Use · SN Doc Reader

Use

concept brazil Updated Sep 10, 2026 2 min read using-grc-cam.md

To provide CAM services, you implement the seven steps defined by the NIST Risk Management Framework (RMF), implement controls and assessment objectives, and perform continuous authorization and monitoring.

RMF step 0 - Prepare the authorization package

In the Prepare step, you set up authorization boundaries, control overlays, and information types, as well as create the actual authorization package.
RMF step 1 - Categorize the authorization package

In the Categorize step, you define the criticality or sensitivity of your information system according to potential worst-case scenarios. This involves selecting NIST information types for the package and using the information types to define the impact levels for the package.
RMF step 2 - Select controls for an authorization package

When the impact levels for the package have been approved, it is time to select baseline controls.
RMF step 3 - Implement controls

After you have selected controls for implementation and performed any of the possible actions on them, you can implement the controls.
RMF steps 4, 5, and 6 - Assess, authorize, and monitor

After you have implemented controls, you can assess internal and external controls, generate Plans of Action and Milestones (POA&M), and manage change requests and vulnerable items.
Implement controls and assessment objectives

NIST 800-53A – assessment objectives are included in the base system with the CAM application. The assessment objectives are mapped to revision 5 control objectives.
Continuous authorization and monitoring tasks in the CAM Workspace

The CAM Workspace is a centralized hub where you can continuously monitor and manage compliance with the NIST Risk Management Framework to ensure adherence to your security policies and guidelines.

48 lines · 3.5 KB Wrap lines

---
title: Use
description: To provide CAM services, you implement the seven steps defined by the NIST Risk Management Framework \(RMF\), implement controls and assessment objectives, and perform continuous authorization and monitoring.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/governance-risk-compliance/continuous-risk-monitoring/using-grc-cam.html
release: brazil
product: Continuous Risk Monitoring
classification: continuous-risk-monitoring
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Continuous Authorization and Monitoring, Governance, Risk, and Compliance]
---

# Use

To provide CAM services, you implement the seven steps defined by the NIST Risk Management Framework \(RMF\), implement controls and assessment objectives, and perform continuous authorization and monitoring.

1.  [RMF step 0 - Prepare the authorization package](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/continuous-risk-monitoring/prepare-auth-pkg.md)

    In the Prepare step, you set up authorization boundaries, control overlays, and information types, as well as create the actual authorization package.

2.  [RMF step 1 - Categorize the authorization package](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/continuous-risk-monitoring/categorize.md)

    In the Categorize step, you define the criticality or sensitivity of your information system according to potential worst-case scenarios. This involves selecting NIST information types for the package and using the information types to define the impact levels for the package.

3.  [RMF step 2 - Select controls for an authorization package](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/continuous-risk-monitoring/select-controls.md)

    When the impact levels for the package have been approved, it is time to select baseline controls.

4.  [RMF step 3 - Implement controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/continuous-risk-monitoring/implement-controls.md)

    After you have selected controls for implementation and performed any of the possible actions on them, you can implement the controls.

5.  [RMF steps 4, 5, and 6 - Assess, authorize, and monitor](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/continuous-risk-monitoring/assess-control-effectiveness.md)

    After you have implemented controls, you can assess internal and external controls, generate Plans of Action and Milestones \(POA&amp;M\), and manage change requests and vulnerable items.

6.  [Implement controls and assessment objectives](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/continuous-risk-monitoring/cam-assessment-objectives.md)

    NIST 800-53A – assessment objectives are included in the base system with the CAM application. The assessment objectives are mapped to revision 5 control objectives.

7.  [Continuous authorization and monitoring tasks in the CAM Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/governance-risk-compliance/grc-continuous-authorization-and-monitoring-workspace/cam-ws-continuous-auth-monitor.md)

    The CAM Workspace is a centralized hub where you can continuously monitor and manage compliance with the NIST Risk Management Framework to ensure adherence to your security policies and guidelines.