General User:

A general user has access to the following basic functions: access control, version control, tag function, and filter function. General user might receive restrictions or instructions from other user types, such as a policy document creator, reviewer, or admin.

There are 4 different features we were analyzing:

1) Access Control; 2) Version Control; 3) Tag; 4) Filter

We have compared the pros and cons over all 4 tools, and You can see the green cells indicate pros and reds indicate cons in the image below. ADO, Confluence and ServiceNow have all green cells for all features in General User, and we completed a more specific comparison in our competitive analysis here (Why Service Now is the best).

In summary, We recommend ServiceNow as our choice for General Users in our Document Management System.

The second user type is doc creator, the owner of each security document. The three main features are notification, to alert approval status changes, exception tracker, to submit and track an exception to a document, and policy template, to create document with inherited fields and permissions.

We believe serviceNow is the best option among the three platforms, not only does it have satisfying support for desired features, but also has noticeable advantages on flexibility, scalability, and migration cost. ServiceNow provides a graphical low-code development environment that can easily deal with situations such as restructure of review workflow, and modification of document fields. ServiceNow also has good support for policy exception requests and even the integration of policy compliance and security audits. This gives the system a high degree of freedom to scale up vertically when more emerging requirements come out. ServiceNow supports a bulk import from the existing multiple sources. The current policy document is created and managed on a confluence wiki page, therefore supporting bulk import from the confluence makes ServiceNow the most optimal tool to better migrate from the existing platform.

The group of users that receive review requests from policy document creators and give feedback including approval or rejection.

There are three features we are analyzing:

• Review Workflow: Manage review requests: see a list of policy document review requests, with necessary information including Title, document status, due date, reviewers.

• Review page (including commenting and giving result tags): Reviewers comment on the policy documents that require their reviews and give result tags(reject/approve)

• Get notifications of review requests: Reviewers can get a notification when someone has assigned them a document to review.

From the reviewer’s side, Confluence is the best option to build a document management system. It’s best paired with the Approval plugin. ADO doesn’t offer a standard document review and approval workflow and doesn’t have a document management plugin either. Even though RSA Archer has a complete policy and compliance functionalities, it would bring more friction to the policy review process, and it restricted users to only IE browsers. ServiceNow also has complete policy and compliance functionalities, but it can also add more complexity to the review workflow since it separates review and approval, and doesn’t provide the same conveniences to the reviewers.