CIS-RC Exam: Who It Suits and What ServiceNow Tests

The ServiceNow CIS-RC exam is written for people who configure and implement Risk, Policy and Compliance, and Audit Management on the platform, not for risk managers who only use those applications. It tests how entities, policies, controls, risks and audits are built and connected, in 60 questions over 90 minutes, and the result is Pass or Fail.

Most of the confusion around this credential, though, starts with its name. The exam title says Risk and Compliance, the training courses say Integrated Risk Management, and the product family is still called GRC in several places. ServiceNow's published blueprint for the exam was updated in January 2026, and every exam figure below was read from it in October 2026. This article explains who the exam suits, what the seven domains ask, where the marks are concentrated, how the vendor's own sample questions are phrased, how booking and results work, and how the credential fits next to the other ServiceNow implementation exams.

Who is the CIS-RC exam written for?

ServiceNow describes the audience as customers, partners, employees and others who want to become a ServiceNow Risk and Compliance implementer. The recommended experience is six months of field experience, taking part in at least two ServiceNow deployment projects or maintaining ServiceNow instances. That is a recommendation rather than a gate, but it tells you what the questions assume: you have seen a platform project from the inside, you know what an implementation team does, and you can read a requirement such as “assess each business service against our control set every quarter” and picture the records behind it.

Three kinds of reader fit that description well. The first is a ServiceNow administrator or developer who has been asked to take over a GRC rollout and needs to speak the language of risk and audit teams. The second is a consultant or partner implementer who configures these applications for customers and wants a credential that proves it. The third is a risk, compliance or internal audit professional who has moved into a platform role and already understands controls, citations and risk statements but not yet how ServiceNow stores and links them. Each of these readers has a different weak side: the administrator knows tables and roles but not the vocabulary of governance, while the risk specialist knows the vocabulary but not the architecture.

The exam is written to reward the person who holds both halves. Its stated purpose is to confirm that you can configure, implement and maintain Risk, Policy and Compliance, and Audit Management applications, manage entity frameworks, configure compliance processes and support audits. Notice the verbs. None of them is “manage a risk register” or “run an audit”. The exam asks what you would build and how you would set it up, so a candidate who knows the theory of risk management but has never looked at how a platform models it will find the scenarios unfamiliar.

It also helps to be honest about who should wait. If you have never worked on any ServiceNow application, the blueprint's own training list starts with Welcome to ServiceNow, ServiceNow Administration Fundamentals and ServiceNow Platform Implementation, and that order is sensible. Questions about roles, groups and record lifecycles assume you already know what a role or a lifecycle is on the platform. Starting with the GRC courses alone leaves gaps that the exam will find.

Is it GRC, IRM or Risk and Compliance? Reading the names correctly

ServiceNow has renamed and regrouped this product family more than once, which is why search results mix three labels. The credential you sit is titled Certified Implementation Specialist – Risk and Compliance, abbreviated CIS-RC. The blueprint's first domain is called GRC Overview. The recommended courses are named GRC: Integrated Risk Management (IRM) Fundamentals and GRC: Integrated Risk Management (IRM) Implementation. Search queries also arrive with variants such as “CIS-RCI”, which is simply a typing variant of the same credential.

For exam purposes the labels point at the same body of knowledge. GRC is the umbrella, Integrated Risk Management is the course name for the risk and compliance applications, and Risk and Compliance is the name on the certificate. What matters is that the exam is still in ServiceNow's current mainline catalogue: the blueprint carries the January 2026 revision and lists the seven domains this article covers. Nothing in it points to a newer version replacing it, and that is the page to recheck before you book, because ServiceNow updates its exams alongside platform releases.

The blueprint also names the scoped applications you will meet in the questions. One of its own sample items asks which applications are scoped applications in GRC, and the answers it gives are GRC: Profiles and GRC: Risk Management. Another asks which tables sit in the Policy and Compliance scope and in the Risk scope. In other words, expect the exam to use the product's own naming for applications, tables and roles precisely, and learn those names from the product documentation rather than from a summary that renames them.

