Out of the Box NIST Accelarator - Risk Statement

[ajaymandal]

Hi Fourm,

We’re currently in the process of implementing ServiceNow IRM in our organization, and I’m looking for some clarity around the NIST CSF Use Case Accelerator.

Specifically, I want to understand:

➡️ How many out‑of‑the‑box (OOTB) risk statements are provided as part of the NIST Accelerator package?

From the documentation and discussions I’ve reviewed so far, I can see that the NIST CSF Accelerator includes pre‑configured content such as policies, control objectives, risk statements, indicators, and other GRC elements. However, I haven’t been able to find any official count of how many risk statements come OOTB with the accelerator.

Before we finalize our implementation approach, we want to know what baseline content is available so we can plan whether additional risk statements need to be authored internally.

If anyone has an exact number—preferably from hands‑on experience or official ServiceNow documentation—it would be greatly appreciated.

Thanks in advance!

[JadaP]

Hey there you're not missing anything. ServiceNow does not publish an official count of OOTB risk statements for the NIST CSF Use Case Accelerator anywhere in their public documentation or Store listing that I’m aware of. This is a known gap that trips up a lot of practitioners during implementation planning.

Here's what I can share from hands-on experience:

The most reliable way to get a count is to install the plugin on a Personal Developer Instance (PDI), ensure the accelerator is installed, then navigate to the Risk Statements list, and see what’s there. That's the only way to get a number you can actually plan around, because the content can vary depending on your version.

Version matters a lot here. The accelerator historically shipped with NIST CSF v1.1 content. NIST CSF 2.0 content was added in version 19.x (Washington DC release), but there's been community confusion around whether control objectives were updated vs. added as net-new records, so if you're targeting CSF 2.0, make sure you verify which version you're actually working with post-install.

One structural thing to be aware of before you start planning: the OOTB content is policy-dependent. The policy record is the binding link between your control objectives, citations, and risk statements. If you remove or scope out any OOTB policies, the relationships break, which can make it harder to isolate just the risk statements you need. Plan to triage the OOTB policies before deleting anything.

Bottom line on planning: most orgs find the OOTB risk statements give you a solid framework-aligned starting point, but they're rarely sufficient on their own. Budget for custom risk statement development on top of whatever baseline the accelerator provides.

Hope that helps you move forward, happy to answer any follow-up questions!