Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

ServiceNow GRC > Vendor Risk > Flashcards

Vendor Risk Flashcards

1
Q

What are the 6 key capabilities for VRM?

A

Vendor Portfolio, Vendor Tiering, Assessment Mgt, Vendor Portal, Issues and Remediation, GRC Integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the Vendor Portfolio

A

Database of vendors and vendor info including contacts, biz svc and other.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What table contains the vendor info

A

Company (core_company) (extended)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Vendor Tiering

A

Vendor tiering is used in VRM to help orgs effectively assess vendors at right time .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is vendor tiering score for

A

Allows orgs to better manage the vendor relationship

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is used to create a vendor tiering assessment

A

a Tiering questionnaire template

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who completes the vendor tiering assessment

A

Internal assessors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Assessment Management (high level - what does it allow orgs to do?)

A

Allows orgs to create templates for assessments with varying content and recurrence intervals based on vendor tier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 2 types of questionnaires

A

Proprietary ones created using the visual designer or Built in shared assessments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is an example of a shared assessment (vs. a proprietary one)

A

Standardized Information Gathering questionnaire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How are assessment responses scored

A

Automatically using a robust hierarchical weighted scoring framework that can be tailored to meet customer requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the Vendor Portal

A

Centralized location for all vendor interaction and communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the vendor portal provide

A

Visibility into what needs to get done by when, who is assigned, and status for vendor stakeholders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are Issues and Remediation used for in VRM

A

Issues can be created based on assessment responses and design remediation plans and share them with vendors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How are VRM and GRC integrated

A

Link control objectives with questions in a questionnaire template, inadequate vendor responses can automatically mark controls as non-compliant.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the benefit of the VRM to GRC integration

A

Top down traceability from an authority doc to the question in a questionnaire for a specific vendor. Non compliant controls can automatically adjust residual scores of risks associated with the vendor, which are then rolled up into other IT and operational risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

VRM Benefits (5)

A

1) Gain efficiencies through automation of routine processes and risk scoring, 2) Reduce risk exposure with integrated view of risk, reporting and vendor tiering, 3) respond to high risk vendors with consistent assessment and remediation process 4) increase communication and collaboration (portal) 5) Leverage a unified platform to provide more comprehensive definition and proactive approach to managing risk, compliance and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Explain cyclical vendor assessment process

A

1) Request comes to risk mgt team. 2) initial tiering process is performed to determine inherent risk of 3rd party 3) Assessment chosen to match the tier and sent to vendor 4) When responses received, risk analyst generates findings and reviews with SMEs for actions 5) Issues are shared with vendor 6) Based on findings and status of issues, residual risk of 3rd party is determined and reported out 7) 3rd party is monitored and events such as incidents or negative reputation reports are triaged.
Assessment process repeats periodically until company no longer does business with the vendor/3rd party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What determines frequency or period between assessments in the cyclical vendor assessment process

A

policy or regulatory requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the 6 steps in the VRM process

A

Tier, Assess, Generate Findings, Remediate issues, Report risks, monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the. components of the Tier step of the VRM process

A

Internal tiering assessment, Security scorecard integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the components of the Assess step of the VRM process

A

Assessments, security scorecard integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the components of the Generate Findings step of the VRM process

A

Vendor Portal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the components of the Remediate Issues step of the VRM process

