0
22.5.1
Australia Patch 5, Australia Patch 3, Australia, Zurich Patch 12, Zurich Patch 7, Zurich Patch 4, Zurich, Yokohama Patch 12, Yokohama Patch 9, Yokohama Patch 6, Yokohama Patch 5, Yokohama Patch 2, Yokohama
Standalone Application
The ServiceNow® Third-party Risk Management application provides a centralized process for managing your third-party portfolio and completing the third-party assessment and remediation life cycle. Integration with other GRC applications provides additional traceability for compliance with controls and risks.
Note: In version 17.x, Vendor Risk Management was renamed to Third-party Risk Management.
The Third-party Risk Management application includes the following features:
- Third-party portfolio - third-party hierarchy and third-party contacts
- Third-party engagements
- Tiering setup, tiering assessments, and IRQs
- Risk assessment setup, and risk assessments, including risk domains (risk areas)
- Configurable risk calculation
- Automated tiering and risk assessment submission rules
- Security score integration
- Issue management
- Support for third-party scores roll up to risk rating
- Reports and dashboards
- GRC Integration: associate policies and controls to questions in a third-party risk assessment
- GRC Integration: roll-up third-party risk information to an enterprise risk program
Changed
- Rebranded to ServiceNow Otto, replacing Now Assist references for a consistent AI experience
Fixed
- Addressed Arbitrary GlideRecord read in VendorRiskAsmtAjax security issue [PRB1997560]
The following applications are automatically installed when the Third-party Risk Management application is activated:
- GRC: Profiles
- GRC: Compliance Assessment
- GRC: Vendor Portal
Permissions and roles:
- Role required to install the app: System admin (admin)
When you upgrade the Third-party Risk Management application, make sure to upgrade the Vendor Risk Management Workspace and any other installed GRC applications to the equivalent release version. For example, Third-party Risk Management version 18.x is certified to work with Vendor Risk Management Workspace version 18.x and other version 18.x GRC applications.