--- sourceDocument: Yokohama Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/governance-risk-compliance Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Continuous Authorization and Monitoring # Continuous Authorization and Monitoring {#ariaid-title1} Release version: Yokohama Updated January 30, 2025 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Continuous Authorization and Monitoring Continuous Authorization and Monitoring (CAM) automates the seven-step NIST Risk Management Framework (RMF) process to help organizations make informed security decisions. This framework, mandated for US federal agencies, enables companies to identify and mitigate risks to their infrastructure effectively. Show full answer Show less The CAM application standardizes and streamlines RMF implementation within ServiceNow, allowing for continuous compliance monitoring and security posture management. ## Key Features * **RMF Step Automation:** Supports all seven RMF steps, from preparation through control implementation, assessment, and ongoing monitoring. * **Prepare:** Configure authorization boundaries, control overlays, information types, and authorization packages. * **Categorize:** Define system criticality and sensitivity based on potential worst-case scenarios. * **Select Controls:** Choose baseline security controls after impact levels are approved. * **Implement Controls:** Execute control actions and implementations. * **Assess and Manage:** Evaluate internal and external controls, generate Plans of Action and Milestones (POA\&M), and handle change requests and vulnerabilities. * **Built-in Assessment Objectives:** Includes NIST 800-53A assessment objectives mapped to revision 5 controls for thorough evaluation. * **CAM Workspace:** Centralized interface for continuous monitoring and management of RMF compliance and security policy adherence. * **Reference Materials:** Detailed documentation on tables, properties, forms, and roles installed with CAM for easier configuration and use. * **Subscription and Activation:** The CAM plugin requires a separate subscription and activation within ServiceNow. ## Practical Considerations for ServiceNow Customers * The CAM application is available for download from the ServiceNow Store; follow the provided checklist for configuration and setup. * Use the CAM Workspace to maintain continuous oversight of your security controls and compliance status, ensuring proactive risk management. * Leverage integrated NIST assessment objectives to align your security evaluations with federal standards. * Access reference topics and support resources including the ServiceNow Community, Known Error Portal, and Customer Service for troubleshooting and guidance. * Be aware that CAM requires a separate subscription, so plan licensing accordingly. Continuous Authorization and Monitoring (CAM) employs the seven steps defined by the NIST Risk Management Framework (RMF) to allow you to make better-informed decisions about your security posture. The video gives you an overview of the seven steps of the Risk Management Framework mandated by the US government for federal agencies that help companies to identify and eliminate risks to their infrastructure. ## Get started {#grc-cam-landing-page__cf-app-landing-get-started} |-|-| | [Explore The CAM application applies a standardized approach to automating NIST's Risk Management Framework (RMF).](https://www.servicenow.com/docs/6zjkBzDJagWTP7_2hZdZTQ "Learn about the CAM benefits and workflows for users.") | [Configure Follow the steps in the checklist to download CAM from the ServiceNow Store and get it ready for operation.](https://www.servicenow.com/docs/6dF8241u1YbcZ9xgiVU_BA "Follow the steps in the checklist to download CAM from the ServiceNow Store and get it ready for operation.") | | [RMF Step 1 - Prepare In the Prepare step, you set up authorization boundaries, control overlays, and information types, as well as create the actual authorization package.](https://www.servicenow.com/docs/Om35C42OuxJaywPDARoaYA "In the Prepare step, you set up authorization boundaries, control overlays, and information types, as well as create the actual authorization package.") | [RMF step 2 - Categorize In the Categorize step, you define the criticality or sensitivity of your information system according to potential worst-case scenarios.](https://www.servicenow.com/docs/8yt6j8Lzt8TtOA6Gd0m4hg "In the Categorize step, you define the criticality or sensitivity of your information system according to potential worst-case scenarios. This involves selecting NIST information types for the package and using the information types to define the impact levels for the package.") | | [RMF step 3 - Select controls When the impact levels for the package have been approved, it is time to select baseline controls.](https://www.servicenow.com/docs/0YBbAZn9icIgr1rDCNkWqQ "When the impact levels for the package have been approved, it is time to select baseline controls.") | [RMF step 4 - Implement controls After you have selected controls for implementation and performed any of the possible actions on them, you can implement the controls.](https://www.servicenow.com/docs/7fTHegBdAxgxf7T3JSQ~Zg "After you have selected controls for implementation and performed any of the possible actions on them, you can implement the controls.") | | [RMF steps 5, 6, and 7After you have implemented controls, you can assess internal and external controls, generate Plans of Action and Milestones (POA\&M), and manage change requests and vulnerable items.](https://www.servicenow.com/docs/WdzGtCvqsvPsKuopFuGRxA "After you have implemented controls, you can assess internal and external controls, generate Plans of Action and Milestones (POA&M), and manage change requests and vulnerable items.") | [Implementing controls and assessment objectives NIST 800-53A -- assessment objectives are included in the base system with the CAM application. The assessment objectives are mapped to revision 5 control objectives.](https://www.servicenow.com/docs/sEr8Tl55Bta07DKfotXz6g "NIST 800-53A – assessment objectives are included in the base system with the CAM application. The assessment objectives are mapped to revision 5 control objectives.") | | [Monitoring and managing The CAM Workspace is a centralized hub where you can continuously monitor and manage compliance with the NIST Risk Management Framework to ensure adherence to your security policies and guidelines.](https://www.servicenow.com/docs/PfLKogKwqofPc~77lkmIGQ "The CAM Workspace is a centralized hub where you can continuously monitor and manage compliance with the NIST Risk Management Framework to ensure adherence to your security policies and guidelines.") | [Reference Reference topics provide the detailed descriptions of tables, properties, forms, and roles that are installed with the CAM application.](https://www.servicenow.com/docs/A4eAk6G1FYy~IMy2h~aCAg "Reference topics provide the detailed descriptions of tables, properties, forms, and roles that are installed with the CAM application.") | [ ] {#grc-cam-landing-page__table_urw_xls_hcc} ## Request apps on the Store {#grc-cam-landing-page__section_parent-topic-send-to-store} Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#grc-cam-landing-page__inline-send-to-store} The Continuous Authorization and Monitoring (com.sn_irm_cont_auth_monitor) plugin is available as a separate subscription and requires activation. ## Troubleshoot and get help {#grc-cam-landing-page__cf-app-landing-get-help} * [Ask questions and explore other resources for Continuous Authorization and Monitoring in the ServiceNow Community](https://www.servicenow.com/community/) * [Search the Known Error Portal for known error articles](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0597477) * [Contact Customer Service and Support](https://support.servicenow.com/now) {#grc-cam-landing-page__ul_qqr_sgj_jcc}