great virtual whiteboarding sessions i've watched it happen um where it just helped to mind map and put things into perspective so hopefully you guys understand that as well i don't know rick if you want to add anything else to that yeah yeah and charles thank you so much and uh i know you've been a great advocate um it also puts your requirements and your roadmap to what you want when you are talking to your partner do not let your partner steer the conversation you know as much as as possible because i think they're there to help but if they're not hearing what you want they're going to go back to what they have been implementing what they're used to doing and it's not going to say it's wrong it's just that their way of doing it but it allows you to elaborate and push the partner to think a way that you're the way you're wanting to implement it in the way you see the world of grc right because without your input they're just going to go back to doing what is normal for them and sometimes normal for them could be something that maybe is a small glitch that they could have corrected and then we're finding it out later so um take take control of your own destiny i think on writing the stuff down so thank you so much for having us by charles and the rest of y'all well thank you for having for taking the time today and i we look forward to the second session which will happen in september thank you customers thank you all for attending and participating in this uh office hour i will be sending the recording as soon as i get it as well as the survey please feel free to take a couple of minutes to let us know how we did if there's other topics areas that we should have covered that you didn't think that we covered very well let us know we love the feedback and also too again definitely when you speak with your csas your customer success advocates that are assigned to you don't hesitate don't hold back let them know during your your check-ins um what other office hours you might want to see it's what keeps us going so i'll talk to you guys later thank you all so much have a great rest of your hopefully shorter week uh have a good time bye-bye thank you all bye