Continuous Risk Monitoring

Add impact levels to a version to categorize authorization packages by risk level. Impacts filter control objectives based on the impact requirements and work with versions.

Add Governance, Risk, and Compliance model state transition conditions to a state transition to validate data before enabling authorization packages to move between workflow steps. Transition conditions verify that the required information is complete and accurate before packages proceed.

Add workflow versions to a workflow configuration to support different revisions or iterations of your workflow. Workflow versions filter control objectives based on the version requirements.

Configure custom view rules to display specific fields, sections, or layouts for authorization packages using a particular workflow configuration. View rules enable workflow-specific user interfaces without modifying the base package form.

Add Governance, Risk, and Compliance workflow states to a state model to define the individual steps in your workflow. Each workflow state represents a phase in the authorization package life cycle and determines what you can do at that stage.

As an Authorizing Official (AO) or AO Delegate, review and approve or reject control tailoring requests to ensure governance and oversight of baseline control modifications.

After you have implemented controls, you can assess internal and external controls, generate Plans of Action and Milestones (POA&M), and manage change requests and vulnerable items.

Assign roles to users and groups to prepare to use the CAM application.

Approve the authorization package when it is in the Select step to create controls. After approval, the authorization package moves to the Implement step and the controls are generated. You can still modify the control requirement implementation status at the control level.

Use the test plan that is automatically generated for a control, which is in an assess state, to view and determine if the control is assessed in accordance with the assessment procedure plan.

NIST 800-53A – assessment objectives are included in the base system with the CAM application. The assessment objectives are mapped to revision 5 control objectives.

Activating the GRC: CAM plugin adds or modifies several tables, user roles, and other components.

Configure the ATO artifacts report templates using the ServiceNow Document Designer with Word add-in.

Apply the objective effectiveness of the assessment procedures and the operating effectiveness of the control test to determine the control effectiveness of the control test. An assessment procedure is applied to check the control test at a granular level.

You can break down a control at a more granular level as requirements when you generate the control at the control objective level.

Control objective requirements are created for a control objective. The control requirements are generated for all the controls that are associated with a control objective. However, a control or a control requirement can become non-compliant because of an attestation failure or issue creation at either of the two levels.

The CAM view of the Control form has fields that have been added to capture the control requirement details.

Define the data that you want to view or fetch, whether it's a list of records or an aggregation when creating an ATO artifacts. For example, specify if you want to see a list of closed POA&M or the list of system elements. A maximum of 200 records can be fetched from any table.

Create a Governance, Risk, and Compliance state model to define the steps, transitions, and validations for a custom workflow in CAM. State models control how authorization packages move through workflow life cycles and determine which actions are available at each step.

An authorization boundary defines the scope of a particular system that can be continuously managed and monitored using the CAM application.

After you have defined the authorization boundaries for the assets or systems to send through the Authorization to Operate process, you must create an authorization package for that purpose. The package is processed through the seven steps mandated by the RMF.

Use the baseline controls to inherit a control, mark a control as common, or create a hybrid control. Create a hybrid control to inherit requirements partially from common controls and the remaining requirements are created for the control that was generated from the baseline control.

The CAM Overview dashboard provides multiple tabs with reports on critical aspects of your CAM security posture.

Platform Analytics Solutions contain prepackaged Performance Analytics and Reporting content for use with ServiceNow AI Platform products. The solutions help you to track and analyze CAM performance analytics dashboard reports.

Assign users and groups with roles to prepare them to user the CAM application.

The checklist includes the tasks that you must complete to prepare the base system.

The Creates controls automatically and Create control requirements options in the control objective form and the state of the authorization package are important to create control requirements.

Configure custom workflows in Continuous Authorization and Monitoring to support compliance requirements beyond the default National Institute of Standards and Technology NIST Risk Management Framework.

In the Categorize step, you define the criticality or sensitivity of your information system according to potential worst-case scenarios. This involves selecting NIST information types for the package and using the information types to define the impact levels for the package.

Create custom state model attributes to add specialized capabilities to workflow steps.

Add existing Governance, Risk, and Compliance state model attributes to add special capabilities to workflow steps without custom code. Attributes control features like approval requirements, report generation, and Open Security Controls Assessment Language (OSCAL) file exports for specific workflow states.

Follow the steps in the checklist to download CAM from the ServiceNow Store and get it ready for operation.

After you have defined the authorization boundaries for the assets or systems to send through the Authorization to Operate process, you must create an authorization package for that purpose. The package is processed through the seven steps mandated by the RMF.

After you have created a common control, you can identify other controls that can inherit protection and compliance from that common control.

Create a control tailoring request to modify baseline controls for an authorization package after the Select step without reverting the package to earlier workflow steps.

Create state model transitions to define valid paths between workflow states. State model transitions control how authorization packages move from one step to another and verify that packages follow the correct sequence through your workflow.

An authorization boundary defines the scope of a particular system that can be continuously managed and monitored using the CAM application.

Enable the CAM workflow configuration to use custom workflows and frameworks in CAM. This feature enables you to configure workflows beyond the default National Institute of Standards and Technology (NIST) framework and adapt CAM to your organization's specific requirements.

Learn about the CAM benefits and workflows for users.

Continuous Authorization and Monitoring (CAM) employs the seven steps defined by the NIST Risk Management Framework (RMF) to allow you to make better-informed decisions about your security posture.

After you have selected controls for implementation and performed any of the possible actions on them, you can implement the controls.

Inherit individual control requirements from different provider packages to create a fully inherited control within an authorization package.

Install the ServiceNow Document designer add-in to your Microsoft Word document to create audit and CAM report templates and generate report content using the AI Reporting Assistant.

In the Prepare step, you set up authorization boundaries, control overlays, and information types, as well as create the actual authorization package.

Reference topics provide the detailed descriptions of tables, properties, forms, and roles that are installed with the CAM application.

Users with the Authorization Official [sn_irm_cont_auth.authorization_official] role can view the reports in the AO Overview module.

The SCA Overview dashboard enables you to view and manage control assessments as they occur.

Control tailoring requests enable you to modify baseline controls for an authorization package after the Select step without reverting the package to earlier workflow steps.

Run the migration scheduled job to associate existing authorization packages and boundaries with the workflow after enabling the CAM workflow configuration property. The migration confirms that existing data is compatible with the workflow configuration.

When the impact levels for the package have been approved, it is time to select baseline controls.

Skip Attestations lets you bypass the attestation stage for all controls in a package. When enabled (before implementation), controls move directly from Draft to Review, attestation-related UI elements are hidden, and Review/Monitor actions replace attestation workflows.

To provide CAM services, you implement the seven steps defined by the NIST Risk Management Framework (RMF), implement controls and assessment objectives, and perform continuous authorization and monitoring.

View and edit control tests and assessment procedures in a hierarchical data grid.

View and edit controls and their requirements in a hierarchical data grid that enables bulk operations and in-line editing.

Define workflow, framework, regulation, and its associated versions, impacts, and view rules. CAM ships National Institute of Standards and Technology (NIST) workflow configuration by default. However, you can create additional workflows for other frameworks such as Protective Security Policy Framework (PSPF) or custom internal frameworks.