Combined Continuous Authorization and Monitoring release notes for upgrades from Australia to Brazil

reference brazil Updated Nov 6, 2026 7 min read brazil-australia-continuousauthorizationandmonitoring-release-notes.md
Raw file servicenow.com

Consolidated page of all release notes for Continuous Authorization and Monitoring from Australia to Brazil.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Continuous Authorization and Monitoring release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Australia to Brazil.

Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Continuous Authorization and Monitoring to Brazil

Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## New features

Between your current release family and Brazil, new features were introduced for Continuous Authorization and Monitoring.

Release

Release notes

Australia

After upgrading to version 22.3.3, Continuous Authorization and Monitoring supports import and export of OSCAL data for Assessment Results (AR) format.

After upgrading to version 22.3.3, skip the attestation stage at the package level and move controls directly from Draft to Review without completing the attestation workflow.

After upgrading to version 22.3.3, control tailoring requests support changes to overlay controls. You can add new overlay controls or modify existing ones within a control tailoring request.

After upgrading to version 22.0.2, OSCAL import and export support additional details for various records, including status, frequency, weighting, implementation statement, control tailoring requests, overlays, and activities.

After upgrading to version 22.0.2, Continuous Authorization and Monitoring supports import and export of OSCAL data for Assessment Plan (AP) format.

After upgrading to version 22.0.2, make incremental changes to control sets while preserving the state of unchanged controls without having to reset the entire package life cycle. Supported modifications include adding new controls, marking controls as not applicable, changing control allocation (baseline to inherited or hybrid), and modifying inheritance configurations.

After upgrading to version 22.0.2, Controls can inherit individual control requirements from multiple Common Control Providers (CCPs) across different authorization packages. Previously, inheritance was limited to a single provider per control, which required creating duplicate inherited controls when requirements came from different sources.

After upgrading to version 22.0.2, edit implementation statements and attestation respondents directly in a hierarchical data grid through the Controls tab in an authorization package.

After upgrading to version 22.0.2, toggle between traditional related list and hierarchical data grid on the Control tests tab. Changes to assessment procedure effectiveness automatically cascade to parent control test effectiveness.

Package detail forms now use a structured vertical layout instead of the previous horizontal tab arrangement.

After upgrading to version 22.0.2, configure control button visibility, UI page access, and related list actions across different workflow steps. Previously, related list actions (such as add or remove buttons for information types or baseline control actions) required manual scripting to support custom workflows.

The following new state model attributes have been introduced:

-   Required Authorization Documents Page
-   Required Overlay Page
-   Required Information Type Actions
-   Required Baseline Actions
-   Required Overlay Actions
-   Request Control Tailoring
-   Generate OSCAL AP
-   Generate OSCAL AR

Brazil

Link documents as shared resources across authorization packages, boundaries, and engagements. Set approval workflows to control who reviews and activates documents before they take effect.

Summarize documents, generate frequently asked questions with answers, or ask specific questions about document content, all from the Documents side panel in an authorization package, boundary, or engagement.

Generate spoken audio summaries of documents and conduct voice-based Q&A using the Voice Assist panel, from the Documents side panel in an authorization package, boundary, or engagement.

Link documents from Google Drive, OneDrive, or SharePoint and keep them synchronized with authorization packages, boundaries, and engagements. Pull updates from cloud storage or push approved versions back, without manual downloads and uploads.

Using generative AI, the Authorization package summarization skill generates a summary of authorization package records. Each summary consolidates system purpose, impact level, operational status, and open POA&M counts to show the package's current state.

Users with the POAM User role can view and update their assigned Plan of Action and Milestones (POA&Ms), including viewing and updating tasks, accepting or rejecting acceptance tasks, and completing milestone tasks.

## Changes

Between your current release family and Brazil, some changes were made to existing Continuous Authorization and Monitoring features.

Release

Release notes

Australia

The Properties page includes new configuration options:

-   Use **Homepage Title** to customize the workspace homepage name.
-   The **Days Before Next Authorization** property is now available on the UI page.

Brazil

The OSCAL enhancements include:

-   Import system-generated authority documents \(SSP, POA&M, SAR, SAP, ATO Letter, Executive Summary reports\) and user-attached files at Authorization Package and Authorization Boundary levels during OSCAL import.
-   Control objective IDs include source values during OSCAL import and export.
-   Policy fields are included during OSCAL import and export.
## Removed

Between your current release family and Brazil, some Continuous Authorization and Monitoring features or functionality were removed.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## Deprecations

Between your current release family and Brazil, some Continuous Authorization and Monitoring features or functionality were deprecated.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## Activation information

Review information on how to activate Continuous Authorization and Monitoring.

Release

Release notes

Australia

  • Activation information

Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the ServiceNow Store to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Important: Continuous Authorization and Monitoring is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes.

Brazil

  • Activation information

Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the ServiceNow Store to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Continuous Authorization and Monitoring is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes.

## Additional requirements

If any additional requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## Browser requirements

If any specific browser requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## Accessibility information

Review details on accessibility information for Continuous Authorization and Monitoring, such as specific requirements or compliance levels.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## Localization information

If there are specific localization considerations for Continuous Authorization and Monitoring we have noted them here.

Release

Release notes

Australia

No updates for this release.

Brazil

No updates for this release.

## Highlight information

If there are specific highlight considerations for Continuous Authorization and Monitoring we have noted them here.

Release

Release notes

Australia

  • Import and export OSCAL data for Assessment Plan (AP) and Assessment Results (AR) formats to streamline compliance reporting.
  • Skip the attestation stage for all controls in a package and move controls directly to the Monitor step to accelerate package progression.
  • Populate additional control fields when importing and exporting OSCAL data for SSP, AP, and AR formats to capture richer compliance details.
  • Raise control tailoring requests to make incremental changes to control sets in authorized packages without resetting the entire package life cycle.

See Continuous Authorization and Monitoring for more information.

Brazil

  • Applies a standardized approach to automate the NIST Risk Management Framework, a U.S. Federal mandate for information system security.
  • Defines clear accountability across System Owners, Authorizing Officials, Security Control Assessors, Information System Security Officers, and other roles
  • Provides continuous monitoring and centralized management of NIST RMF compliance, including control implementation and assessment, authorization boundaries and impact levels, and Plans of Action & Milestones (POA&M)

See Continuous Authorization and Monitoring for more information.

**Parent Topic:**[Products combined by family](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/delta-australia-brazil/rn-combined-intro.md)
Search documentation
Search document titles and file paths on the brazil branch