NIST RMF supporting concepts

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of NIST RMF supporting concepts

    This content outlines key concepts from the NIST Risk Management Framework (RMF) as integrated into ServiceNow’s GRC products, specifically the NIST RMF Use Case Accelerator. It provides foundational definitions and explains how these concepts support security risk management aligned with NIST standards.

    Show full answer Show less

    Note that starting with version 10.1.0, the NIST RMF Use Case Accelerator is supported only for existing customers, and new customers are encouraged to use the GRC: Continuous Authorization Monitoring application.

    Key Concepts

    • Target: The central element representing a single security profile across its RMF lifecycle. Targets are shared tables used across ServiceNow GRC products and Use Case Accelerators, similar to profiles but focused on attributes specific to the accelerators.
    • Security Objectives (Confidentiality, Integrity, Availability):
      • Confidentiality (C): Protecting information access and privacy, rated as High, Moderate, or Low.
      • Integrity (I): Ensuring proper information modification, non-repudiation, and authenticity, rated High, Moderate, or Low.
      • Availability (A): Ensuring timely and reliable access to information, rated High, Moderate, or Low.
    • Baseline Controls: Recommended NIST security controls mapped to impact levels (High, Moderate, Low) that mitigate security risks and meet compliance requirements.
    • Impact Analysis: Determines how changes affect the Target’s security state. Impact levels (Low, Moderate, High) are assigned based on the highest rating among the CIA objectives, which guides the selection of appropriate security controls.
    • Assurance Controls: Enhance the reliability and confidence that Target security functions are complete, correct, and consistent, further mitigating risks.
    • Common Controls: Controls that can be inherited by multiple Targets, simplifying control management across related systems.
    • Compensating Controls: Alternative controls that provide equivalent protection when baseline controls cannot be implemented as recommended.
    • Supplemental Controls: Additional controls applied to meet specific risk management needs beyond baseline requirements.
    • Tailoring: The process of customizing the security control baseline based on Target scoping, compensating controls, and organizational parameters to ensure relevant and effective risk mitigation.

    Practical Implications for ServiceNow Customers

    Understanding these concepts enables customers to effectively align their security risk management and compliance efforts with NIST guidance using ServiceNow GRC solutions. Customers can manage Targets as distinct security profiles, apply appropriate baseline controls based on impact analysis, and customize controls through tailoring to meet unique organizational requirements. The framework supports a structured approach to assessing and mitigating risks related to confidentiality, integrity, and availability of information.

    Familiarize yourself with these concepts, developed from the NIST RMF guidance.

    Note:
    Starting with version 10.1.0, the NIST RMF Use Case Accelerator will be supported only for customers who currently use the product. New and existing customers should consider using the GRC: Continuous Authorization Monitoring application. For details, Continuous Authorization and Monitoring.
    Concept Description
    Target

    The target is the foundation of the NIST RMF Use Case Accelerator and all related concepts.

    The target is a shared table between the ServiceNow® GRC products and several Use Case Accelerators. They are similar to the concept of profiles in the core GRC applications. They are optionally linked to profiles, but are used for any attributes that are specific to the Use Case Accelerators.
    Note:
    Each NIST RMF Target uniquely represents a single profile throughout its RMF life-cycle.
    Confidentiality (C) Confidentiality is a security objective of a Target, and is defined as the act of preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. Confidentiality is expressed as High, Moderate, and Low values
    Integrity (I) Integrity is a security objective of a Target is defined as act of guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. Integrity is expressed as High, Moderate, and Low values
    Availability (A) Availability is a security objective of a Target is defined as act of ensuring timely and reliable access to and use of information. Availability is expressed as High, Moderate, and Low values
    Baseline controls Baseline Controls are recommended set of security controls from National Institute of Standards and Technology (NIST) which when implemented and determined to be effective, would mitigate security risk while complying with security requirements. Baseline controls have a designated impact value which is a combination of High, Moderate, or Low values.
    Impact analysis Impact analysis determines the extent to which proposed or actual changes to the Target or its environment of operation can affect or have affected the security state of the Target. A Target in which all three CIA security objectives evaluate to Low is considered Low-impact and uses any of the security controls which are tagged as Low impact value. Likewise, a Target in which any of the three CIA security objectives evaluate to Moderate is considered Moderate-impact and uses any of the security controls which are tagged as Moderate impact value. Likewise, a Target in which any of the three CIA security objectives evaluate to High is considered High-impact and uses any of the security controls which are tagged as High impact value.
    Assurance Assurance controls increase both the strength of security and degree of confidence that the functionality of Targets is correct, complete, and consistent and would mitigate the security risk and assists in complying with security requirements
    Common Common controls are controls that are inheritable by one or more Targets
    Compensating Compensating controls are controls which can be employed in lieu of recommended baseline security controls and provide equivalent or comparable protection for the Targets
    Supplemental Supplemental controls are controls which can be employed as added security controls to adequately meet the risk management needs of a Target
    Tailoring Tailoring is a process by which a security control baseline is modified based on: (i) Targets scoping guidance; (ii) specification of the security controls, for example, compensating, if needed; and (iii) the specification of organization — defined parameters in the security controls via explicit assignment and selection statements