A

Issue Management, Remediation workflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are the components of the Report Risks step of the VRM process
GRC integration
26
What are the components of the Monitor step of the VRM process
Security score submission, Tier based submission, repeating assessments
27
What are the states for the Vendor Tiering lifecycle
Draft, Awaiting Response, Tiering Assignment, Closed
28
How is Vendor Tiering used
To classify vendors into categories of potential risk, determined at the time of onboarding
29
Vendor tiering - internal or external survey?
internal
30
What are the vendor tiers
none, minor, low, moderate, high, critical
31
What are the states for the Vendor Risk Assessment lifecycle
Draft, submitted to vendor, responses received, generating observations, finalizing with vendor, closed
32
What are the 2 components combined to make a Vendor Risk assessment
Assessment Template and a vendor
33
What are the 2 components combined to make an Assessment Template
Questionnaire Template and a Document Request Template
34
What is contained in the vendor portal
assessments, contacts, deadlines, issues and remediation
35
What happens in Assessment Management via the portal ? | this is on test per Rick's notes
Respond to Questionnaires and Doc requests submitted as assessments. SIG is supported. Questions are parsed and managed individually with status for each question tracked to completion
36
What happens with Issues and Tasks via the portal
Create and delegate vendor issues and tasks, provide vendor with access to update and respond, assign tasks to team members to support resolution
37
What happens with Vendor contact management in the portal?
Distribute vendor contact management to drive issues and assessments closure. Delegate contact management to primary vendor contact, assign responses and tasks to vendor team members
38
What are some criteria/methods for determining if an assessment is to be created
tier based, score based, default vendor tiering scale, default risk rating scale
39
What table are vendor contacts stored in and from where is it extended
vm_vdr_contact extended from sys_user
40
What table are vendor risk issues stored in and from where is it extended
sn_vdr_risk_asmt_issue extended from sn_grc_issue
41
What is the name of the Vendor risk module
com.sn_vdr_risk_asmt
42
What are the internal roles
Vendor Risk Manager (sn_vdr_risk_asmt.vendor_risk_manager), Vendor Risk Assessor (sn_vdr_risk_asmt.vendor_assessor), Vendor Risk Reviewer (sn_vdr_risk_asmt.vendor_assessment_reviewer)
43
What is the Vendor Risk Manager role for
Manage vendors, contacts, assessment templates, questionnaire templates, doc request templates and scheduled assessments.
44
What roles does the Vendor Risk Manager contains
Vendor Risk Assessor and Vendor Risk Reviewer
45
What is the Vendor Risk Assessor role for
Manage Vendors, contacts, assessments and issues.
46
What roles does the Vendor Risk Assessor contain
Vendor Risk Reviewer
47
What is the Vendor Risk Reviewer for
Reviews and edits vendor assessments.
48
What are the external roles installed with VRM
Vendor contact (vendor_contact)
49
What is the Vendor Contact role for
Answers questionnaires, may own remediation tasks. Primary contacts are responsible for assessments and can manage other contacts,
50
T or F Vendor contacts are in sys_user
True
51
What role do vendor contacts automatically have
snc_external
52
Who gets snc_internal
All existing users when GRC:VRM is installed
53
What are 5 config steps for VRM
Populate vendors, clean data, populate contacts, assign primary contacts, tier vendors
54
How can you clean the vendor data
Field normalization rules, data import/transform, fix scripts.
55
How do you use field normalization in cleanup
Activate the separate plugin
56
What are the 3 tier rating values on vendor record
Risk rating, Rank Tier, Vendor Tier
57
???Which rating tier values are set manually by customer
Risk Rating, Rank tier and OPTIONALLY Vendor Tier - see Impl Class p49
58
With the VRM to GRC integration, what are the Related lists added to the Company/Vendor table
Entity Types, Risks, Controls
59
What is table name for the tiering assessment
sn_vdr_risk_asmt_vdr_tiering_assessment
60
What is table name for the tiering questionnaire template
asmt_metric_type
61
Where are Questionnaire and Doc Requests templates stored
Assessment Metric Type table - asmt_metric_type
62
Where are assessment categories stored
Assessment Metric Category table - asmt_metric_category
63
Where are the questions stored
Assessment Metric table - asmt_metric
64
If a question in an assessment has choices/answers, where are those stored
Assessment Metric Definitions table - amst_metric_definition
65
What is the internal term for a question on a questionnaire?
Assessment metric
66
How can you connect parts of the assessment to GRC?
Assessment metrics/questions (within categories that fall under questionnaires or metric types) can be related to policy statements prior to conducting an assessment
67
T or F - Document Requests have a risk score
F - they have a risk rating (H, Medium, L)
68
What determines document requests risk rating
Answer to first question (do you have document...)
69
What are the SIG levels
Lite (non-crit), Core (Biz Crit), Full (situation specific additions to core or lite), Master (repository of completed Sig ?s and correct answers)
70
What is module name for Sig Questionnaire integration
com.sn_sig_asmt
71
