hey everyone D here nice to have you all participating early morning today uh early morning in California yes the rest of the world they' got a few more hours on me oh like me in India it's evening already that's true you got the whole day all right before we get started a couple housekeeping tips um you will be automatically placed on mute um please is the Q&A button up there um we track the questions if we don't get to all of them we make sure we follow up there'll be some things put in chat like I'll put the links to the recording which will be done we're recording um was a playlist you'll be able to go listen to later or if you've got co-workers that couldn't join us they can listen to it at that time um and then in the session ends you'll be prompted for a survey so you know please hang out and and answer our survey it helps us with later webinars and and we really appreciate it we want to make this interactive so please please ask questions I'll be interrupting D along the way as he's doing his demo so um I want to get those questions answered we are very excited and the reason we're here is because we have released new applications on the service now star and we've got a series of webinars so if you didn't catch them we' had one already last week on business continuity management risk management and thirdparty risk management that's like two weeks ago actually last week oh this week we have our continuous authorization monitoring later this week make sure you tune in again because we've got our compliance and audit management so we're going to be talking about managing the documents using 36 Office 365 we've got some great enhancements there and we've got some great indicator enhancements too so you don't want to miss that one mark your calendars for it and then next week we're going to be talking about our integration with radar first so this is a really interesting one with our privacy management application which again you know you don't want to miss that one and then our very last webinar of the series is going to be around compliance case management and Regulatory change management so that's also next week we really hope you join us for those um think it's going to be a fantastic fantastic series and again I'll put the playlist in the chat of the ones that we've already done so you can catch those later on so before we get started we actually want to ask you a question so let us ask you about the important enhancements that you'd like to see in upcoming releases super quick question just as at the stage would you prefer the workspaces for continuous authorization and monitoring cam or or would you prefer oscal support or is there another enhancement that you think is the most important enhancement that we should enter that we should we should uh create this is going to help draw um plan his road map exactly and that's where we are looking forward for I see there are good responses already coming in so we will surely consider one of your output from this into the upcoming release which will be next in August and hence I see a lot of things coming along for workspace for cam so yeah we do want to listen to you guys everybody wants a good user interface I think the cam face currently is is is lovely but yes those those new user interfaces that we did a couple years ago those are really really nice nice I see about 80% have answered already I'll just give it a few seconds before before we close the poll and share the results so if you're not yet voted I think we got them yep all right I'll say andp and share results no surprise right we were just talking about it overwhelmingly work spaces for Cam that that is what everybody cares about I also see five of them saying hey we would prefer something else about apart from this and that's going to be interesting so what I would request is if you could drop your email ID into the chat or in Q&A part where we'll just capture them and we'll connect with you offline to gather more details hear your thoughts and even for those who have voted otherwise right even you voted for cam or oscal if you still feel you have other inputs to share we are happy to hear you guys so please drop your email IDs on the chat and we'll reach out to you separately and your team and we'll discuss from there with that I am going to stop sharing the polls and we will get started on what's near today so again make sure you put your questions in the Q&A because that's that's how we're going to be able to log them and we're going to be able to ask them all right super so with that we're going to get started onto the next slide which is what's exactly coming and I'll quickly start to it without going through the next agenda so the very first thing we bringing is control requirements uh we've heard it from I forums Community chats we've heard it from some interactions with the partners that um today some of the control tend to be a long one and there needs to be really a way where we need to bifurcate it drill it down into granular level not just that we want to do a testation at that level meaning okay I do have a control that says I have to do a b CDE e but two of these things are done my my facilities team one of this thing is done by my HR and only the remaining things are the ones which are done by it actually so you want them to participate into this and what customers do today is they have to send it offline as an email get attested get the reviews and then one person goes and attach to it so with this we are breaking that limits and we are going Beyond where it's not just the control that you could attach but even at granular requirement you can choose that yes I want to attach it separately and how it works so that's one feature that we've added again this comes from two level at objective level what you see on the screen right now where your objective has a description ABC and that gets broken down into the requirements and there is also the attestation part which will actually score through this entirely when we do the demo I'll go to the next slide which is just the highlights so again we'll go through all of this in details but these are just the highlights of it so when you are on the control form actually you would see the requirements broken down already for you if those are nush controls and in the attestation you see a view where do you want to do it at requirement level or you could uncheck it and it continues the way it was behaving till today so you have the ability to do it at both the level and monitor them separately next is the hybrid controls uh this is again a highly asked feature that we had so far and hybrid control sits on top of our requirements so now that you have your control broken down into multiple requirements you may say that okay a testation was good enough but what if the part of this control is already implemented by another theme a provider control or package