and we live I believe so I just want to check before I start talking that my audio is working if you bear with me please I've had a few problems in the past excellent might just check in that thank you so welcome to Phil goes deep this is community service it's Wednesday the 22nd of April and you might notice I've had a bit of a haircut so walk in the lockdown look a few other things that are going on at the moment which has been distracting me from doing anything on the channel is this weekend we've got the EU vs. the virus hackathon which my colleague James foot is going to be putting a team forward for so some of the guys from around giver getting involved in that it's my daughter's birthday as well so I will be trying to help where I can but really I can't get too involved unfortunately and then the following week is the start of creator come on so the hack virtual hackathon knowledge 2020 from ServiceNow so we'll be involved in that and look out for a bit more information from us from myself and the guys from Rangoon yeah a few other things happening in the background but really just want to get on with doing another session for community service try to bring a new format into the show to try and keep a bit of tension rather than dragging on so let me try and do this in around an hour keep it to an hour we'll be going through the community and posting so we're looking at the posts that are in the community and I'm going to use some t-shirt sizing so this is the current format and my lovely daughter actually helped me make some props for this not quite sure on the time in jet but I'm gonna try and focus on small and medium size posts so small and medium sized teachers and then what we might do I see little tiny one floating around any big ones will Park them we'll leave them so the big t-shirt might be a little spin-off show we do but without further ado we will get into detail I will check out in trying to do some of my transitions and short cuts using those so I should be able to switch over to my screen yes using keys so I've seen a few posts on the community which have another chance to to get into like I say there's a few things going on and I will try and find over 10 points lovely I will try and find some small and medium so I'm thinking that a small t-shirt we should be able to do in around 10 minutes 10 15 minutes at least to get an answer and medium maybe 25 minutes I'm just noticing better so I'll get the technology working and keep it working so what did I see maybe what do would just jump straight into we're going to focus in the GRC community another thing I'll try and do as well is share the links to the posts as I'm working on them and put a time code against them in the in the description as well so it's just oh my God look at those fast to reply lots of points scoring opportunities here let's look at the leaderboard as well sitting there around 6000 redundant way from second place there so watch out Shiva I'm on your tail in GRC can we record phone calls how is it done okay small t-shirt right I think that's a no might even be a tiny one to be honest we're gonna set also what I've got here is a timer - yes yes a small first time using this on the show as well so small what did I say 10 minutes so this is tiny and to put ourselves against the clock here tiny it's only one five minutes start timer okay then on to this yeah sure okay we've got a timer running yeah five minutes in the background so in GRC can we record phone calls image AC module of service now is there any way we could record calls now I don't believe this is the job of GRC I think in if we go to Docs that there is some integration some telephony integration where from you know Service Desk perspective CTI from a Service Desk perspective you can have the staff calling out or when somebody calls into your service desk it will connect the call automatically through to the desk agent they'll be on the phone and the incident ticket will know the caller and identify them through this CTI so that's the only place where I'm aware of having the integration and you can see here customer service agents can do the following with CTI making the ongoing outgoing call to a phone number receive an incoming call transfer a call place a call on mute or set their availability status so this is supporting inbound and outbound telephone calls I don't believe that the the recording of phone calls is in here but let's have a let's start this off who we talking to Harry okay all right Harry integration just have some 11 e integration see it's just Google Oh DuckDuckGo to create cool service that's cool yeah I am Not sure that that's possible to be honest with you I guess you could look at you know some other potentials there are integrations with teams you know through the virtual agent and you know chat BOTS integrations perhaps that's something to explore but that wouldn't be the phone call itself as far as I'm aware that's really the chat conversation I just feel like that belongs elsewhere not on the platform but let's check what is your use case a couple of use cases I think we could assume might be in Investment Banking for example you know phone calls have to be recorded but they have very specific system for that I don't believe that lives on the platform so you know main question here what is your use case what is it we're trying to solve I'm also going to take a copy of the community ID this replied let's pause that timer where do we get Oh coz was you okay it didn't tell me what we got to but we beat the five minutes for a tiny one I'm just going to share this link into the chat description maybe I'll do that next time when we first start looking at it okay so that's one down so tiny didn't wait what do we say so 20 minutes for medium and 5 minutes for tiny yeah we're trying to use t-shirt sizes because there's something you might be familiar with when we're looking at estimating you know in a sprint or in a story sometimes we use story points sometimes customers want it really simple just what is this small medium large so I'm just trying to bring a little bit of that to this how to implement control I'm just picking on these be first to reply okay so I am working on change management policy here I want to align control with change