{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":17855,"path":"governance-risk-compliance/policy-and-compliance-management/t_CreateAPolicyStatement-2.md","title":"Create a control objective","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create a control objective\n\nA control objective is an objective, direction, or standard that acts as guidance for company interactions and operations. Control objectives can be categorized, classified, and related to policies.\n\n## Before you begin\n\nRole required: sn\\_compliance.admin, sn\\_compliance.manager, sn\\_compliance.user\n\n## About this task\n\nTo understand the difference between a control objective and a control, see [Structural overview of Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/pc-structural-overview-policy-comp.md).\n\n## Procedure\n\n1. Navigate to **All** > **Policy and Compliance** > **Control Objectives**.\n\n2. Click **New**.\n\n3. On the form, fill in the fields.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nName\n\n\n\nName of the control objective.\n\n
\n\nSource\n\n\n\nSource of the control objective. For example, if the control objective is from a third-party provider, indicate which one.\n\n
\n\nSource ID\n\n\n\nUnique identification number used by the source to catalog this control objective.\n\n
\n\nReference\n\n\n\nUnique numerical identifier.\n\n
\n\nParent\n\n\n\nControl objective that is not a child of the current control objective. This is to avoid cyclic parent – child relationship.\n\n
\n\nCompliance Score Percentage\n\n\n\nCompliance score percentage calculated for this control objective and it's color code: - 80 and higher in green\n- 80 to 50 in yellow\n- below 50 in red\n\n\n
\n\nActive\n\n\n\nOption that indicates whether a control objective is active.\n\n
\n\nCreates controls automatically\n\n\n\nOption that indicates that controls are automatically created from the control objective. **Note:** Select this option if the control objective can also serve as the control.\n\n
\n\nCategory\n\n\n\nList of options:- Acquisition or sale of facilities, technology, and services\n- Audits and risk management\n- Compliance and Governance Manual of Style\n- Human Resources management\n- Leadership and high-level objectives\n- Monitoring and measurement\n- Operational management\n- Physical and environmental protection\n- Privacy protection for information and data\n- Records management\n- System hardening through configuration management\n- Systems continuity\n- Systems design, build, and implementation\n- Technical security\n- Third Party and supply chain oversight\n- Root\n- Deprecated\n\n\n
\n\nClassification\n\n\n\nList of options:- Preventive\n- Corrective\n- Detective\n\n\n
\n\nType\n\n\n\nList of options:- Acquisition/Sale of Assets or Services\n- Actionable Reports or Measurements\n- Audits and Risk Management\n- Behavior\n- Business Processes\n- Communicate\n- Configuration\n- Data and Information Management\n- Duplicate\n- Establish Roles\n- Establish/Maintain Documentation\n- Human Resources Management\n- Investigate\n- IT Impact Zone\n- Log Management\n- Maintenance\n- Monitor and Evaluate Occurrences\n- Physical and Environmental Protection\n- Process or Activity\n- Records Management\n- Systems Continuity\n- Systems Design, Build, and Implementation\n- Technical Security\n- Testing\n- Training\n\n\n
\n\nAttestation\n\n\n\nList of options. - **GRC Attestation** is chosen by default\n- **Note:** If the user changes the control attestation, the related control objective attestation type is changed also.\n\n
\n\nIssue group rule\n\n\n\nGroup rule assigned to this control objective.\n\n
\n\nDescription\n\n\n\nDescription of the control objective.\n\n
4. Click **Submit**.\n\n The control objective is created and all related lists are visible.\n\n - A control is created for every control objective when a policy is associated with an entity.\n - The control attributes default to the same attributes as the related control objective.\n\n## What to do next\n\nIf you are implementing the [Policy and Compliance Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/policy-compliance-impl-checklist.md) software, return to the [Policy and Compliance Management setup checklist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/policy-compliance-impl-checklist.md) and proceed to the next step.\n\n**Parent Topic:**[Policy and Compliance Management mandatory setup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/policy-compliance-mandatory-setup.md)\n\n**Parent Topic:**[Manage control objectives and policies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/policy-and-compliance-management/r_PoliciesAndProcedures.md)\n\n"}}