which is a common control provider a GSS package for those who are from the federal s and you have the provider controls right so what if I just want to inherit some part of it not the control entirely so yes we could even do that and that's going to be in hybrid you could now have a new option to create hybrid which is highlighted on the screen and you would also see a related list for hybrid controls based on your tailoring of the control we'll again go through this in detail in the demo further down and the third highlight is assessment procedures 853 Alpha which is again coming from the nest is what leads to 853a uh wherein we taught about the assessment procedure so it's coming directly from the nest this basically talks about when you are doing the testing of the control what are the different things you should do for testing today you can only test a control based on its operational effectiveness as yes and no or you had a design Effectiveness which could be yes or no but what we seeing is with assessment procedures you could have different steps individually so when your control fails or it's not effective you don't have to go through all these steps you can pinpoint directly to a particular step what failed and fix that and that would lead to fixture of your control compliance by fixing the control control test so assessment procedures is again a new thing that we are introducing in this release and um you would see certain new Fields like examine interview test which were not there before you would see design test is no longer there so we made some changes as well I'll speak through on all of these as we move ahead into the demo but these are major highlights again it doesn't mean it ends here there are multiple other things that we've done so for example enhance went to control test where we added these fields not just the fields but even the data out of the box so whatever n gives you you don't need to go ahead and now add it manually everything comes out of the box you can directly edit it into tool and it can be used as is there other features like test plans test templates which were not used in cam so far and now these are being leveraged meaning you could have different test plans for the same control and have multiple test for it you could even go ahead and move a package back and forth is what we also added so there are multiple other small minor features that we've also done and I would not take more time into this presentation I'll rather jump into the demo about this also I just want to uh have a baseline uh I sure I'm sure we have a mixed audience today what we're going to look at today is everything that we've enhanced and only those features there might be certain customers who are new to cam or there might be certain participants who are like hey what is I'm just interested for it unfortunately this is not that uh webinar for understanding the entire thing it would take a 2-hour webinar in fact just for that we are planning to do that but it's going to be in next release so with the new features and new things we going to actually do that but just wanted to highlight and clear out as to if there are any assumptions I assume the crowd already knows what a scam and the focus would be on highlighting the new features for Washington release that we have I'll take a pause if there's any questions before before jumping into the demo Teresa if there any other question there actually is a question and I've also got a comment so um the question is um is there a way to add other Frameworks such as ISO 270001 or tippa zero trust Etc so uh today you could do that in our compliance already we are shipping ISO 2701 content as well in certain way uh Hippa can also be performed but that would be a customized workflow that we would have to do out of the box solution is for nest 800 uh Nest risk management framework which can be leveraged to do multiple other things and cam is being used so for example today I've seen cam not only used in the US but also in Australia region Europe region for their different requirements so it could be tailored yes there are there are a lot of different different uses for cam not just governmental um do we have an architecture or data model slide that we could not share maybe on the webinar here but we could make available for for customers we can put it up on the community at the community link with the this particular webinar we can we can leave it there if we have one sure we do have one we'll post it in the community and then I will also put in the um chat along with a couple other links I mentioned I will put a link to our demal Center because we do have a really good demo of Cam just cam so you can get a feel for what cam is as d off said we'll be going through a lot of the new features here so to get a good Baseline that demo is fantastic so let me go ahead and turn it over to you I will answer a couple of the questions that are still in chat in chat and we will be we'll be good to go sure and I also see someone asking about I'm new to cam and uh there are some about BCM and things yeah I can I can answer those in the okay super QA and you can go ahead and show everybody what what I'll also try to do is I see we have a good participation uh then I'll also go through a boundary quickly and a package to start with and rather than jumping directly but my major focus on the Highlight will be considering the time frame on the new features that we have today so here are the list of boundaries that we ship out of the box ignore the Zodiac one which I created for a demo purpose right now but if you see everything that you uh that you see over here from common provider boundary to all the other ones these are part of our demo data similarly if you would go to package and if you just want to try it out in your instance and see how it works like so in the packages we you you would see everything which is from monitor which is here that I'm highlighting till below these are all based on revision five so n 853 revision five is what is the demo data based on everything above was revision four what you had till today so this way it's easy to understand that okay you have a provider package where you are having controls which can be inherited and these are different packages in each step so the seven steps of RMF is what we have ignoring the last one which is zodiac but uh that's what we ship out of the box as demo data to start with with that I am going to go ahead and quickly create a boundary quickly create a package and I'll showcase all of our features from there so for this I'm going to say what's new demo demo and I'm just going to assign a system owner this will also help those who are new as to how it works as a high level overview so I'm just going to go ahead and save this the moment you create a boundary it allows you to have filters added so you can bring in data from any service