What are 3 ways vendor risk assessments are created
manual, vendor tiering (auto) and vendor security scoring (auto)
72
Where are repeating assessments stored
Repeating assessment table - sn_vdr_risk_asmt_repeating_assessment
73
What determines Risk rating on Vendor Risk Assessment
Rollup from individual questionnaires and doc requests
74
?? How is Assessment rating calculated ??
Not stored in database. getBusinessServiceCriticality will find most crit biz svc and use the weight from that rating scale record. ?? I don't get this.
75
What happens during the Generating Observations state of the Vendor Risk Assessment lifecycle
An assessor generates observations which may create issues.
76
What table store vendor risk assessments, extended from..
Vendor Risk Assessment - sn_vdr_risk_asmt_assessment, extended from planned_task
77
What can cause issues to be auto-generated
Issue Generation rules - based on incorrect responses for selected questions
78
What are states of the Vendor Risk Issue lifecycle
New, Analyze, Submitted to Vendor, Finalize with Vendor, Review, Closed
79
What table stores vendor risk issues, extended from
Vendor Risk Issue - sn_vdr_risk_asmt_issue - extended from sn_grc_issue (extended from planned_task?)
80
What are steps for a vendor risk issue remediation
Create task, accept issue, request addnl info, vendor to remediate
81
What can be used to track the steps to address issues?
tasks
82
Who can be assigned tasks created from issues
internal or external individuals
83
Where are tasks created from vendor risk issues stored
Vendor Risk Task - sn_vdr_risk_asmt_task
84
What can a vendor risk issue be related to
Vendor, Vendor Risk Asmt, Question in a questionnaire in a Vendor Risk Asmt
85
Integration touchpoint with GRC P&C
Vendor Risk Issue table will have a policy exception related list
86
What is the vendor risk task lifecycle
New, Submitted to Vendor, Work in Progress, Review, Closed
87
** How can someone that is a Vendor Assessment Reviewer create a task? They cannot see the Filter Nav option to Create Task because they do not have Vendor Assessor role.
Go to a Vendor Risk Issue and go the related list of tasks.
88
What table triggers events
Vendor Risk assessment - sn_vdr_risk_asmt_assessment
89
**Vendor Risk assessment notifications are made up of...
Events, Notifications and Run Script workflow activities
90
Where do you change the company name for the vendor portal
System property sn_vdr_risk_asmt.company.name
91
Once an assessment or doc request is assigned to vendor, primary contact can ...
Invite others to collaborate or assign to another contact
92
**T or F - Primary contact can assign SECTIONS in the questionnaire or doc request to individuals
F - the whole thing can be assigned over, but not sections
93
T or F - A questionnaire can only be completed by the assignee
True. Others can only read it
94
VRM integrates with what in GRC
P&C, Risk
95
GRC to VRM integration - Control is marked non-compliant or compliant, what happens in risk?
Calculated risk score of risks for the vendor is adjusted
96
** response to question (tied to a control obj) results in control status going from compliant to non-compliant or vice versa.
Per Rick's note - the answer is yes.
97
What are steps to integrate GRC and VRM
Relate a question/assessment metric (in a questionnaire template) to a Control objective. Or do the reverse and add question/am to control objectives via a related list. In both cases, the Control related to the Control objective will be updated based on the answer to the question
98
Integrate GRC and VRM what related list do we see in Control Objective
Assessment Metric/Questions - used to link answer to the question to a particular control
99
***??? Integrate GRC and VRm, new related list Assessment Metrics, what is the qualification
Eval method in Vendor risk Assessment
100
**??Integrate GRC and VRM - what related list do we see on the Vendor Risk assessment
Controls for that vendor
101
**GRC to VRM Integration - Control Status will get updated based on Vendor Risk Assessment - when? what state?
Vendor Risk Assessment is in Finalizing with Vendor or Closed
102
What changed with the vendor portal URL in v 12.
Starting with version 12.0.4, the legacy version of the Assessment Vendor Portal, launched using [your instance URL]/vdp, is no longer deployed, enhanced, or supported. The new version, launched using [your instance URL]/svdp, operates the same
103
What are some recent assessment engine enhancements
Multi-selection and choice can use normalization scoring, Info fields can have images, video, links, etc., Questions can be dependent outside their category, min max for assessment score
104
What are 2 external integrations to VRM
bitsight and security scorecard
105
What fields are mandatory on Vendor Contact
First, Last, Email, Vendor
106
What are values of Risk Rating and Vendor Tier
1 -Very High, 2-HIgh, 3 - MOderate, 4-Low, 5-Very Low
107
What makes a VR Issue show up in portal
Visible in Portal, State Submitted to Vendor or >?
108
What fields required on a VR Issue
Just Name until you submit it to the vendor, then Vendor
109
What roles required to see vendor portal
snc_external and vendor_contact
110
What does SIG stand for
Stadardized Information Gathering
111
What are some things you can do in the designer
Preview, copy, Add Categories, Add questions, create new questions, specify a correct answer, dependencies between questions

ServiceNow GRC (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions