CIS-VRM Sample Questions & Answers

Flow Designer is the modern and recommended approach for creating complex, conditional approval workflows. A flow can be triggered when an issue is created or updated. It can then use 'If' logic to check if the issue's severity is 'High' and the related third party's tier is 'Tier 1'. If both conditions are met, it can use the 'Ask for Approval' action to route the request to the specified user or group.

The standard ServiceNow GRC process is to elevate a vendor risk issue into a formal Risk record in the Risk Register. This allows for comprehensive risk assessment, scoring, and treatment planning. The Risk record can then be directly associated with the specific Control Objective (e.g., a specific HIPAA control from the UCF), creating a clear audit trail from the assessment finding to the compliance framework.

When mapping a source field containing a display value (like a country name) to a target reference field, the correct approach is to use a standard Field Map and specify the 'Referenced value field name'. By setting this to 'name', you instruct the Transform Map to look up records in the referenced table (core_country) where the 'name' field matches the incoming source value, and then populate the target field with the sys_id of the found record.

The IRQ is an internal-facing questionnaire. Its primary purpose is for the business owner or relationship manager to provide information about the nature of the engagement with the third party (e.g., what data they will access, how they will connect). The answers are then used to calculate an inherent risk score and automatically determine the third party's tier, which in turn drives the level of due diligence required.

While the sn_vdr_risk_asmt.vendor_assessor role provides the necessary permissions to perform the action, the 'Generate Observations' UI action has a condition that requires the logged-in user to be the individual specified in the 'Assigned to' field of that specific assessment record. This ensures that only the designated assessor can advance the assessment.

While SAM Pro can be a valuable related application for managing software vendors, it is not a core component for meeting the specified requirements of centralized data, risk-based tiering, automated assessments, issue approval workflows, and a vendor portal. The other options directly address the CRO's mandates using core TPRM functionality.

The ServiceNow Virtual Agent can be configured and exposed on the Third-party Portal to provide a conversational interface for third parties. It can be designed to answer frequently asked questions, guide users through processes, or create cases for the internal TPRM team if the issue cannot be resolved automatically.

The default assessment lifecycle includes several key states. 'Submitted to Third Party' indicates the assessment is with the external contact for completion. 'Finalizing with Third Party' is a state where the internal team reviews the submitted responses and may ask for clarification before closing the assessment. 'Pending Approval' and 'Awaiting Implementation' are typically states for Issues, not the assessment itself.

For security-related events like data breaches, the best practice is to route the alert to the Security Incident Response (SIR) application within ServiceNow Security Operations. A security incident can be created, which allows for a formal, structured investigation by the security team. The security incident can then be linked to the third party's company record and a corresponding GRC Issue can be created to track the risk impact within the TPRM application.

False. The sn_vdr_risk.vendor_admin role has limited administrative capabilities, primarily focused on managing vendor records and contacts. The role required to configure core application settings like questionnaire templates, risk scoring, and tiering rules is sn_vdr_risk_asmt.vendor_risk_manager.