now table into the boundary and they can be added once you go ahead and add the filters it will get updated in your system Elements which will be autop populated so anytime your data in the back end let's say you're bringing from cmdb and if you adding something from a set table if that change tomorrow it will automatically update here so that's the part of automation that you have which will also populate and then comes the authorization packages so here is where you would go ahead and create a new authorization package actually and that will start working from the authorization package part so coming back to my packages again this is just for those who just wanted a gist of how it works today and where things are differently so when you go to the package the very first thing that you have is the prepare step in the prepare step I would have also defined the rules and responsibility of different personas so for those who don't know we are capturing this out of box all of these are federal specific personas that we have today and uh then you look at ptap Pia if there's any Privacy Information you would answer yes which would lead to a privacy impact assessment and you can see who has to be responded in this case I'm not going to show that because there's no enhancement there everything remains as is and then you click on the categorize option which will move it to the next step you also add the option to select what is the revision version that I want to use on the top so revision 4 five what is it now once you are on the select uh on the categorize step that is where you will see the impact of what is your package impact as a overall impact and if you see here someone had already taken the Privacy impact assessment I could review it and based on it I could add different information types so again information types is something that we provide out of the box uh that is again coming from n you could select them and based on it CIA values get updated so I do have a package already ready for us in the interest of time wherein you we can go ahead and have something in the select tape and you would see I have an information type added where CIA values are populated I can either go ahead and update them as well in the previous step which would have led to my impact getting changed and then you come to the impact as moderate so everything I showed till now was all part of how things work and how you come for a package till here now is the actual changes that we're going to do so the first thing that you do is based on your impact and if it's moderate it brings up my Baseline controls I see 280 controls got autop populated those who have used cam would already know how it comes because the there's a link between the impact and how this gets populated so once these are populated now is the new Option of create hybrid but even before going to the Hybrid part I would like to look at uh I would like to Showcase how the control requirements work over here and what are we shipping there so I'm just going to go ahead and duplicate this and I'm going to go to my control objectives so in cam if you go to control objectives you would see that you have source as R3 rev four or rev five both in this case I'm just going to filter out my rev four so I'm left with all the Rev five ones and here I could go ahead and change them with reference so for example if I go ahead and again I've kept the list view to be limited but if I go into one of them let's say in this case device lock what new things you would see is the description was having a and b now I can see there is also a new related list called control objective requirement this is where you could actually configure things and again going back to the question about ISO and Hippa you can leverage the same things if you are using it for ISO or Hippa as well so basically whatever you have pointers here you could actually go ahead and break it down into your control objective requirements you can add new you can create new or remove from here which means whenever a control is getting generated out of such an objective it will also create these requirements again this is an optional feature so we've given a toggle flag over here so what I'm highlighting on my screen is create control requirements so if you have this checked which is by default checked in the new releases because it comes with that feature so if it's checked then these gets generated if you don't want the requirements to be generated you could actually uncheck it and it will not generate for any new controls created from this objective going forward that is one part you would have also noticed there's a new field called discussion so again discussion is a field which comes as out of box and um that is having data from nich so if you had revision four there was supplemental guidance which was a field discussion is the new field which comes if you have revision five so with that you have this discussion again all of these you could update and edit based on your organizationally defined standards and this will further float down into the controls which are generated out of it so this is my control objective these are my requirements and new edit are the options that help me configure them with that I'll now move on to my package which we saw over here so in my package when a control gets generated out of such a control a baseline control because now these would have my requirements I would like to Showcase one package which is down further so let's go back to our packages and I'll open something let's say which is in monitor state so if you see here my controls are also generated and if I go ahead and see the controls list the very first thing to highlight is my controller location this is a new field that we added this helps you identify if it's my system specific control which means like a self-implemented one or it's a hybrid one hybrid we will look at it in the in a few minutes again how to create but if it's a hybrid control you could easily go ahead and identify that difference so if it's my system specific control what I could do do is I could go into one of the control and even here I would see control requirement as a related list in this case because for ac2 there are no control requirements I don't see any requirements and I cannot even add or create new because these are coming directly from your control objectives so in your objective if you had requirements it would be created over here if you do not have them it will not be created so that's about the control requirements now let's look at the Hybrid part of it and uh how it works because these two are so tightly related so if I go back to my package this time I'm going to pick a package which is in select state so select state in RMF is where you do the control tailoring by that I mean you could add overlays you could add new control objectives you could remove you