Grc Continuous Authorization And Monitoring Workspace

Establish parent-child relationships between authorization boundaries to improve boundary management, visibility, and organizational structure within Continuous Authorization and Monitoring. You can assign a parent boundary and associate multiple child boundaries to authorization boundary.

You can include overlays to the baseline control objectives in the Authorization Package using either addition, subtraction, or a custom action.

Use the authorization boundary overview page to define the parameters of a security measure for an organization.

Use the authorization package overview page to view documents and evidence that help you to assess your organization's security posture.

Link documents to authorization packages, boundaries, and engagements from your workspace, cloud storage, or local systems. Linked documents become shared resources across records.

Export the OSCAL Assessment Results (AR) file for an authorization package from the CAM Workspace.

The CAM Workspace is a centralized hub where you can continuously monitor and manage compliance with the NIST Risk Management Framework to ensure adherence to your security policies and guidelines.

The CAM Workspace is a centralized hub where you can continuously monitor and manage compliance of users and systems with the NIST Risk Management Framework to ensure adherence to your security policies and guidelines.

In CAM application, all issues related to an authorization package are called as Plan of Actions and Milestones (POA&Ms). The issues can be package issues, or control issues, engagement issues, or control test issues that are related to the package.

Create boundary filters to define system elements within an authorization boundary based on specific table conditions.

From the Control objective list view page, you can export the catalog in OSCAL JSON format for the selected control objectives. This action enables you to export your control objectives from CAM.

Export engagement data as OSCAL Assessment Plan files to share testing plans with auditors or import into external systems.

Generate zip files Plan of Action and Milestones (POA&M) data in Open Security Controls Assessment Language (OSCAL) JSON format from the Authorization package overview record page. The authorization package must be in Implement state or later, and a POA&M file must link to the selected authorization package.

Generate Authority to Operate (ATO) artifacts such as System Security Plan (SSP), Security Assessment Report (SAR), Plan of Actions and Milestones (POA&Ms), Security Assessment Plan (SAP), Authority to Operate (ATO Letter), and Executive Summary from an authorization package in Microsoft Word format. Generating ATO artifacts as Microsoft Word format enhances ease of editing, collaboration, and compliance, confirming professional and portable documents.

From the Authorization package overview record page, generate Authority to Operate (ATO) artifacts in Microsoft Word format. This action enables you to download your ATO artifacts from CAM.

From the Authorization package overview record page, generate zip files and export the record's mapped content details in OSCAL format. To generate OSCAL SSP, the selected Authorization package must be in implemented state or after that. This action enables you to export your authorization package from CAM.

Import OSCAL Assessment Plan files to automatically create engagements, control tests, and assessment procedures in your authorization package.

Import OSCAL Assessment Results (AR) from similar NIST RMF frameworks to create an engagement.

From the New Import playbook experience page, you can import OSCAL files in the Catalog model into CAM workspace. This task focuses on uploading and processing the required JSON files to begin the import process.

From the New Import playbook experience page, you can import OSCAL files in the System Security Plan (SSP) model into CAM workspace. This action enables you to seamlessly upload authorization package data in OSCAL format.

The CAM OSCAL import offers a playbook-style experience designed to streamline the integration of security control data.

Open Security Controls Assessment Language (OSCAL) provides a standardized way to express control-related information, enabling interoperability, consistency, and automation in IT security. It supports the JSON format only. CAM supports OSCAL version 1.1.2.

CAM supports the Open Security Controls Assessment Language (OSCAL) used by the National Institute of Standards and Technology (NIST) that provides control-related information in standardized machine-readable formats. CAM supports Catalog, Profile, SSP, Assessment Plan (AP), Assessment Results (AR), and Control Tailoring Request data.

Remove a document from the current record by unlinking it from the record, or delete it permanently from ServiceNow.

Link documents from your workspace, cloud storage, or local drives to authorization packages, boundaries, and engagements. You can organize documents into folders and grant access to other users.

Set up reviewers and approvers for linked documents to establish a formal approval workflow before a document version becomes active.

Link documents to external cloud storage such as Google Drive, OneDrive, or SharePoint to keep your documents synchronized across platforms.

Update document properties such as name, owner, classification, and access settings to organize documents and control permissions.

Activate or deactivate the authorization package summarization skill from the AI Admin Panel to control whether users can generate summaries.

Generate an AI-powered summary of an authorization package to view its status, key metrics, and operational information in a single consolidated view.

Examine document versions submitted for review and authorize them to move forward in the approval workflow as a reviewer or approver.

Grant users and roles access to documents by assigning permissions at the role, user, group, or criteria level. Permissions control whether users can view, edit, or own documents.

Create and manage document versions to maintain a complete history of changes as a document evolves.

Use ServiceNow Otto to summarize documents, ask questions, and generate audio summaries without manually reviewing every page.

Use the Tasks page to address the approvals, control attestations, and all other items that are assigned to you and to your group.

Access the CAM Overview, AO Overview, and SCA Overview dashboards from the CAM Workspace to monitor and analyze data and view CAM reports.