Creating encrypted fields of type string on incident, case and ritm table

[ss52]

We have a requirement to have two new encrypted fields on incident, case and RITM table.

We planned to create these fields at task table and can be reused for different client in future as well on any table that extends task table.

These two encrypted fields to be decrypted or content visible for current assigned to user and requestor of incident, case and ritm.

We do have field encryption starter license and going with ServiceNow specified keys.

Configurations done:

Created two fields at task level.

Step 1: Set Up the Encryption Module

1. Navigate to System Security > Field Encryption Modules in the Application Navigator.
2. Click New to create a new encryption module. Configure the following fields:
• Module Name: incident_short_description
• spec Template: Default template
• Name: auto populated based on module name
• Application: Global
• module lifecycle state: Published
• Parent module: Pre-populated as column_level_encryption (read-only)
3. Save the configuration by right-clicking on the form header and selecting Save.

Step 2: Configure the Specification

1. On the Module form, click the global.incident_description record under the Specifications related list.
2. In the Algorithm Definition form, confirm the pre-populated fields and click Next.
3. Open the auto-generated Key Lifecycle record and update the following fields on the Field Lifecycle Template form:
• Expiration date [expiration_date]: Set to expire 1 year after activation.
• Relative duration: 1 year, relative to the Activation date.
4. Click Update, and then Next.

Step 3: Generate the Encryption Key

1. On the Key Origin form, set the Key alias to incidentkey (overwrite the existing value).
2. Click Next, and on the Key Creation form, click Generate Key.
3. You’ll return to the Module form, where a new record with the encryption key will appear under the Module Keys related list. The key will have an expiration date of 1 year after activation.

Step 4: Create a Module Lifecycle Policy

Module Lifecycle Policies track and limit the validity of a specific encryption module. Follow these steps:

1. From the Module Policy Exceptions related list of the incident_description Encryption Module, click New.
2. Configure the policy:
• Key type: Symmetric Data Encryption Key
• Policy condition: Expiration date is more than 2 years after activation.
• Result: Track
3. Click Submit to save the policy.

Kindly guide me on How can i create module access policy where these fields to be decrypted only for current assigned to and requetsor of case , incident and sc task.

Thanks in advance

[Ankur Bawiskar]

@ss52 

you will require script type module access policy which has script include

Module access policy overview 

Create a module access policy 

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[ss52]

Hi Ankur,

I alreayd tried this module access policy and selected type as script. but the functionality is nto working as expected. So kindly guide me on this