--- sourceDocument: Australia Strategic Portfolio Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-business-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Strategic Portfolio Management ft:clusterId : - itbm bundleId : - itbm workflow : - Technology --- # Additional security # Additional security with Extended Security for EWD {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Additional security with Extended Security for EWD Additional security is an optional Access Control List (ACL) enforcement feature within Extended Security for Enterprise-Wide Deployment (EWD) in Strategic Portfolio Management (SPM). It enhances data protection by implementing partition-based access control at the database level for key tables: Project, Demand, Program, and Portfolio. This ensures users can only interact with records within their assigned partitions, adding a second layer of security beyond traditional role-based access control (RBAC). Show full answer Show less ## Key Features * **Partition-based ACL Enforcement:** Controls read, create, update, and delete operations based on user partition assignments. * **Supported Tables:** Project (pmproject), Demand (dmndemand), Program (pmprogram), and Portfolio (pmportfolio). * **Independent Table Configuration:** Additional security can be enabled individually on any combination of the supported tables. * **Database-level Enforcement:** Access control applies at the database level, independent of user roles or traditional permissions. * **Immediate Effect:** Changes take effect immediately upon configuration, with existing records retaining their partition assignments. ## When to Use Additional Security * To enforce strict data isolation across business units, geographic regions, or separate entities within your organization. * To comply with regulations requiring partition-level access controls such as SOX, GDPR, or HIPAA. * In multi-tenant environments where segregated customer data access is essential. * To prevent accidental cross-partition data visibility that can occur through role-based permissions. ## Access Model and Configuration Additional security complements existing partition assignments rather than replacing them. Users must be assigned to partitions via roles linked to partitions, team memberships scoped by partitions, or direct assignment on the user record. Users can only access data within their assigned partitions, while enterprise administrators with multi-partition access can view all corresponding records. Configuration is done per table in the SPM Configure console under **Partitions \> Enable additional security**. Administrators simply select the checkbox for each table to enable partition-based ACL enforcement, and changes apply immediately. Additional security is an ACL (Access Control List) enforcement feature available with Extended Security for Enterprise-Wide Deployment that applies partition-based access control to four partitioned tables: Project, Demand, Program, and Portfolio. ## What is additional security {#additional-security-with-extended-security-ewd__section_sdt_bm1_lkc} Additional security is an optional feature that strengthens access control in Enterprise-Wide Deployment by enforcing partition-based ACL rules at the table level. When enabled for a table, users can only read, create, update, or delete records within their assigned partition, regardless of their role or existing table permissions. This provides a second layer of protection beyond traditional role-based access control (RBAC), ensuring that partition boundaries are enforced at the database level. ## Supported tables {#additional-security-with-extended-security-ewd__section_tdt_bm1_lkc} Additional security is available for four tables in Strategic Portfolio Management with Extended Security for EWD. * Project (pm_project) --- Work initiatives and deliverables * Demand (dmn_demand) --- Work requests and capacity planning * Program (pm_program) --- Collections of related projects * Portfolio (pm_portfolio) --- Strategic collections of programs and projects {#additional-security-with-extended-security-ewd__ul_udt_bm1_lkc} You can enable additional security for any combination of these tables. Each table can be configured independently. ## How it works {#additional-security-with-extended-security-ewd__section_vdt_bm1_lkc} When additional security is enabled for a table, every database operation is subject to partition-based ACL validation: * **Read:** Users see only records assigned to their partition * **Create:** New records are automatically assigned to the user's partition * **Update:** Users can modify only records in their partition * **Delete:** Users can delete only records in their partition {#additional-security-with-extended-security-ewd__ul_wdt_bm1_lkc} ACL enforcement occurs at the database level and is independent of role assignments, ensuring consistent access control regardless of how permissions are configured. ## When to use additional security {#additional-security-with-extended-security-ewd__section_xdt_bm1_lkc} Enable additional security when: * Your organization requires strict data isolation between partitions (business units, geographic regions, or separate entities) * Compliance regulations mandate partition-level access controls (SOX, GDPR, HIPAA, etc.) * You operate a multi-tenant deployment where customer data must remain segregated * You want to prevent accidental cross-partition data visibility through role-based permissions {#additional-security-with-extended-security-ewd__ul_ydt_bm1_lkc} ## Access model {#additional-security-with-extended-security-ewd__section_zdt_bm1_lkc} Additional security does not replace partition assignments. Users must still be explicitly assigned to partitions through: * Role assignments linked to partitions * Team membership with partition scoping * Direct partition assignment in the user record {#additional-security-with-extended-security-ewd__ul_a2t_bm1_lkc} When additional security is enabled, users can only access tables and records within the partitions they are assigned to. Enterprise administrators with access to multiple partitions can see records from all their assigned partitions. ## Configuration {#additional-security-with-extended-security-ewd__section_b2t_bm1_lkc} Additional security is configured on a per-table basis in the SPM Configure console under PartitionsEnable additional security. Each table has a checkbox; when checked, partition-based ACL enforcement is enabled for that table. Changes take effect immediately after save. Existing records retain their partition assignment; access restrictions apply to all future queries. For instructions to enable additional security, see [Enable additional security for partitions](https://www.servicenow.com/docs/0KKA4giiZgJ07LnMmmqEow "Enable additional ACL enforcement for partitioned tables to strengthen access control validation. Select the tables where you want to apply enhanced security."). *[\>]: and then