could categorize them as hybrid or non-hybrid things like that so when I come to my Baseline I see okay these are all my controls I have already created some as hybrid how did I create them let me redo it for this so I'm just going to change one is ac2 and I'm going to move it back to Baseline and I'll create a hybrid on the fly so we all understand how it works ac2 is this account management I'll select that and I'll say create hybrid now two things we need before we create a hybrid one is there should be another package which should be providing ac2 as a common control meaning if you see common control provider here it's false there should be a existing package where Comm common control provider has to be true and that should be a package which should be in a further state which is in monitor state only then I can go ahead and inherit from such a control objective so I'm going inherit or create hybrid so in this case I'm selecting it and I'll say create hybrid now what this would do is it will show me all the packages which are providing ac2 in this case it's only one package you could see it's only one again there would be a better view in the next release there were some limitations which led to us repeating but you could actually go ahead and group by over here which is done in our upcoming patch for uh the upcoming patch for Washington so these would be grouped so that you don't see repeat uh repeats but if you see these are actually all the different requirements which you had for ac2 and out of this which one do you want to go ahead and actually inherit is the question so Define and document the type of account maybe this is something my HR team does as part of policy and compliance right so I'll say I want to inherit that and then there's also something about specify authorized users or group role membership again this is part of that policy so maybe I know there is a package providing me these two requirements so I don't want to implement them again I'll just inherit them so I'm just selecting these two and I'll say add now what happens is the control moves from my Baseline and it gets updated in hybrid so if you see ac2 is shown over here if I go ahead and expand ac2 I'll be able to see what requirements of ac2 are the ones which I inherited so I'm saying ac2 A and ac2 D is what I have inherited again I can go ahead and move it back to Baseline I can change things uh if I want by selecting them and making changes uh or as a whole or even I can actually open this objective together and I can update certain text if I want over here before taking it finally and here are all my requirements so I could do all of these changing at changes at the objective level with that said I have it over here as ac2 inherited and I'm just going to say request approval which will move this further in the flow so it is right now moving it further in the flow for this case I'll have to go ahead and approve and go through that part what I'm going to do is I'll directly open another package which is already moved from that state to the next state so I'm going to open something which is already in Implement State because that's the next dat and if you see here I had five of them in this package again ac2 is part and if you see there were some of them so in this case I had 1 2 3 4 5 six six out of 12 requirements which which I inherited so the control that got generated out of it if I open ac2 again over here and if I expand that I could again see it over here or I can go into the control form so you could see it's over here and I can see six of them which are inherited while everything else gets self-implemented or I could actually go into the control and from the control I can also see all of those things and take action so I would see that oh these are already in the monitor State because these are something I'm inheriting and it comes with its own status so I would know what is the status of it this is how the hybrid control works today further we're going to look at the attestation part of it how it works going forther control testing assessment procedure but I know this was a lot so I'll take a pause and see if there is any questions and I can address before moving forward there was a lot okay so will the feature control objective requirement and hybrid control be part of policy and compliance as well as cam so today out of mock it is uh not available so you wouldn't see this related STS uh related list in the policy and compliance but from technical side yes they are actually shipped as part of policy Inc compliance so if you are a partner or if you are administrator who is curious to do this things already you can configure this by just going in here and related list configuration and you can have it added there might be certain actions you might want to work with but yes you have parts of it and you can make it as build it up okay one more has an update been made to allow users to update the Baseline control information like inheritance and applicability in States other than the select state uh no so we intentionally did not allow it to be updated apart from the select state so that we are staying consistent based on what you did in tailoring like if you if I go back to one of the package and that's a good question we did think about it if we should update it or not so when you move from select to implement that is when the actually control gets created until then it is just control objective technically so we have intentionally kept it that way to be synchronous and it creates it accordingly otherwise you might not have a data M you might have a data match where here it would show something else but if you go back to hybrid control which is objectives it might not show the right data uh however we are planning to address such requirements I have heard from some customers that sometimes after the package is there we don't want to move all 280 controls back or 300 controls back we want to do minor modification so in our product backlog we do have how do we go ahead with adding such ad hoc things and addressing it it's in our backlog all right awesome all right keep the questions coming keep them coming all right d you're on to the next topic super so with that we looked at different packages and what state they are now I'm going to also open up one of the again the ones which are an Implement today because there is where we would have all the controls which are in probably draft state so you could see these are the states of those controls and then here I do see some of them which are in draft State let me open something which is with the requirements so okay I will select ac7 so I know ac7 has at least two requirements which is remote access one of my um known controls I'm just going to move it back to draft for this demo so when you have a control in your draft state right you could see the option of take attestation at requirement