A city CIO hears IRM and GRC used interchangeably in a vendor demo and asks which product the city is actually buying. How should the implementer clarify the naming?

On the CIS-RC path, Integrated Risk Management is ServiceNow’s current product-family name for the risk-and-compliance capability set historically and in blueprints often still called GRC. For a city CIO hearing both labels in a vendor demo, the implementer should clarify that IRM and GRC describe the same evolving suite, not two unrelated purchases fighting for budget. Workspace language may say IRM while older documentation, exam blueprints, and table names still say GRC; that naming drift is expected and does not imply a second product. Treating IRM and GRC as forever-separate products that must be disabled against each other invents a false choice and wastes implementation focus. Calling GRC merely classic UI while branding IRM as a Security Incident Response suite conflates Risk and Compliance with CIS-SIR operational response. Equating IRM with Software Asset Management license scoring pulls the conversation into entitlement management, which is outside the CIS-RC core. Exam caveat: expect both IRM and GRC wording on the exam; map them to one family rather than hunting for a hidden product split. Operational check for the city: in the instance and licensing paperwork, confirm Policy and Compliance, Risk, Entity Framework, and Audit apps under the IRM/GRC family, and document for sponsors that SIR or SAM badges in the same demo are sibling products, not the IRM rename.