What does the CIS-RC exam test, domain by domain?

The blueprint lists seven domains. Their weightings add up to 100 percent, and the table below shows each one with the sub-topics ServiceNow names. ServiceNow adds that the listed sub-skills should not be treated as an all-inclusive list, so use them as the minimum.

Domain	Share of exam	Sub-topics named by ServiceNow
GRC Overview	11.67%	GRC positioning and framework, key terminology, technical details
Implementation Planning	5%	Use cases, implementation team and checklist, risk and compliance personas, groups and roles
Entity Framework	20%	Entity scoping overview, entity type approach, entity class approach, entity architecture
Policy and Compliance	25%	Record lifecycles, architecture, configuration, compliance supporting processes
Risk and Advanced Risk	25%	Record lifecycles, architecture, configuration
Common Elements and Extended Capabilities	8.33%	Integrations, content packs, other platform capabilities, regulatory change management, common elements, continuous monitoring
Audit and Advanced Audit	5%	Audit and advanced audit lifecycles, architecture, personas, groups and roles

Read the sub-topics as three repeating questions. Lifecycle asks how a record moves from creation to closure and who acts at each step. Architecture asks which tables, relationships and scoped applications hold the data. Configuration asks what you would set or change to make the process fit a customer. The Policy and Compliance, Risk and Audit domains all repeat this pattern, so a candidate who learns it once for compliance can apply it to risk and audit with different record names.

GRC Overview is the vocabulary domain. It covers how the applications are positioned, the terms the rest of the exam uses without explanation, and technical details of how the pieces are packaged. It is the cheapest domain to prepare because it is mostly reading, and weak answers here usually come from skipping the terminology.

Implementation Planning is small but practical. It asks about use cases, who belongs on the implementation team, what a checklist should contain and which personas, groups and roles a risk and compliance programme needs. One vendor sample item asks who should be on the core implementation team for a GRC implementation, and the answers it accepts are risk and compliance experts and the ServiceNow developer team, not the external audit team. That tells you the exam treats the business owners of the process as part of the build.

Entity Framework carries a fifth of the exam and is the domain that surprises people most. Entities are the things you assess risk and compliance against, and the framework decides how they are scoped, typed and classed before any policy or risk record touches them. Because every later domain hangs off entities, a muddled understanding here costs marks in the heavier domains as well. A sample item in this area asks which field is mandatory on an Entity Filter record, and the answer is the source table.

Policy and Compliance and Risk and Advanced Risk carry 25 percent each, so half the exam is about these two. Both ask about record lifecycles, the architecture beneath them and the configuration choices that tailor them. Compliance adds supporting processes, and risk separates the standard application from the advanced one, so you need to know which capability belongs to which.

Common Elements and Extended Capabilities gathers the connective material: integrations, content packs, regulatory change management, continuous monitoring and other platform capabilities. At 8.33 percent it is a small domain with a wide scope, which is the usual recipe for a few questions you could not have predicted. Audit and Advanced Audit is the other 5 percent domain, covering lifecycles, architecture and the personas, groups and roles that audit work involves.

Where do the marks sit, and how should that shape your study time?

Three domains hold 70 percent of the exam: Policy and Compliance at 25, Risk and Advanced Risk at 25, and Entity Framework at 20. On 60 questions, and assuming every question counts, that is roughly a quarter of the paper for each of the first two and a fifth for the third. The two 5 percent domains are only a handful of questions apiece. A candidate who spreads revision evenly across seven headings spends as long on a domain worth a handful of questions as on one worth a quarter of the paper.

A better way is to weight your hours by the table, with a floor for the small domains so that no heading is left blank. One workable split for a four-week plan with evenings and weekends: in week one, cover GRC Overview and Implementation Planning and read the terminology until you can explain it without notes. In week two, work through Entity Framework slowly, because it is the foundation of the rest. In week three, take Policy and Compliance, then Risk and Advanced Risk, building the lifecycle of each record type on paper as you go. In week four, finish with Common Elements and Audit, then spend the remaining days on timed practice and on re-reading the topics where you missed questions.