level or not so this is the feature which is newly added now I may choose that I understand there are two requirements but I really don't want to touch those requirements at all I just want to do one attestation at control level I can uncheck it and I can proceed with ATT test which will only create one control or one attestation per control however if I wanted attestation at these individually I can actually go ahead and change the respondents I can add more respondents and I can say let's do the attestation at the requirement level what this would do is there'll be two attestations sent for each AC 17A and ac7 B and I can go ahead and take those attestation once these attestations are taken it will move the attestation into uh it will move the requirement into the next state which will further drive my control into the review state so it's driven by attestation let me open one of the control requirement just to Showcase how it looks like today so this is my control requirement and here you could see what is the attestation I want to do if there are others that I want to pick in I can go ahead and pick them out of the box we are shipping one template which is GRCC attestation that is control requirement attestation and you can go ahead and add more participants or change the participant list from here as well so this is what you could do what it also shows is the same requirement if it part if it's part of multiple controls you would see them down below so you would see that okay there's a remote access as a v is ac7 as a control it is of type hybrid and it is currently in draft state so you get all this kind of review over there let me also pull up a better example with the package so I'm going to go to packages again and I'm going to open up the Zodiac one which I was playing around with before the demo starting so it's a better way to do and AC's to is one of the best example I've seen because it has quite a few requirements so ac2 I've already moved it to review state but I'm just going to move it back to draft for this and with it returning to draft I'm going to choose that yes I want to take ATT testation at the requirement level now before even doing that you might have noticed what is implementation statement so again that's something new that we added I'm going to talk about all this minor features as well that we added so basically implementation statement is something that's mandatory before you move from draft FL test so I know the details about what the control is I know what is to be done for the control but how am I implementing it for example you have a encryption as a policy what type of encryption are you going to use what is the length what is the encryption key so there multiple details that you might want to add as to how was it actually imp implemented because there are multiple ways to implement the same control and this is what will be covered in implementation statement again this is driven by our customers where they ask that while testing it's very important to understand that in this framework it's important to understand what was the implementation how it was excuse me how is it that it was implemented so we are capturing that as a mandatory step before you move from draft to a test St however even while in a test you can still go ahead and update this so it is open for both but while moving you at least need to fill something so you don't mess it out and it doesn't go to review directly so that's the thought flow over there in this case because you've seen a regular attestation I'm not going to do that I'll do a attestation at requirements level and I'm going to say attest so we've got a question that's actually a pretty basic question you might want to address right now is how can the control requirement be part of multiple controls so in cam we have not enabled that for now because we are not giving the new and edit option uh however we are giving this option an objective so if you're using N Out of the Box as this you might not want to do that but what I've done is I just navigated back to my objective and in my objective I can see new and edit button so if I go to my edit UI action it will show me a list of all my requirements which are there today so I know ac1a is actually part of ac1 but because the context of it is so unique or it's so uh common I might want to add it here as well so you can easily go ahead and do it this way and it will be part of this control objective as well so this applies to mostly the common control or the organizationally defined parameters because control objectives we are shipping from Nest is one thing but you might always have your own control objectives you might always have your own control objective requirement and that you might want to repeat across let's say for example password has to be minimum 10 characters or 12 characters you might want to reuse it in PCI you might want to reuse it in ISO or something else as well so in that way you could repeat them okay coming back so we did send that uh package for uh sorry that control for attestation I'm just going to go to that control and if you see now it's in ATT testate although it's in ATT testate it allows me to update this over here what I'm going to do is uh it went to Susan I'm going to go to Susan Orwell's profile just going to refresh my instance that expired during the demo so timed out and there we go we log in as Susan and what and what a nice user interface for the employee so this your your showcast casing the employee user interface here too wonderful yes so here when I go ahead and say attest station you would see again a new module that we added for the them so control requirements is a new module as as a whole within which you could see attestation and group attestation this are filtered list to show you requirement level attestation what you always had was my attestation which were part of control so if it's a control level attestation you will still see it here but in this case I'm going to go to my attestation under the requirements and if I see I'm just going to refresh this okay there it is it's the Zodiac one which we were using so if you see these are my entity I could even go ahead and group byy it just for the easiness so I see okay these are all my requirements ac2 C EF and whatever we had there and if I go ahead and if you if you notice a is missing D is missing these two are missing the reason for that I would also like to showcases let me switch back to my account so if you notice here these these two A and D are the ones which are inherited so because they are inherited the status will be remaining same as whatever was the common control provider status right so you don't need to attest them at all it is already done and tested so it will only send the attestation for the remaining ones with that coming back to Susan's profile I could actually go ahead and do take a