on - edited on by
Steph Morillo
|
Welcome to ServiceNow® Major Security Incident Management (MSIM) Are you ready to start your Major Security Incident Management (MSIM) implementation journey? This guide gives you valuable information you can share with your team, including proven guidance and links to key resources—all designed to set you on the path to success. While this guide is primarily designed for ServiceNow platform owners, it also contains useful information if you have a different role in your organization.
Let’s get started!
|
 |
|||
|
Guide Overview Here’s an overview of the topics we will cover in the guide:
|
|
|||
|
Start by familiarizing yourself with MSIM Major Security Incident Management (MSIM) offers you a virtual war room for driving a collaborative response to critical security incidents. MSIM tracks the progress of Major Security Incidents from discovery to closure, centralizing operations and enabling you to better prepare and respond to high profile security incidents such as ransomware, data breaches, and targeted attacks.
For more information on MSIM, we recommend reviewing the product documentation, including this Checklist for MSIM Setup and How to Get started with MSIM. On the ServiceNow Store page for MSIM, you will also find a detailed MSIM Quick Start Guide (PDF) available for downloading (located under “Supporting Links and Docs” on the right-hand side). This guide helps you quickly get started with MSIM and provides links to additional resources.
Here are some other MSIM resources that are useful to get started:
Check out this Security Operations demonstration video, which also includes an overview of the MSIM Workspace, as well as this video on How ServiceNow MSIM Helps Streamline Collaboration When Dealing With Major Security Incidents.
For additional learning, we have a Security Operations Fundamentals course (Instructor-Led or On-Demand) which provides an overview of the SecOps product suite, as well as a Security Incident Response Implementation course (Instructor-Led or On-Demand), which has a section featuring MSIM. If you are new to ServiceNow, we also strongly recommend that you take this very short Get Started with the Now Platform course to learn platform basics. If you want a deeper dive into using the Now Platform, a longer ServiceNow Administration Fundamentals course (Instructor-Led or On-Demand) is also available. |
Major Security Incident Management (MSIM) is available in the following ServiceNow products:
Check out the Security Incident Response product page to learn more. |
|||
|
Identify your desired business outcomes Before you start to implement MSIM, it’s critical to have a clear vision of what you want to accomplish. MSIM allows you to deliver multiple positive business outcomes, and you can achieve all of these over time.
However, by deciding which outcomes are most important for your organization and agreeing on these with your stakeholders, you can set clear expectations and tailor your initial implementation to realize these goals.
For more information, including sample business objectives and key performance indicators, check out this article on SecOps Outcomes and How to Measure Them.
|
|
|||
|
Chart a path to implementation Work with ServiceNow experts If you have chosen to work with a ServiceNow partner or ServiceNow Expert Services for your implementation, it’s important to clearly communicate the business outcomes you want to achieve and agree on a well-structured roadmap to attain these goals. If you need guidance on successfully engaging with an implementation partner, this workbook is an excellent starting point.
To accelerate time to value and reduce risk, make sure that your partner uses Now Create, ServiceNow’s library of more than 700 leading implementation practices. We also recommend you use Now Create (login required) if you are self-implementing, as it provides a wealth of assets designed to guide you to success, including:
Check out this post featuring a Quick Start one-pager resource for MSIM.
If you want to work with a partner but haven’t selected one yet, check out our Partner Finder or talk to your ServiceNow account representative about ServiceNow Expert Services. We can also work with your chosen partner to infuse our expertise into your implementation through our ServiceNow Co-Delivery service offering.
For those of you who have purchased ServiceNow Impact services, ServiceNow experts and resources are at your fingertips to help you implement MSIM and achieve your goals. If you don’t have a ServiceNow Impact package, consider how having dedicated resources, discounted training, and jumpstart services can help you get the most out of your ServiceNow investment. Read more here. |
|
|||
|
Self-implementation Build your team’s skills If you are planning to self-implement, you’ll need to build your platform team’s knowledge and skills before you begin. This is a key reason many SecOps customers choose to work with a partner instead of self-implementing. The following certification paths are a good starting point for building these skills, but we do strongly recommend that you also engage resources who have previous SecOps and MSIM implementation experience.
Make your implementation smooth and easy For a comprehensive implementation process framework that is proven to scale to the largest, most complex global deployments, take a look at our Success Packs on Now Create. Success Packs tailor our core Now Create methodology of more than 700 leading practices to deliver business outcomes aligned with specific product sets:
Understand ServiceNow releases and upgrades If you’re not already on the latest ServiceNow release, we strongly recommend that you upgrade before you go live. By upgrading, you get new ServiceNow innovations into the hands of your users faster, gain access to the latest performance and security enhancements, and ensure that support is there when you need it.
To make your upgrade smooth and successful, check out these upgrade resources. View the MSIM release notes here. |
Pro Tip Stick to out-of-the-box ServiceNow functionality wherever possible. The process guide below provides detailed descriptions of “as designed” ServiceNow functionality for Security Incident Response features and includes a section on MSIM:
|
|||
|
Prepare for organizational change To successfully deploy MSIM, you need your business to understand and use MSIM, and to recognize its benefits. With many different stakeholder groups, it is essential to ensure everyone understands the benefits for them, and how to get the most value out of the system. More broadly, this webpage provides detailed guidance on how to plan for organizational change. If you need help creating a winning communications plan, this communication plan template also provides useful advice.
The following courses are a great starting point for training your analysts and other MSIM process users:
|
|
|||
|
Bookmark these resources! ServiceNow Customer Success Center -- The CSC is a one-stop shop that gives you instant access to proven methodologies, leading practices, and expert insights and advice. NowSupport -- You can get technical issues resolved quickly by contacting our team comprised of ServiceNow employees with deep product knowledge and real-world experience. Read more here on how to use support. |
|