management process to prevent policy violation eg change should not surpass without approval and how about change management process but it has its own workflow can we control the process from GRC itself how can i implement or enforce the control it's a business process to follow policy okay what do we think we could answer this so we could go into a bit of detail so really it depends how we want to answer this well I'm gonna say that's a medium all right [Music] let's start the timer just because I want to go into a little bit of detail here so go to the new timer and drag so of using here as well mount meru moreno mary narottama mary narottama and it's using the Pomodoro Technique okay so it just seemed the easiest way to to get a timer running so off we go twenty twenty minutes to go so let's look at this shebang so a change management policy see you can't enforce the policy from GRC I would say I would say GRC kind of is like the policeman so it can alert you if things are not being followed correctly and it can you know generate issues and give you the route to remediate those issues so let's jump into my instance change management let's just go and see what data we've got under change so if I go there by data for change management I've got no change requests I think I cleared out all my demo data so let's just do a normal change here's a change okay so how are we going to control this configuration item I would suggest we could do it by department so scoping is you know the question here whether we want to look at ok who's requesting it who is assigned to it we need some kind of reference field to be able to tie it back to what we scope our controls by typically typical use case will be the CMDB and this could be a business service yes so let's look I'd say HR management ok so we've got a change just save that have no idea what the change approval looks like in this instance the last time I did change management on a demo instance was was a while back but it is one of my favorite areas to play and quite often this will have been customized for a use case anyway so we've got the affected CIS we don't have any approvers is there enough in here to request approval you'd expect some kind of justification so here is a change I want to update justification would be they attest risk and impact zero back out plan go back test ban make sure it works so I'll save these changes and I request approval a song okay so the change management quest approval and we're refreshing the impacted services that's really nice don't have any approvers in here so it's scheduled where is the some crew stays here something like this in here let's show that well I just want to get gets hold of some kind of example there that makes sense so wait for condition change moves to assess approval action requested okay so the important thing here is we've got a CI and we've got a change then what we can do is under I'll start with control objectives in fact in our demo data then we might have something before change management so change test all software changes so one approval that was the use case so name contains change and name contains approval validate the system before implementing approve changes here we go it's just perfect so this control objective is tied back to several citations you can see Co bit you know this is a typical framework that we would see for looking at the ITSM type processes but also we can see that we've got NIST got PCI as well as sort code bit in here from this one control objective our entity type business services so do we have HR management this is perfect right so this control we've got some indicator templates in there as well so dis control two indicators this is already demo data so I'm not even creating anything I should have set this as a medium as a small t-shirt let's just take a look at this indicator okay it's gonna run monthly I think the important thing if you are looking at indicators when you have your frequency you should also consider the time frame that you have in your the criteria because you need to be able to succeed if you don't have a time frame then it's possible that your indicator fails and it will always fail you'll never never be forgiven so I I would enhance this by saying in the last month so I check monthly and I care about data in the last month okay however that's it we do okay now it's looking at closed so I'm going to say we have only in these two states but it's enclosed so approvals not approved state is implement review closed what state is my control my change sorry here is a change it's scheduled so if I just run this fast okay let's say execute so I'm running the indicator for HR this should method fail this should pass okay we should get an indicator result that passes because it won't find a change that meets his condition okay there we go we've just seen this now yeah just now passed if we look at the data in here look at the indicator result there's no change requests now if I move this to implement I can't see the approved field let's just say show XML is approved okay so this will still this will still pass if I execute this it's in implement but it's been approved so it's meeting the requirement true so for me this is a perfect scenario of how to enforce the control to business process to follow policy right so so let's say you're looking at change you might also say ITIL as well but I think Cove it has a little bit more I'll take priority maybe the right word it's not that items not important I think obit seems to be something that is more relevant so we try and find the sorry the control objective or the control so I've got too many tabs like them to implement here we go an example here might be prove change request prior to implemented if you check the demo data you will see this go to the control objective just grab that reference if you check them with 18 you will see this associated indicator change with change your CI and you can use indicators you can use gr C's automated indicators to enforce and raising issues so I think that's enough we could link goodnight this video just looking on our screen you're really 40 minutes in already time flies okay and in terms of estimation she said medium twenty minutes and we got there six minutes remaining okay close some of these down sorry you probably don't see my tabs but I've got quite a few open back to the community now that's GRC so I know we've been live for 26 minutes do you think another one o'clock right back to the community so the next one there are a few more in there be the first to reply yeah saved it didn't I it's going to see what we can do you suck one reports for datacenter partners suck one okay this next to over and sock one and this is not my let me say my favorite areas just not something on math it's hardly clear on for for sock sock one regulation so in your sock documents you reference Qualis as a sub service sorry Catherine I'm not going to attempt to answer that because I don't know and I believe that you'll have a lot better response from some of the others on the community I looks like Catherine made two posts about the same topic we need sock one reports for dates and the partners what I can check colleagues in on this one right now some messages have to step away hold on okay Demetrios this one I did see this one floating around how can I perform a calculation on a risk assessment and Eric said in here yet you can use a script I would recommend now to use the brand new advance risk assessment to be honest advance risk assessment I still need to I need to check this out so what we could do is let's just take a look at Advance risk assessment now because in the chat the advance risk assessments not an area I've had an opportunity to investigate in a lot of detail as you can see here so he killed have you been released in March and I have done this a number of different ways obviously scripting is an option but scripting is not very maintainable another option is flow designer so I would recommend flow designer if you know Eric and Utkarsh had not recommended it's new facts you can see that you know hooker she's from service now Eric was service now so you know these guys know they know their stuff let's take a look if we go to Docs and just talking here advanced risk assessment and under service now advanced risk assessment this is jump into the overview so it's a nice nice point to start and advance risk assessment various kinds of risk assessment methodologies and enables customers to integrate risk assessment as part of their overall decision-making process okay great before understanding advanced risk assessments it is important to understand the five key principles of risk management risk identification analysis evaluation treatment malla truth okay so I was not gonna read all of those things I would say those things are covered in GRC risk management anyway so advanced risk assessment is performed on factors or questions it can be performed for an entity such as an organization to be able to use advanced risk users must enable the migrate to advanced risk assessments okay let's just check that property out so just intrigued on here just assessment methodologies this might be a topic for another session really so we need to enable that this is an advanced risk so it it's actually part of the advanced risk which makes sense advance risk assessment most part of the advanced risk application which includes risk event risk roll-up and so on so helps us determine losses enables organizations to calculate risk ratings updates risk ratings continuously highly configurable so we've got here that do a detailed assessment of the risks and we're also including mitigating controls in around what is a risk assessment methodology he must first define manual factors or group factors as soon as anything in the demo dates already so we've got a risk assessment methodology so we've got some rounds enterprise risk assessment assessment types okay.i I can tell this is a this is a bigger topic not what I was hoping to cover on on community service one thing we could do which I agree you know advanced risk assessments very definitely going to be worth looking at there's a lot in there and I might do that on a separate session where I kind of know where I'm going going to be going what I would like to do is just give an alternative so you can create a script to handle that I cannot really make much recommendation on an advance risk so I'm going to just say here advanced risk assessment certainly very interesting I need to applause one of the things I found the known you know I was watching one of the live codeine happy hour sessions recently and there was mention from Andrew Barnes about decision tables and when to use decision tables so I thought I had a prime case for using decision tables where we took the questionnaire and looked at the possible answers and said okay if you get this answer if you answer a five-four three-two-one on your risk scoring then let's translate that to the relevant risk criteria value but when I then put it into flow designer it still wasn't quite behaving how I expected it to behave and so the decision table did give me a degree of abstraction laxity but it still felt a bit clunky so I'm not sure that I was necessarily using it in the most efficient way certainly you can code it probably with a lot less effort certainly for myself I would write the code much quicker than I would do the flow designer but then there's the maintenance side of it and also with flow designer what you might find is that the the users of flow designer are not going to be your kind of typical GRC personas okay so they might need that that layer of configuration and that's where advanced risk assessment might be perfect because you can go in there and tune your logic and you don't have to learn flow designer and you know flow designer might well kind of give you you know the permissions you need for that it could give you access to other things so with that in mind although I think flow design is really great and I'm still learning more about it all the time I'm not sure that is always the best answer to these but sometimes it is better than coding with coding it's very simple to go and kind of translate and get an average for example so in this scenario you know probably that's the one I would jump to but I like to see where flow designer can can really help to solve these problems so respective alternatives coding could be one answer but there's also the flow designer so you still need to do a bit of