testation individually for each of them which is again where you will see what is your control what is the requirement number and what does it state so if there was a bigger definition of it it would have come up over here and then is this implemented if I say yes it will ask me to attach evidence and explain about it if I say no it will not require an attachment or I could say you know this is not applicable for me at all you could do either of either or I'm going to cancel this what I'm going to do is I will select these and again it will be a better user interface in the upcoming iteration but I'll say you know all of these are for my same entity so why do I have to go in each of them I want the requirements but I don't want to do it all one by one I want to do it together so you can go ahead and group them as well together so I am on the wrong one one second my attestation and if I select them over here group assessments yeah that's the one so okay I didn't select all again but I could go ahead and select them all and I can say group assessments so it's going to group all of them together into one group and it will create that group again am I going to reply all the same or I would reply differently to each of them I can select this in this case I'm going to do same for all of them and I want to group them by entity is what I'm going to look that so because they are all part of the same boundary which is basically our entity so you see see assessment group is created I'm just going to click on that and take this attestation so I'll say take assessment my popup came on a different page one second again let's see if I am lunched on the screen while doing that or it timed out or something I can again click here or I could go to my group data station as well and this 26 the one which is ending with 26 would ALS appear there so you could do it either ways so I could go from here and take it or I could go to here and take it and I'm just going to answer yes to all of them and I'm going to say test and I'll be submitting it if I answer yes it's a positive answer meaning it should take it as a compliant is what I believe so I'm going to change my screen back to the user and I'm going to reload this form so now I expect my control to move into review which is what it's done all my requirements also has moved to review and they compliant had I answered one of them as no for example it would have made it non-compliant which would have further led to my status being non-compliant so again that's how it works another thing to talk about is even if your requirement level if one of them is non-compliant it actually creates a issue at that requirement level so if this one was uh non-compliant you see there's a issue related list so it's a issue created against that which makes my requirement non-compliant and I could also see the same issue just for visibility purpose when I'm on my control screen so on the control also I would see the issue that there's a control requirement issue which is autocreated and that is causing your control to be non-compliant fixing it would fix my requirement first which will automatically fix my uh control status so the way it works today is it takes the worst case scenario uh it takes the high water mark So if any of these is non-compliant it makes it as non-compliant and that's how it's driven by the issue if you had three things which were non-c compliant and you would have three issues and if you just fix two of them because again they are individual issues at requirement level it will still be non-compliant because you've not fixed the third one so that's how it works uh we've taken care of all those so I hope you like this feature again this is just the attestation hybrid in consider hybrid with the inheritance how it works today um one other thing I would like to call out is what if one of my inherited one today it's in monitor state but that becomes retired my package got retired for some reason or the control got retired so here it will show you as retired and it will create an issue for you that would mean you would have to move the control all the way back and you might want to change it or generally in Practical scenarios they would fix it up with a new one or they will move it back to uh monitor but you also have a way where you could move it back and you can change your inherited one to a different inherited one or change it to a self-implemented one you could even go ahead and do all those things with that we're going to move to the final topic that we have today is assessment procedure and before that let's look at if there questions let's look at questions I mean I love the fact that it lets you know when the controls are retired and actually gives you a heads up to do something about it I think that's fantastic um there's a couple of questions I wanted to ask this one live because I think a lot of people probably want to know this very basic question what is the difference between a control requirement and a citation within an authority document so citation is still ma to your control objectives and that remains as is we not touching that part as at all citation I would say consider you have authority document then you have citation which is a higher level thing within a citation again you could have multiple objectives or or one to one objectives based on your organization and from the objective if you want to go granular that's how control requirements come into picture so it is the least level the leaf level that you would have is what I call it as uh in Nest uh specifically with the RMF the risk management uh framework process that you have they dictate that you shouldn't have a control which is this big what we are looking at on the screen it might always be difficult so you want to manage them better and that's how control requirements came into picture Okay um next next question can evidence requests be created for control requirements and reused good question so evidence comes when we want to go ahead and do more of testing part and where we link the evidence on the audit part we're going to look at that it's not going to be linked to control requirements just to answer it right now it's going to be linked to our assessment procedure or the control test alog together uh when we look at assessment procedure which is right now I think you'll get more clarity and if you have more questions feel free to let me know po them in the Q Anda it's the third question though there's a third question will you have to redo the package when moving this to a new to the new release no we have taken care of that so there are multiple ways one is because I understand many of our customers might still be in revision four so all these features that we are shipping out of box like the content and things are related to rev five because that is now mandatory and rev 4 is outdated uh so one it's for rev 4 uh