Hands-on time changes how well any of this sticks. If you can reach an instance with the GRC applications activated, such as a customer sandbox or a partner training instance, follow each lifecycle through by creating the records yourself. Do not assume an ordinary personal developer instance has these applications; check what your instance provides before you plan around it. If you have no instance at all, ServiceNow lists a GRC: Integrated Risk Management (IRM) Simulator among its recommended courses, and the product documentation and release notes cover the same record structures in text.

Study from ServiceNow's materials. ServiceNow draws its questions from its own training, the product documentation and the developer site, and warns that material posted elsewhere is not official and should not be used for preparation. The recommended training list is long and starts at the platform basics: Welcome to ServiceNow, Administration Fundamentals, UI Builder Essentials, Flow Designer Essentials, Get Started with Now Create, Platform Implementation and CMDB Fundamentals, followed by the GRC courses on IRM fundamentals, IRM implementation, classic risk assessment, audit management and regulatory change management. Our own breakdown of the same domains is on the CIS-RC syllabus page, which you can use as a checklist beside the vendor's blueprint.

How does ServiceNow phrase the questions? Seven sample items, read closely

ServiceNow publishes seven sample items with answers on the blueprint page. They are the best evidence of the exam's style, and they show three habits worth practising. First, many items ask for a specific table, role or field name. Second, several are multi-select and tell you how many answers to choose. Third, the wrong options are usually real parts of the product that just do not belong in the scope being asked about.

Sample item (ServiceNow)	Accepted answer	What it checks
Which are scoped applications in GRC? (choose two)	GRC: Profiles; GRC: Risk Management	Application scopes
Who should be on the core implementation team? (choose two)	Risk and compliance experts; ServiceNow developer team	Implementation planning
Which mandatory field is required on the Entity Filter record?	Source table	Entity framework
Which tables are in the Policy and Compliance scope? (choose two)	Control; Citation	Compliance architecture
Which tables are in the Risk scope? (choose two)	Risk Framework; Risk Statement	Risk architecture
Where do Unified Compliance Framework control documents import with the UCF integration?	Control Objectives table	Integrations
Which roles are inherited with the sn_audit.user role? (choose three)	sn_grc.reader; sn_compliance.reader; sn_risk.reader	Audit roles

Look at what the distractors are. In the compliance-tables item, Issue and Risk are offered beside Control and Citation. Both are genuine GRC records, and a candidate who has only a general feel for the product could pick them. In the risk-tables item, Citation appears as a wrong option, which is a compliance record. The skill being tested is not recognising a name but placing it in the right scope, and that comes from having studied the architecture of each application separately.

The role item shows the same thing from the access side. Giving a user the audit role brings the reader roles of the GRC, compliance and risk applications with it, but not the external auditor role. Questions of this kind are easy if you have looked at the role structure and hard if you have not, and there is no way to reason your way to the answer from first principles.

Reading the samples is one step; answering many questions of the same kind is the next. After a first pass through the seven domains, the CIS-RC practice exam gives you that volume, written in the same configure-and-choose style as the blueprint samples above.

How do booking, the 90-day clock and the result work?

Registration on ServiceNow's side equals payment. The blueprint says that registering secures your attempt, that learning credits and credit card payments are accepted, and that completing instructor-led training includes one free exam attempt. Nothing is refunded once you pay, so book the attempt only when you can sit it soon. The fee is USD 450 as of October 2026. The payment starts a 90-day window for scheduling and finishing the exam, and a lapsed window means paying the full fee again.

You then choose how to sit it: at a Pearson test center, or online with OnVUE, where a proctor watches through your webcam. From the My Exams page you are directed to Pearson. ServiceNow provides reasonable accommodation for candidates with disabilities and for those taking the exam in English as a second language.

The exam has 60 questions and lasts 90 minutes, which is 90 seconds a question on average. Items are either multiple choice with a single answer, which always have at least three possible responses, or multiple select, which have at least four responses and state how many to choose. Partial credit is not given on multiple-select items, so a three-answer question where you find two correct options earns nothing. That makes it worth spending your extra seconds on the multi-select items rather than on easy singles.

