A telecom operator has two weeks to bring a new partner into its network operations.
Building the governance, risk and compliance (GRC) process in ServiceNow to support that usually takes a couple of months. We took on a project to close that gap, and it worked. This post explains how.
Two weeks to onboard a network partner with LigaX Enterprise and ServiceNow GRC
The Situation
The SituationOperators bring in partners all the time to help run their networks. Before a partner can start, the operator has to answer some basic questions:
- Has the supplier been checked?
- Who approved the access it needs?
- Who owns each control?
- Where is the evidence?
The answers usually exist, but they are scattered. Procurement has the contracts. Security keeps its requirements in a spreadsheet. Network Operations knows which systems the partner will touch. Compliance needs proof that all of it was done properly. Pulling this together into a working GRC process in ServiceNow is where the weeks go.
Procurement, Security, Network Operations and Compliance each hold one answer
The Slow Part Isn't Building It
The Slow Part Isn't Building ItConfiguring ServiceNow is not what takes the time. What takes the time is keeping everyone's documents in step.
Take one example. Halfway through, Security changes an evidence rule. Now someone has to update the control, the assessment question, the workflow, the reminder email and the test. Each of these lives in a different document, owned by a different person. Miss one, and it shows up later as a failed test or an audit finding.
Repeat that every time a requirement shifts, and the timeline slips from weeks to months. The problem is not effort. It is that the pieces are disconnected, so every change has to be chased by hand.
What We Did Differently with LigaX Enterprise
What We Did Differently with LigaX EnterpriseIn this project, LigaX Enterprise from Ligaments AI handled the GRC setup. Instead of separate documents passed between teams, it kept all of the work in one connected place.
Read the source, reuse first, build it, then team review
- It started from the source. LigaX Enterprise read the supplier documents and pulled out the requirements. Each requirement stayed linked to the exact place it came from, so anyone could check where it originated.
- It reused what the operator already had. It checked the operator's existing ServiceNow controls and showed which ones could be reused and where the real gaps were. New work was only created where something was actually missing.
- It built the process. It drafted the GRC process, wrote the ServiceNow stories and built the standard configuration, ready for the operator's teams to review.
One Change, Made Once
One Change, Made OnceBecause every requirement, control, assessment question, workflow, notification and test is linked, a change no longer has to be chased across documents.
Before: a change chased across five documents. With LigaX Enterprise: one review
When an evidence rule changed midway through the project, LigaX Enterprise showed every item it affected. The control owner reviewed those items together and approved them in one go. A late change became a short review instead of another round of rework.
People Still Make the Decisions
People Still Make the DecisionsSpeed only matters if the result stands up to an audit. So every important decision stays with a person:
- Security and Compliance confirm which requirements apply.
- Control owners approve the controls.
- Developers review every change.
- Business users test the process.
- The release board approves go-live.
Five human checkpoints, with every action logged
Every action LigaX Enterprise takes in ServiceNow is logged, and the operator's normal change process stays exactly as it is.
What the Operator Had by Day 14
What the Operator Had by Day 14By day 14, the operator could see in ServiceNow which supplier checks were done, what evidence backed each one, which exceptions were still open, and who needed to act next.
After the Setup
After the SetupOnce the GRC setup is done, LigaX Enterprise steps back. The operator runs the process in ServiceNow with its own teams. When the next supplier comes along, they start from a working process instead of a blank spreadsheet.
The work doesn't get skipped. It just stops being repeated.
