--- sourceDocument: brazil Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/delta-yokohama-brazil Release : - brazil ft:locale : - en-US ft:publication_title : - brazil Combined Product Files ft:clusterId : - delta3by bundleId : - delta3by --- # Combined Continuous Authorization and Monitoring release notes for upgrades from Yokohama to Brazil # Combined Continuous Authorization and Monitoring release notes for upgrades from Yokohama to Brazil {#ariaid-title1} Release version: Brazil Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 14 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Continuous Authorization and Monitoring release notes for upgrades from Yokohama to Brazil This consolidated release notes document assists ServiceNow customers in preparing for upgrading Continuous Authorization and Monitoring (CAM) from the Yokohama release family to Brazil. It summarizes new features, changes, and important upgrade information across the Yokohama, Zurich, Australia, and Brazil releases. The document also highlights activation instructions, requirements, and enhancements to streamline CAM usage and compliance workflows. Show full answer Show less ## Key Features * **OSCAL Import and Export Enhancements:** Starting in Yokohama, CAM introduced an OSCAL Import landing page for catalog and System Security Plan (SSP) models with status tracking, and an OSCAL Export button for control objectives. Brazil release expands this with support for importing system-generated authority documents, user-attached files, and policy fields during OSCAL import/export. * **ATO Artifact Generation:** Generate Authorization to Operate (ATO) artifacts including Security Assessment Plan, ATO Letter, and Executive Summary in Microsoft Word format with consistent templates to facilitate sharing and review. * **Workflow Configuration and Governance:** Zurich introduced CAM Workflow Configuration, enabling administrators to create, manage, version, and configure custom workflows with GRC state models, approvals, risk assessments, and migration of NIST RMF flow for enhanced standardization. * **Boundary Management Enhancements:** New Child Boundaries list allows one-to-many relationships visualized in sidebar and diagram views, with OSCAL export/import supporting parent-child mappings. Dynamic boundary filters update system elements automatically based on conditions. Boundary operational status synchronizes with package lifecycle states for improved coherence. * **OSCAL Import Playbook and Overlay Enhancements:** User-friendly OSCAL import playbook supports multiple overlay files, previews data before import, and auto-maps users and groups to ServiceNow entities. Overlays now support addition, subtraction, and customization of control objectives within authorization packages. * **Australia Release Highlights:** Support for importing/exporting OSCAL Assessment Results and Plans, skipping attestations to accelerate workflows, enhanced control tailoring requests supporting overlay controls, and improved data grid views for controls and tests. * **Brazil Release Highlights:** Automation of NIST Risk Management Framework compliance with clear role accountability, continuous monitoring of control implementation and assessment, centralized management of authorization boundaries and impact levels, and POA\&M tracking. Also includes AI-powered document analysis and summarization, voice-assisted Q\&A, external cloud storage synchronization for documents, and a POAM user role to manage Plan of Action and Milestones. * **Document and UI Improvements:** Authorization package summaries generated by generative AI, new CAM system properties page for administrators, card-based workspace homepage with modern layout, vertical package and boundary layouts, and coral theme with dark mode for enhanced user experience. ## Key Outcomes * ServiceNow customers upgrading CAM will benefit from streamlined compliance workflows through enhanced automation, import/export flexibility, and improved governance controls. * Consistent and shareable ATO artifact generation in Microsoft Word and OSCAL formats simplifies authorization package documentation and review processes. * Enhanced workflow customization and state management improve risk assessment and approval processes aligned with organizational standards and NIST RMF requirements. * Improved boundary management with hierarchical relationships and dynamic filtering enables better control over authorization scopes. * AI-driven document analysis and cloud storage integration reduce manual effort in managing compliance documentation and improve accessibility. * Users can accelerate package progression by skipping attestations and tailor controls incrementally without full lifecycle resets, enhancing agility. * Activation remains consistent across releases, with CAM available via the ServiceNow Store, ensuring