Technology risk calculation in Enterprise Architecture Workspace

  • Release version: Australia
  • Updated March 12, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Technology risk calculation in Enterprise Architecture Workspace

    This feature in the Enterprise Architecture Workspace enables ServiceNow customers to assess and calculate technology risks associated with their business applications. The risk calculation is performed at multiple levels—hardware models, software products, application services, and ultimately the business application level—providing a comprehensive view of technology risk exposure.

    Show full answer Show less

    Technology Lifecycle Management (TLM), formerly known as Technology Portfolio Management (TPM), is the underlying feature used for risk calculations. Note that terminology and interface elements may vary depending on application versions installed.

    Key Features

    • Risk Calculation Levels: Risks are computed at the hardware model and software product levels, then aggregated to application services and business applications.
    • Lifecycle-Based Risk Values: Risk is assigned based on lifecycle phases (internal and external) and aging of hardware/software components. Risk categories include very high, high, moderate, low, and none, customizable per organizational needs.
    • Aging Risk Parameters: Defined as high risk for 0-90 days, moderate for 90-180 days, and low for more than 180 days.
    • Risk Aggregation Logic:
      • If any component has high risk, the overall risk is high.
      • If any component has moderate risk and none are high, the overall risk is moderate.
      • Overall risk is low only if all underlying components have low risk.
    • Parameter-Based Risk Calculation: Software model risks consider internal/external lifecycle stages and aging; hardware model risks consider internal/publisher lifecycle stages and aging.
    • Customizable Risk Scripts: The scripted calculations for aging and risk aggregation can be tailored to meet specific organizational requirements.
    • Data Storage and Visualization: Risk data is stored in dedicated tables ([snapmtpmhardwaremodelrisk] and [snapmtpmsoftwaremodelrisk]) and visualized through the software model timeline.

    How Risk Propagates

    • Hardware and Software Model Risk: Calculated first using lifecycle and aging parameters.
    • Application Service Risk: If any underlying hardware or software model is high risk, the application service inherits the high risk.
    • Business Application Risk: Derived from the risks of all associated application services and software/hardware models, following the aggregation logic above.

    What You Can Expect

    With this technology risk calculation approach, ServiceNow customers gain detailed insights into the risk posture of their technology stack supporting business applications. This enables proactive risk management by identifying high-risk hardware or software components and understanding their impact on application services and business applications.

    Customers can customize risk thresholds, lifecycle stages, and aging parameters to align risk assessments with their organizational policies and compliance requirements. The feature supports informed decision-making for technology lifecycle management, ultimately helping to reduce operational risks and improve enterprise architecture governance.

    Assess the technology risks of your business applications by calculating their risks. Technology risks are calculated at the hardware model and software product levels to determine the risk at the business application level.

    Important:

    Technology Lifecycle Management (TLM) was previously known as Technology Portfolio Management (TPM). TPM and TLM refer to the same feature. Table names and scheduled job names continue to use TPM and haven't been renamed.

    Whether your instance displays TPM or TLM also depends on your application versions. TLM labels appear only when both the Enterprise Architecture Workspace application (version 9.2.1 or later) and the Technology Lifecycle Management plugin, sn_apm_tpm (version 1.11.0 or later), are installed. If either application is on an earlier version, the interface continues to show TPM.

    Technology risks are calculated at the hardware model and software product (considering the model and full version) levels to determine the risk at the business application level.

    Lifecycle stage - Internal and External

    The range set for a risk value at each level such as very high, late, moderate, low, and none vary from one organization to another. You can set the risk value for each lifecycle phase based on your organizational requirements. Use the software product lifecycle form to associate the lifecycle phase for each software model with a risk. Based on the selected risk the parameter risk is determined.

    The risk values in the lifecycle table are very high, high, moderate, low, and none. Accordingly the risk is also very high, high, moderate, low, or none.

    For lifecycle stage parameters, only the risk value is considered irrespective of the lifecycle phase.

    Aging - Internal and External

    Similarly, the aging internal and external has the following risk values:

    • 0–90 days is high risk.
    • 90–180 days is moderate risk.
    • More than 180 days is low risk.
    Based on the internal and publisher lifecycle stages and the internal and publisher aging stages, the risk of the hardware and software models are calculated as follows:
    • If there is a single High risk, then the risk of the software model is High.
    • If there is a single Moderate risk, then the risk of the software model is Moderate.
    • The risk of the software model is Low only if the risk of all the underlying components are Low.
    • If there is a single High risk, then the risk of the hardware model is High.
    • If there is a single Moderate risk, then the risk of the hardware model is Moderate.
    • The risk of the hardware model is Low only if the risk of all the underlying components are Low.
    Note:
    The engine first calculates the risk at the hardware and software models, it then calculates risk at the application service level, based on the risks of all the underlying hardware and software models. Finally it calculates the risk at the business application level based on the risk of the production instances which are nothing but production application service.

    The risk calculation for aging parameters are scripted and you can edit as required.

    Parameters to determine software product risk

    Figure 1. Parameters to determine risk at software model level
    An example showing how parameters are used in calculating risk at the software model level

    Risk on a software model is calculated based on four parameters, namely internal lifecycle stage, external lifecycle stage, internal aging, and external aging.

    Parameters to determine hardware model risk

    Figure 2. Parameters to determine risk at hardware model level
    Illustration showing how parameters are used in calculating risk at hardware model level

    Risk on a hardware model is calculated based on four parameters. The parameters are internal stage risk, publisher stage risk, internal aging risk, and publisher aging risk.

    Calculating technology risk at business application level

    A business application can run on many software models. The risk of a business application due to its underlying software models is derived from the risk of the individual software models.

    Figure 3. Calculating risk at the business application level
    Calculating technology risk at the business application level
    Risk at hardware model level
    The technology model suggestion engine calculates the risk of the hardware model based on the four hardware risk parameters. The highest risk value is assigned to the hardware model. If the risk of hardware is high, then the risk of the application service, which runs on the hardware, is evaluated to be high. The engine stores the risk data of the hardware model in the Hardware Model Risks [sn_apm_tpm_hardware_model_risk] table.
    Risk at software model level
    Based on the four software risk parameters, the technology model suggestion engine calculates the risk of the software model. If the risk of software is high, then the risk of the application service, which runs on the software, is evaluated to be high. The engine stores the risk data of the software model in the Software Model Risks [sn_apm_tpm_software_model_risk] table. This data is rendered on the software model timeline.
    Risk at application service level
    If any hardware or software model on which the application service runs is high risk, the application service is also high risk.
    Risk at business application level

    If the application service is of high risk, then the business application which runs on the application service is also high.

    • If one of the software models is at High risk, then the business application is at High risk.
    • If one of the software models is at Medium risk, then the business application is at Medium risk.
    • The risk of the business application is Low only if all the underlying software models have a Low risk.
    • If one of the hardware models is at High risk, then the business application is at High risk.
    • If one of the hardware models is at Medium risk, then the business application is at Medium risk.
    • The risk of the business application is Low only if all the underlying hardware models have a Low risk.

    You can customize the script that is executed to calculate the risks at the product model risk level (hardware and software models). The script also calculates risks at the application service risk level and business application risk level.