The result appears immediately as a conditional pass or fail. Every question carries one point, and the total is set against a fixed cut score. ServiceNow keeps that score private and notes that it is not always 70 percent. A follow-up report lists the share of items you got right per section, but those section figures play no part in the verdict and should not be averaged into a grade; they are a pointer for revision after a fail. The word conditional matters: a later audit of the sitting can overturn the result if the test security policies were breached.

If you pass you receive the Certified Implementation Specialist – Risk and Compliance certification and a Credly digital badge. If you do not, ServiceNow asks you to review the blueprint and the recommended training. The retake policy requires a waiting period between attempts and payment of the fee for each attempt, and the Credentialing Program Guide holds the full retake details, so read it before you plan a second date.

Because the cut score is hidden and the result is Pass or Fail, a practice score tells you less than people hope. Treat it as a map of weak domains rather than a prediction. A better readiness test is whether you can explain, without notes, the lifecycle and the main tables of each of the three heavy domains, and whether you can name the roles each application brings with it.

Where does the credential sit among ServiceNow exams, and how is it kept current?

CIS-RC is one of the ServiceNow Certified Implementation Specialist exams, each of which covers one application area. Its closest neighbour in subject matter is the Third-Party Risk Management exam, whose own exam blueprint is published in the same format. The two share ideas about assessments and risk scoring, but they test different applications, so passing one does not cover the other. Someone who works on risk programmes for suppliers and also on enterprise risk and compliance might sensibly hold both.

The implementation exams build on the platform administrator foundation. ServiceNow's recommended courses for CIS-RC begin with administration fundamentals and platform implementation, so the System Administrator credential is a natural first step if you do not hold it. Candidates who go on to develop custom applications on top of GRC often add the Application Developer exam later, though ServiceNow does not make either a prerequisite for CIS-RC.

A ServiceNow certification is not a one-off. Holders keep the credential valid through short yearly update exams that ServiceNow calls deltas, together with a yearly Certification Maintenance Program fee. That follows the platform's release cycle, so expect the exam content to move. When you plan the cost of the credential, plan for the maintenance as well as the first attempt.

In practice the credential is most useful as evidence for a hiring manager or a customer that you can set up these applications correctly, not as a replacement for project experience. Combine it with a short list of real work you can describe: an entity framework you scoped, a compliance process you configured, an audit workflow you supported. The exam covers what to build; the projects show you have built it.

Frequently Asked Questions

Who should take the ServiceNow CIS-RC exam?

The exam suits implementers who configure Risk, Policy and Compliance, and Audit Management on ServiceNow: administrators, developers, partner consultants and risk or audit professionals who moved into platform roles. ServiceNow recommends six months of field experience across at least two deployment projects or maintaining instances.

How many questions and how much time does the CIS-RC exam have?

ServiceNow's blueprint gives 60 questions and 90 minutes. Items are single-answer multiple choice or multiple select, where partial credit is not given. The result appears at once as a conditional pass or fail after you submit.

What is the CIS-RC exam fee and how long do you have to take it?

The exam fee is USD 450 as of October 2026. Registration equals payment, fees are non-refundable, and once registered you have 90 days to schedule and complete the exam before the registration expires. Instructor-led training includes one free attempt.

Which CIS-RC domains carry the most weight?

Policy and Compliance and Risk and Advanced Risk carry 25 percent each, and the Entity Framework carries 20 percent, so those three hold 70 percent of the exam. GRC Overview is 11.67 percent, Common Elements and Extended Capabilities 8.33 percent, and Implementation Planning and Audit 5 percent each.

What is the CIS-RC passing score?

ServiceNow does not publish it. Each question is worth one point and your total is compared with a predetermined cut score that is not shared and is not always 70 percent. You see a conditional Pass or Fail plus the percentage correct in each section, which should not be averaged.

Select ratingPoorOkayGoodGreatAwesome

No votes yet