Cherwell Software was founded by the former CEO of FrontRage Solutions and is a full suite of service management tools competing with BMC Remedy, ServiceNow, and IBM SmartCloud.
N/A
ServiceNow Governance, Risk, and Compliance
Score 8.1 out of 10
N/A
ServiceNow Governance, Risk, and Compliance provides the tools businesses use to proactively manage risk by measuring, testing and auditing internal processes. This solution helps business users ensure compliance to regulations, policies, standards and frameworks. It is available via the Standard, Professional, and Enterprise editions, the latter two supporting GRC and internal auditing processes.
Well suited in an IT environment where you have limited staff. It can be managed by one administrator. Reliability of the SaaS environment has been excellent. Flexibility in developing automated workflows to open, manage, and close Incidents. Change Management due to ability to modify OOB to meet the needs of our staff. Contract Management allowing us to be notified when a contract or license is up for renewal and setting reminders. Integrations are not easy to create and manage.
Oracle EBS R12 requires a unique user skillset to understand how it handles user access and functions. Accordingly, ServiceNow has this high level of sophistication to manage this information and apply it to Sensitive Access and Segregation of Duties rules to identify exceptions. This depth of configuration is critical to accurately identify when Oracle Responsibilities (access) truly allows access and thus could be a violation. ERPs with less complexity may not require this customization of ServiceNow GRC, but you would be wise to raise these questions and examples in the demo to ensure it will work for you. In the past, we have found that risks of under-reporting exceptions or false positives become so voluminous that users don't always get to the accurate violations for timely remediation. Proper configuration up front will improve your effectiveness and ROI down the road.
Cherwell's email handling automation works flawlessly. The only time that I have ever needed to reset the automation service that drives it is when my own server that houses the small connecting agent has some kind of problem and disconnects us from our hosted Cherwell instance. It just works. Emails to a certain address always result in a new ticket or update to an existing ticket.
Cherwell is literally 100% customization in so many ways that it would be pointless to try to enumerate them. There is a very sizable list of already-created customizations (called "mApps") that you can download and apply to your instance. If you don't like them you can roll them back in seconds. But you can add and configure entire modules using one of these pre-defined, completely free, add-on packages. It's so easy to add features this way that I check the list of available mApps every month or so just to see what functionality I can add.
Finding reported by the auditor. GRC helps us identify, assign, and track the resolution of this.
Exception to information security policy. These require quarterly reviews and setting up reminders to revisit these.
Building out new projects and baking security and compliance into the project and tracking it in GRC to ensure we deliver a compliant product on day one
Delivering more out of the box functionality that rivals other GRC platforms. The bare bones approach may not help companies that do not have expertise or capabilities to build effective GRC processes.
Easier way to implement workflow.
Offering better metrics without buying add-on tools.
Cherwell is still the best tool for the job in the market. Even though Ivanti bought them and are trying to convince everyone to move over to Neurons for ITSM, they have stated Cherwell will remain supported indefinitely and have a roadmap for future Cherwell development. Unfortunately, ISM is not as flexible as Cherwell (and the UX is atrocious), hence why many people are sticking with Cherwell (and why many Cherwell customers never purchased ISM originally)
I enjoy the layout and configuration of our Cherwell Service Management instance. It did take me a bit to get used to, as with any new ticketing system, but now that I understand the system more, I thoroughly enjoy it! There are just so many options and the UI is very intuitive.
I'm satisfied with our experience. The configuration was the biggest challenge, but we have moved onto the stage of user training and usability. We would appreciate having better user training documentation and possibly videos and/or computer-based training to help our international users adopt this software for their GRC needs.
The browser client is mostly acceptable in terms of performance, but still lacks parity with the rich client. The rich client is not very performant at all. It's built on old architecture and relies heavily on a fast internet connection, good caching and database indexing. There are several unwritten rules with form design (and form arrangement) which most users are not aware of, but can severely impact performance in the rich client. This is where the flexibility of Cherwell can come back to bite you if you step outside the boundaries of these unwritten rules
We generally have a good time with Cherwell support, however, there are the few niche cases where I have to explain how Cherwell works to the customer support agent on the other end. A little more product education for tier 1 support could go a long way in helping expedite support requests from SaaS customers.
It's a good system, but I am awaiting key features in the new release. We hear that ServiceNow is continually adding new features and we look for improved reporting, better Oracle Integration, and user training opportunities. To the extent these materialize, we expect further improvements in our experience with ServiceNow GRC. Until that time, though, we believe we are meeting our objectives expected at the beginning of this project.
I didn't partake in the in-person training, but it was available. I preferred the online method instead, which was a great experience. It was nice to have someone available to bounce questions off of and demonstrate how certain functions worked.
The training was great! We got together to review the system, its UI, and how to perform basic functions. Then there was plenty of time to ask questions and test out the system while there was someone available to assist.
Implementation is a breeze. Each time I've implemented it, we had an outsourced vendor overseeing it & assisting where needed. However, Cherwell OOTB is ready to go, and configuring it for LDAP/SAML, etc. for authentication and user-imports is really straight forward. The infrastructure needed for Cherwell is extremely simple too - and installing the server & database takes no more than 20 mins
Much more customizable than other products, especially when ran in a self-hosted environment. Cherwell [Service Management] allows for greater flexibility of custom development and integrations to allow for automating tasks that traditional ITSM apps are not well suited for. Cherwell [Service Management] gives you the freedom to develop your own objects with minimal licensing costs.
We just recently started using TrustArc for data privacy requests and I can already speak to the fact that TrustArc is a more confusing platform once there. The positives of ServiceNow would be that a majority of our URL's drive to owned websites which our employees are very comfortable with using versus pushing them to another website that feels unsafe.
We have never had any major show-stopper issues with Cherwell itself - more so with the infrastructure it sits on. Moving from in-house cloud (on Cherwell's side), to AWS then to Azure has caused multiple problems over the years (some still on-going), however the product has remained fairly stable
As mentioned, they were always great to work with (minus the project management side). My only feedback would be to push back on requirements that don't make sense
As with any standard ticketing system, it helped decrease the time before first contact with clients.
Our department was always concerned with keeping a low budget, and it was cheaper than most.
My supervisor could easily tell how many resources were being put into each employee, so we had more visibility of our team's capabilities at a given time if we needed to take on something complex.
