How to create RULES and MITIGATION COUNTROLS in GRC 5.3

Question

Hi,
We are working on GRC CC 5.3.Could you please refer some of step by step procedure documents for creating new RULES and MITIGATION COUNTROLS.
Thanks & Regards,
KKRao.

Answer 1

Hi KK,
Frank is right, it is not just technicla steps but clear understanding of what you want to mitigate.
I assume that-
1. You have a defined rulebook.
2. you have created all risks and rules are generated.
3. You have run risk analysis in your system.
4. You have now list of risks exposure in your system and your business people have to get a look on that and to decide what is to be removed and what they must retain to run business.
5. You have remediated all authorizations whic hare not neccessary at all.
Now you have list of mitigations.
You may do it at two levels-
First you need to clean all roles. Mitigate them.
Second user level-If user is getting violations via two roles, you need to decide whether you want ot keep them or not.
If not, then you will have to remove one/more roles.
If you want to keep, then you have to mitigate them.
Regards-Sabita
Mitigation procedure-
1. Create a naming convention which clearely states mitigation nature-e.g. which module it belongs to role and risks.
1. Create mitigation control and associate approver, monitor, risks to them,.
2. Mitigate Roles using contorls specifying which risks you want ot omitigate.
Same procedure for user mitigation.