configuration to get this working so this has look back at the question the assessment with five different impact categories the values of the choice list boards calculate the average impact score and bring this numeric value back to the risk record so I assume actually the risk record has a numeric value on there assuming the risk [Music] trying to simpler there's also if you look at vendor risk management the way the vendor risk management leverages the waiting and the the scalps within the assessment you know that's something to be aware of as well also waiting scales I didn't put time right I thought we were going to be going into a lot of detail there but I'm just conscious of time so I was hoping to be able to answer that or at least go through what is advanced risk but clearly that's the whole session in itself that's a big t-shirt for sure okay policy exception workflow in Orlando with virtual agent demo once we've answered a form design missing view cannot edit did see this all right and actually I am unable to edit the target view in the form design let's take a look at this because it's been replied to are you in the correct application scope make sure you apply yeah this is an application scope this is just a ten minutes small t-shirt all right let's get the timer on ten minutes and that will get us roughly two to the top of the hour 20 minutes so we might be able to get to smalls in let's have a look I was copying oh ha ha gents how we doing right okay I was not watching chat you're right I've got Jase Andrew Barnes Brad in case I think it's great right what Thanks thanks for tuning in I'm honored to have you guys on board yeah so are you looking at this all right so I don't know if you missed it I'm using a t-shirt rate in the post right so I'm saying this is a small give me 10 minutes and that means I've got the timer run in I need to switch don't have a string deck shortcuts eight minutes to try and answer this now when I took a look at this in the brief before hand what I think is happening here I'm unable to edit the target view in the form design but sometimes if you access something through another view it kind of holds on to that view and then when you go in and try and edit it the view is not really there so I think that's what's happening here so coil and see what we can do so if we jump into so I got NIST RMF enabled misters refresh my browser close down the docks it's a missed RMF I'm not sure if I've enabled that accelerator on this instance that's gonna blow my small t-shirt or well our plugins seven minutes look at the child I like the idea at the time here there are other ways to do timers with OBS and so on but it look like a lot more hassle so I've just jumped on a Pomodoro website but it's going to update quality and compliance to version 10 as well yeah I think on some of the shows that I've done so I'm still just testing all the technology out and seeing if the format works but what I've found is that I end up going for two hours two and a half hours and you know I don't tell anyone I'm starting I have no idea when I'm gonna finish end up like a bit of a wreck at the end so I thought what I would do is try and create a sense of urgency and gamification for the the community I don't know what happens if the timer runs out I haven't thought that far ahead but I want to see how many t-shirts I can solve and then maybe a breakout session another show called the big t-shirt for the things that we couldn't tackle and by the way my kids help me you know make some graphics for the show I have anything that's too big and you know lock advanced risk assessment we cover that in a separate show as this worked it says a hundred percent complete sometimes this let's duplicate the tab I don't know that so let's read the issue again so I am unable to edit the target view in the form design so create target goes into the target and creates the form design you're in the correct scope but why am i unable to edit the form design I think the view edit that view informs on I think it doesn't exist another weird thing is if I open the form design from the table I do not see yeah yeah I think it doesn't exist I think in the route that you've gone through there Kyle that will be it's just holding onto the view so I'll try and do is recreate that I'm not sure what you're actually trying to do by edits interview so I can't really help you with that if we can recreate the issue all right there we see 16 over 130 so it said it was a hundred percent complete it's still running yeah we can try and recreate this and I can probably show it elsewhere without this I've got over t-shirts but Alea medium 20 minutes maybe small the thing is my daughter made these and she did them green so with the green screen they ended up kind of vanishing a little bit and then she also made me a little tiny one as well yeah I did mess around with After Effects and so on but that seemed not the easiest option yeah I'm glad you guys are on board anyway I'm Lucas I'm honored they see what we can do then target I know he says no person complete refresh there we go for our success at last I need some sound effects for three minutes twenty did i refresh the whole platform you can see on being a bit impatient here and I know this happens if with customers sometimes have to tell them to calm down a little bit stop clicking just let things kind of work themselves out here we go miss Tara Matthew see I just needed a little bit of patience so under target targets you can see that it's given us this NIST RMF target view so I think if we look and edit this module we'll see that the view name is passed into the link type and if we look at targets and configure list layout there is a view for list okay then when we go into one of these records is gonna carry that view with it so I'm looking at the form right there is no view okay okay so that it says here view name mist RMF targets so if we configure form design which I never use by the way unless I want to remove form sections if I can't to clean this way I find to remove fourths form sections I don't want to go into all the tables form configure form layouts this is where I build my forms most of the time it's got the view name so I think my assumption at the start was was wrong right hold on