Best end-to-end GRC solution on the market. Unified platform: Data flows smoothly between IT, security, and risk teams within one shared system. Automation: Automated workflows assign tasks and send reminders and alerts without the need for manual follow-up. Real-time dashboards: Executive dashboards clearly display live risk scores and compliance status. Integrations: It connects well with other enterprise tools, security scanners, and IT service management (ITSM) systems. Review collected by and hosted on G2.com.

High Implementation Cost: Setting up and customizing the platform can take a lot of time and money, and it often requires certified experts. Steep Learning Curve: The user interface can feel complex and overwhelming for everyday business users. Heavy Customization Maintenance: Custom workflows can break or become difficult to manage during platform upgrades, which adds ongoing maintenance effort. Licensing Expenses: The cost per user or per module can become very expensive for mid-sized teams. Review collected by and hosted on G2.com.

GRC is an important domain, and compliance requirements are something most companies tend to ignore. This tool helps by providing a unified platform that is integrated with the CMDB, which enables better auditing and overall management.

Implementation is straightforward when you have an experienced developer team. Automation also helps with monitoring and restoring, making these activities easier to manage. Review collected by and hosted on G2.com.

It takes an experienced team to implement, and it’s not something you can just handle with simple runbooks. Review collected by and hosted on G2.com.

ServiceNow GRC's greatest strength is its ability to provide a single source of truth for governance, risk, and compliance activities. The platform links risks, controls, assessments, issues, and remediation actions together, improving visibility and accountability across the organisation. I also value its workflow automation, configurable framework, and executive reporting capabilities, which help clients reduce manual effort and gain real-time insights into their risk and compliance posture. Review collected by and hosted on G2.com.

While ServiceNow GRC is highly capable, it can be complex to implement and configure, particularly for organisations that are new to GRC technology. The platform has a steep learning curve for administrators, and advanced reporting or dashboard development often requires specialised expertise. Additionally, implementation and licensing costs may be challenging for smaller organisations, and some administrative screens could be more intuitive for non-technical users. Review collected by and hosted on G2.com.

The standout strength is consolidation: policies, controls, risk assessments, audits, and incidents all live in one platform, giving real-time visibility across the entire GRC program. For anyone already in the ServiceNow ecosystem, the UI feels familiar and intuitive, making it easy to navigate and track issues across teams. Integrations are a genuine highlight, especially the deep CMDB connection that lets you trace risk directly back to specific assets and incidents, with heat maps, risk scoring, and rich reporting built in. Performance impresses when it comes to real-time monitoring - the platform automatically detects policy non-compliance as issues emerge rather than after the fact. Using multiple modules together (IRM, CAM, etc.) delivers strong ROI, turning fragmented GRC processes into a single auditable workflow. On AI, Now Assist for IRM and auto-generation rules for third-party assessments are genuinely useful, cutting out repetitive manual work and making risk calculations more consistent and transparent. Review collected by and hosted on G2.com.

The UI has a steep learning curve for first-time users, with no built-in onboarding guide to ease the start. While integrations are powerful, the initial configuration, particularly CMDB, demands significant time and internal expertise. Pricing is subscription-based per user and can be hard to justify as a standalone tool without broader ServiceNow investment. Support is the most inconsistent area, with documentation tending to cover menu structure rather than function, and vendor support tickets can take weeks to resolve, often leaving teams to problem-solve independently. AI features, while promising, are still maturing and not yet consistently reliable across all modules. Review collected by and hosted on G2.com.

I like that ServiceNow Governance, Risk, and Compliance (GRC) is integrated with all the data in ServiceNow. It is easy to code and integrate, especially with its low-code/no-code capabilities, which help in reducing the time to market. Review collected by and hosted on G2.com.

There are several things that I find challenging with ServiceNow Governance, Risk, and Compliance (GRC). It doesn't solve all the problems, and I feel like it lacks some major components of GRC. While it helps with model risk, policy management, and compliance, there are still areas where it's lacking. The control testing and handling of cyber vulnerabilities are only dealt with to some extent, which is a bit disappointing. I also have issues with the licensing model, specifically that read licenses should be free if users login once a month or year. Additionally, the initial setup was not easy for us because we have a lot of solutions, making it too complicated to migrate. Review collected by and hosted on G2.com.

I like the traceability between records in ServiceNow Governance, Risk, and Compliance (GRC). It's great to know what citations relate to each control and how those controls target risks. This makes it easy to govern. Also, it helps us understand how our company's controls are covering regulatory requirements and industry frameworks. Review collected by and hosted on G2.com.

Workspace views don't have the same functionality as default/native views. For example, in the risks workspace, you can't select multiple risk responses during a risk assessment, whereas you can select multiple if operating in the native view. The initial setup was challenging, requiring us to redesign some processes to conform with ServiceNow functionality due to our reluctance to customize ServiceNow. Review collected by and hosted on G2.com.

Great to have our External Connections Cyber Security Assessment scoped app that relates to Policy and Compliance (P&C) in the same platform as our ITSM (to leverage order guide, service request, change, etc), CMDB (device inventory), Knowledge Management (KB Articles), Now Assist (AI Assistance), Platform Analytics (dashboard and reporting), and future possibilities such as OT Visibility, Vulnerability Response, AI Agents/Specialists, etc. P&C allows for auto-instantiation of controls per the entity type, auto-instantiation of issues for failed attestations, recurring attestations to confirm controls are still in affect, compliance status/score, as well as lifecycle status of the policy/entity:control/issue. We’re also able to leverage platform capabilities like scheduled job, email with email template, business rules, flow, etc in this low code application used enterprise wide. Enhancements are added to continue to improve our process and user experience. Lastly, the support and partnership from ServiceNow ensures our success. Thank you ServiceNow. Review collected by and hosted on G2.com.

Currently no functionality to sync-up attestation of a new control (of an existing entity already in review/monitor state) with the rest of the controls’ attestation cycle. Review collected by and hosted on G2.com.

I like how ServiceNow Governance, Risk, and Compliance (GRC) keeps all the rules in one place for everyone to use as a source of truth. I also appreciate that with this tool, I only need to teach one platform, which simplifies the training process. The approvals feature is valuable as it eliminates the hassle of having to chase them down. Review collected by and hosted on G2.com.

One area where I find ServiceNow Governance, Risk, and Compliance (GRC) could improve is its appeal to a very broad audience of users, many of whom are not tech-savvy. It would be beneficial to have a feature that walks them through the process, similar to how a survey does. Review collected by and hosted on G2.com.

I like how ServiceNow GRC centralizes risk, compliance, and governance activities in one platform. It improves visibility, tracking, and collaboration across teams. Review collected by and hosted on G2.com.

The platform can feel complex initially, especially when configuring workflows and reports. Some features require additional training and customization to use effectively. Review collected by and hosted on G2.com.

I use ServiceNow Governance, Risk, and Compliance (GRC) to centralize risk and compliance management across my organization on a single platform, which is really helpful. It makes identifying, assessing, and tracking risks with scoring and ownership straightforward. I really like how it allows me to monitor third-party risk posture throughout the lifecycle of my projects. The integration with HRSD to secure some of my most sensitive data is also something I value. Additionally, I found the initial setup very easy to provision. Review collected by and hosted on G2.com.

Screen density and form layouts can feel sort of busy, at least for non-technical users. Review collected by and hosted on G2.com.