# Importing ComplyForm Evidence as GRC JSON

## Prerequisites

- A GRC platform that supports JSON import (e.g., ServiceNow GRC, Archer, OneTrust)
- ComplyForm GRC JSON export file (`grc-evidence.json`)

## Steps

1. **Generate the GRC JSON export**:

   ```bash
   complyform export grc-json \
     --frameworks {{ frameworks }} \
     --output=grc-evidence.json
   ```

2. **Review the export structure**:

   The JSON file follows the ComplyForm GRC interchange format:

   ```json
   {
     "meta": {
       "tool": "ComplyForm",
       "version": "{{ version }}",
       "generated": "{{ timestamp }}",
       "cloud": "{{ cloud }}"
     },
     "findings": [...],
     "control_mappings": [...],
     "risk_scores": [...]
   }
   ```

3. **Import into your GRC platform**:

   - **ServiceNow GRC**: Use the JSON import set table to map fields
   - **Archer**: Use the data feed manager with JSON connector
   - **OneTrust**: Use the API integration endpoint

4. **Map fields** to your GRC platform's schema:

   | ComplyForm Field      | Common GRC Field       |
   |-----------------------|------------------------|
   | `finding.id`          | Issue ID               |
   | `finding.severity`    | Risk Rating            |
   | `finding.resource`    | Asset                  |
   | `control.framework`   | Regulation             |
   | `control.id`          | Control ID             |
   | `control.status`      | Compliance Status      |

## Notes

- The GRC JSON format is designed for maximum interoperability across platforms.
- Custom field mappings can be configured in `complyform.yaml` under `export.grc.field_map`.
- Incremental imports are supported via the `finding.id` deduplication key.