I'm in the wrong section I've gone into not going to create target but I am in the target table create target there just go through the same route create targets it's got the view name pick a forum design and we've got the view name at the top so actually I am not able to recreate that issue but what I was trying to show was a scenario where maybe we create a view that doesn't exist on the table and it does huh it does still hold it you can remove form two sections in form designer look at the weird view name at the top you know this bit this is this with you maybe because it's known it's a new record oh my time I ran out by the way I didn't get the audio for that happened we failed on a small t-shirt learning so view yeah that it's not available to select configure form design if I change to so this is in a different scope GRC nest RF news case accelerator plus by the way I'm using SN you tilt it could be it could be something to do that that might be technical names off that's why you see yeah that's why that was showing up SN utils plugin view still not available configure form design oh you've got the audio I do apologize I'm not monitoring this at all I failed so I am now in the right scope we do have the target name at the top the view name for it missed RMF targets along with default I can't recreate the issue so did I share this in this is what I was trying to do to keep track just going to post this in the Chapman case I've didn't already what I once tried to do is update the description afterwards as well because otherwise you did no idea what's under video and provide the links to the community posts the best way I can find to do that is just chucking in the chat so I call this is check what version of the polish running ten yeah running version last night just because he once he's into form designer then what you know let's say we fixed a few what is it you're trying to actually do with form designers so what you can do obviously the view label and the view name can be different it looks like there must be a view or actually enforcing this created you can give it a nice name afterwards but as long as you give it the right name to start with then that should enforce the view rule the table do we table on here yes NGO see target I think it was there's no view rule oh it's coming from it's coming from the menu it's linked him from the menu it does exist that's because SM GRC targets SM GRC target table obviously comes in and is available for many different places and this is part of the NIST use case accelerator so that form layout the list layout etcetera is going to be very specific to NIST which is risk management framework I believe our M F stands for show them how to get to the view from the view table yes okay thanks Andrew so views if we system UI views create it I thought it did say you can check on whose tableware exists I thought he said they checked if I open the form design maybe I misread something okay so if we go to UI views and then we look for the name which is missed our targets you can see it's there and please post results here we'll pick this one up now I'm replying to it that should automatically subscribe me so I should get the updates I hope that's helpful got the whole team here or the regular suspects oh did we both have the same idea for community service because I swear I came up with that a few months ago I can say andrew is great minds think alike you know I just started streaming one day on lockdown in quarantine and then I gave it the name community service so I don't know if you know community services in the UK but it's kind of punishment it's not meant to be punishment I just thought I could try and do something positive for the community so I was looking at the Co vid 19 apps however my kind of area of kind of focus is around GRC so that's where I spend most of my time in the community now yeah just trying to score a point to get up the leaderboard and help people along the way one thing I did want to do is to just I'll give him helpful as well trying mark people's posts helpful when they get involved it's always nice to get people I think active in the community for me as well like when I started in ServiceNow the community was my go-to place so what I started doing was going in looking at you know kovat apps the emergency response apps looking at GRC community and if I kind of exhausted all of the new posts in there then I'll go back to the main forum and try and answer one or two in there so I mean if you like it I'm glad I'm happy and I'm glad that you've tuned in I find it difficult I've got distracted last time I was on weave the chat was a little bit less busy actually and I got completely distracted with the chat versus what I'm doing in the community so I know when you guys do live code in happy hour kind of have like three or four of you and get one person to check the chat so you know maybe I need some friends how are we doing on time I've hit the hour mark I said I would try and keep this to an hour I'd love to keep going but tonight is also going to be quite interesting in the sky's the Lyrid meteor czar out tonight and some of these styling satellites are going to be above the UK so I'm going to try and go and see a bit of that in the night sky but I will try and reschedule some other stuff I've realized I'm talking from my see my transitions go oh by the way chuck was streaming the other day just down in the right corner and I think he had some really cool transitions it was looking to flow designer again so this great stuff has so much so much activity now around ServiceNow JC's link where he's checking the internet for anything to do a service now is amazing obviously ServiceNow dev program I'll link to that channel again look out for live code in happy hour the hackathons virtual hackathons going on for creator con get registered for knowledge 2020 kicking off with the live coding happy hour on the Friday I believe and it's all weekend and then this weekend there's the EU vs. the virus hackathon taking place as well so lots of stuff going on thanks to everyone for tuning in and all the feedback keep posting in the community and thanks a lot for getting involved appreciate it have a great evening or morning if you're in the US and stay safe thank you