rev five not for rev 4 you could actually start with a net new package altogether rather than moving the entire package back you have that one way to go ahead and do it if you already using something like if your package is Midway today and you are upgrading to the new instance we are providing upgrade scripts which will take care of everything so let's say if your controls are not yet created you are still in select state and your package is like that you can remain as this and you don't have to do any changes you will be easily able to adopt to all this changes so our upgrade script takes care of it and if you have packages which are all in monitor State either you would be creating a new package to work on it for your annual cycle or quarterly cycle or you might be moving it back to draft the uh moving it back to the uh step which is prepare if you move back yes it's going to work if you create a new it's going to work if you are somewhere in Middle it's going to work so we taking care of all of those Perfect all right I think you got the next bit of a enhancement let's see so the next thing is about assessment procedure and uh if I go to cam you would see assessment procedure as one of the list so again I have it in my continuous if I favorite this done if you go to your favorites and if you expanders you would see you also see assessment procedure which is a new module that we added now assessment procedures is basically if you see this are for all my identifiers and reference I'm just going to group by so it makes a easy view to understand how it is so these are all my controls that I would have ac1 ac10 is all the controls so in ac1 what I'm trying to say is there are 25 different ways or different steps to test it so in policy and compliance world we call it test steps basically and Nest world or in federal domain World n uses as assessment procedures and this actually defines how should you be testing your control and what it means is for ac1 you may only have two or three control requirements but the assessment procedures can be much more so there's no onetoone relationship between your control requirement to your assessment procedure today which Nish defines as a mapping and so we have also kept it independent of each other how this assessment procedure comes is it will come all the way from your test plan to your test templat so I'm just going to start from my test templates so if you see for all of these we are shipping the test templates out of the box so ac1 is what I've opened here is the reference the first thing that we added is examine interview and test these are the new fields which Nish provides and provides data as well so these are the new fields that we added for your test template and what we also did is assessment procedure is a related list here so similar to control objective requirement which was at objective level you could do new edit and you can updated you can create a new test template you can go ahead and update this and edit everything here but after you've done this when you have the actual control test created it will have these procedures autocreated so you don't have to go ahead and edit it it will be readon option for you and you won't be able to make changes again that's how Nish defines but but in the PNC world you would be able to change it when we consume it there coming to how this exactly works is let me move back to our package list and basically anything that is an assess state is how a engagement is created in cam so I'm going to open the package in assess State you would see control assessment where you have ass uh engagement created for it and based on the number of controls that you have for each control you have control test created so let's look at some differences which are there now as well into how we look at the engagement and how it changed so if I go ahead and look at my um engagement right now I would see this something called as control test this wasn't the case earlier earlier it was named as audit task but because in N or in cam world you only deal with control T this is a cam view created for it and and where you would see all of this named as control test because it won't be any other task type once you go ahead and click into one of them again I'll just sort it so we have something with better data but if you go ahead uh inside the control test here is where if you see it's in cam View and I have schedule which is always there there used to be a design test as option which is no longer there the reason being because this is designed by nest we don't want to redo the design test it's already a nich design coming through so the control is designed by them so design test is no longer required is what we heard and so we've removed it however if you have some control overlays or your own control objective where you still feel hey you know what I still need to do design test you can always go ahead and switch over to your default view and you will start seeing the design test over there so that still works as is and it's still calculated in our Effectiveness based on whatever details that you give there I'll come back to the cam view the other thing was in the operational test if you see now we have all the fields which are autop populated examine interview and test and then you still have your operational effectiveness the way it was where you could say it's effective or ineffective so if I go ahead and say effective you would see my control Effectiveness says effective but the new thing is assessment procedure in this case for this particular difference that is si7 I had two assessment procedure and that is what is also effective hence my control Effectiveness is effective if I go ahead and change one of them and again these are changeable directly in line which is what customers ask for so if I make it ineffective it will update it so it's going to take the higher water mark So worst case scenario any one of them being in effective it will make it ineffective otherwise it's effective I can also say it's not applicable which will skip that state all together so it's still going to make it as effective so the different combinations and permutations that we have gone through and we've validated it you can try it out you can keep it effective ineffective or not applicable if you choose to keep it none it will not allow you to move this further after the review state because you need to actually say it's not applicable or it's effective and that's how you are testing to it so these are new things from assessment procedures uh for the assessment procedure irrespective of one or more of them being ineffective we are always creating one issue out of the box and that is generated at the control test level so if you mark something as ineffective and if I save it and if I move forward what would basically happen is when I go to my engagement and here is where I see the