Domain 4: Can you implement and operate the platform?

NIST’s March 2026 workforce guide connects workforce decisions to risk and planned responses. ServiceNow’s January 2026 implementation certification blueprint separately covers configuring, implementing and maintaining its risk and compliance applications. Neither source establishes a universal staffing ratio; use them as prompts to identify the work your organisation must resource. (csrc.nist.gov)

10. Have you allocated buyer-side delivery capacity and dependencies?

A — 0: The supplier or partner is expected to handle implementation with little buyer involvement.

B — 1: People are named, but their availability and responsibilities are unconfirmed.

C — 2: Process design, cleansing, integration, testing, decisions and cutover planning have accountable owners, allocated time and documented dependencies.

D — 3: The team has challenged the plan against a missed dependency, unavailable specialist or delayed migration extract, and agreed revised sequencing, contingencies and go/no-go ownership.

Evidence to retain: a resource-loaded GRC implementation project plan, buyer/partner responsibility split and dependency log.

Mandatory gate: score at least 2. An examination or renewal deadline should be recorded as a constraint, not treated as proof that the work fits.

11. Who will administer the platform after implementation support ends?

A — 0: No ongoing service owner or administrator has been identified.

B — 1: Someone is nominated, but capacity, backup and support arrangements are undefined.

C — 2: Administration, access reviews, workflow changes, integration support, upgrades and user support have owners, capacity allocations and a funded sourcing plan.

D — 3: Those owners have rehearsed a change request, support incident and handover scenario; training gaps, documentation requirements and external escalation arrangements are addressed.

Evidence to retain: an operating plan, administration task list, workload assumptions, backup arrangements and handover acceptance checklist.

Mandatory gate: score at least 2. Managed services can qualify; responsibility and funding must still be explicit.

12. Can occasional users complete the work, and can evaluators judge it?

A — 0: Evaluation is limited to the core GRC team watching standard demonstrations.

B — 1: Business users have been consulted, but tasks and acceptance criteria are not written.

C — 2: A buyer-specific demonstration script covers an ordinary contribution, rejected evidence, an overdue action, a disputed score, a restricted record and an administrator change.

D — 3: Representative contributors have rehearsed the tasks using mock-ups or synthetic records; the team has agreed completion, usability, training and support criteria for supplier evaluation.

Evidence to retain: demonstration script, user feedback and acceptance register. Record supplier outcomes as demonstrated, partly demonstrated or not demonstrated—not automatically “unsupported”.

Microsoft’s Dynamics 365 go-live guidance recommends testing edge cases, migrated data and correct security roles, alongside business sign-off. This is a transferable enterprise-implementation practice, not GRC-specific product evidence. (learn.microsoft.com)

Sources cited on this page

csrc.nist.gov ↗csrc.nist.gov
learn.microsoft.com ↗learn.microsoft.com