list of control test and based on how I Market I would see them effective and effect perspective over here and that is where the issue also gets created so I'm just going to go ahead and say sort by state so if you see there many of them which are closed in complete or Clos script is what we've done again all of these would always require you to go ahead and update your details without that it will not work so you need to answer these before you move forward to the last date one other thing that we did is while I am in the state let me go back to my package so I was in the state which was in assess if I go ahead and move this package back to previous step this is again the small enhancements which I spoke about which are not highlighted but is what we can look at if I move it back to previous step earlier it just moved to implement nothing happened to my engagement nothing happened to anything else now when you move it it's actually going to close CL this engagement as a whole and it will mark it as closed incomplete so if I say move to previous package uh it will say this action will actually do something do you want to do it or not similarly if uh for this I'm not going to do it it will take a time and series of actually going ahead with it but if I had been in my Implement State and even here if I want to move back to select it's actually going to do something what it is say is it's going to retire my existing controls all of this did not used to happen before before it was just a dummy move it was just moving the workflow State keeping all your controls ases your engagement as is and that's a feedback that we've also heard from customers that we want to undo it as a actual undo of it rather than just moving the state not just that once you go back there is no move forward there used to be another UI action which is move forward which we've taken off so you need to actually go ahead once you move it back you need to get the approval like categorize to select there's a approval select to implement there's a approval you need to actually go ahead and have that approval before moving forward so yeah these are most of our things let me quickly show you the very last thing which is U package which is probably in monitor State yep there we go and if I go to my control assessment here I can also add a new engagement and again this was a thing earlier but the idea was if I have a new engagement and if I create any issues there they were not getting tracked as part of my poems they were just lost somewhere and they were not linked to it so we've ensured that all your engagement issues from this or any future engagements you can still go ahead and it will keep updating in your poems so your poem list is also up to date and it's not changed and that's more of it about the today's demo if there are any questions would like to see that there are yeah well I want you go ahead and go to the first poll we got a quick Poll for you while I ask this question sure is there a way to view the control implementation and attestation information when completing assessments a v to see control attestation to view the control implementation and attestation information when completing assessments uh not as of now however we do look forward to having implementing a smart assessment which is the new thing that you might have seen in our PNC policy and compliance but once we consume there that is where we would be able to do all this things see contextual information even we looking at how do you see the related items about uh what was my previous answer what did I answer for this particular question not just that what is the control I'm answering it about what is the state of it so all this contextual information is something that we are also planning to add once we adopt to Smart assessments which is the new one the new assessments that we have y wonderful any other questions yeah we got one more question why don't you go ahead and show the the poll results I see there are some more answering it's only 44% answer Goa okay so next question is how will the SSP be impacted with this yeah so SSP report stays as this we've not updated that to change anything with all of these however in the next iterations what we looking forward is so that you also have the assess steps and control requirements which are the granular level thing which can be part of assessment not only that we are also looking forward to enhance it with some new features uh which you will see in our product road map so you might want to do digital signatures you want might want to do reporting in word things like that so yeah we are also looking at all those features together as part of at artifacts so there'll be much more artifacts you can work on awesome those are all the questions um we're getting close to the poll here we got one more poll after this we'll share these results I'll just share this result and and then we have one more poll and I have put in the chat the link to the um the playlist on YouTube that you can share with your co-workers that were not able to make the uh the um the the demo today and we got some comments in the in the chat also on you know what a great demo it was and it was fantastic and I know we got one minute left here so I just want to go ahead and thank everybody for joining us thank you for doing the polls for us it's uh really super helpful that we're able to see what you're thinking and what you want um DAV thank you so much for for a fantastic demo we we really appreciate having you here and going through all those amazing enhancements please connect with us on our community join us for upcoming webinars you know we I've got the link in the chat also for our upcoming webinars that you can register for and we're going to be continuing to have them yep and I see we are getting great responses for the poll three so poll three is more related to what should we focus on in the coming future iteration the very specific things for nest are related and I see we getting great participation over there and answers as to what we should work on also if you feel there are other things which are not listed here you can go ahead and put those emails have we've captured the ones which you put at the start we would like to connect one-on-one to understand how we are using today what enhancements we could do better for user experience and overall and we will surely all take all the inputs that you you are providing the valuable inputs into our road map and you will see it in the product soon okay with that I'll end the poll and I'll quickly share the results and there you go thank you so much everyone for participating from around the world giving us your cool comments and helping us with all this inputs it really helps Drive the product better thank you for your time today have a great day hopefully we'll see you again on Thursday take care bye bye thank you byebye