customers can easily access and maintain the application. ## Pre- and Post-Upgrade Considerations Before upgrading to Brazil, customers should review and complete any necessary pre- and post-upgrade tasks outlined in the release notes to ensure a smooth transition. The document notes that no features or functionalities were removed or deprecated between Yokohama and Brazil, minimizing disruption risk. ## Support and Activation Continuous Authorization and Monitoring is available for installation and upgrade through the ServiceNow Store. Customers are advised to consult the ServiceNow Store version history and activation instructions to manage installations across releases effectively. Consolidated page of all release notes for Continuous Authorization and Monitoring from Yokohama to Brazil. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Continuous Authorization and Monitoring release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Brazil. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Continuous Authorization and Monitoring to Brazil Before you upgrade to Brazil, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__2} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## New features Between your current release family and Brazil, new features were introduced for Continuous Authorization and Monitoring. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__12} | Release | Release notes | |-|-| | Yokohama | [OSCAL Import landing page](https://www.servicenow.com/docs/access?context=import-oscal&family=yokohama&ft:locale=en-US) : Import files for catalog and SSP models on the new OSCAL Import landing page. Once the import process is initiated, you can check the status under the Import status section. [OSCAL Export button](https://www.servicenow.com/docs/access?context=export-catalog-cam-ws&family=yokohama&ft:locale=en-US) : Export selected control objectives in the OSCAL format with the new OSCAL Export button while in the control objectives list view. [ATO artifacts in Microsoft Word](https://www.servicenow.com/docs/access?context=generate-ato-artifacts-cam-ws&family=yokohama&ft:locale=en-US) : Generate ATO artifacts from an authorization package in the Microsoft Word format. In CAM Workspace, you can use the Generate SSP drop-down list in a selected authorization package to generate the following reports: * Security Assessment Plan (SAP) * Authorization to Operate (ATO) Letter * Executive Summary This enhancement verifies that all ATO artifacts are formatted consistently and can be shared and reviewed. | | Zurich | [\[Placeholder link text to key cam-workflow-configurator\]](https://www.servicenow.com/docs/access?context=cam-workflow-configurator&family=zurich&ft:locale=en-US) : Streamline governance, risk, and compliance processes with the CAM Workflow Configuration. This feature allows administrators to: * Create and manage multiple workflows within a package. * Define GRC State Models for custom workflows. * Configure and version workflows. * Evaluate workflow version impacts to retrieve baseline controls. * Set up workflow-specific approval configurations. * Perform risk assessments across CAM objects. * Migrate the NIST RMF flow to workflow configuration for improved standardization. [\[Placeholder link text to key add-child-boundary\]](https://www.servicenow.com/docs/access?context=add-child-boundary&family=zurich&ft:locale=en-US) : Introducing a new Child Boundaries list that enables a one-to-many boundary hierarchy, allowing you to create relationships between boundaries. This hierarchy is visualized in both the sidebar and diagram view, showing one parent boundary with multiple child boundaries. OSCAL export and import now include the parent boundary relationship if present. Dynamic Boundary Filters [Dynamic boundary filters](https://www.servicenow.com/docs/access?context=create-boundary-filter&family=zurich&ft:locale=en-US) : Select the Dynamic Filter option in boundary filters to update system elements according to filter conditions. When disabled, the system elements remain unchanged. This update enhances the flexibility of boundary filter management. [Boundary operational status automation](https://www.servicenow.com/docs/access?context=cam-form-authorization-boundary&family=zurich&ft:locale=en-US) : Linking boundary operational status to the package life cycle ensures seamless integration. Key changes include: * Automatic update of boundary status to Operational when a package moves to the Monitor state. * Transition of Boundary status to Reauthorize as the Package Authorization date approaches. This update maintains synchronization between package and boundary states, enhancing overall system coherence. [\[Placeholder link text to key export-oscal-files-from-authorization-package\]](https://www.servicenow.com/docs/access?context=export-oscal-files-from-authorization-package&family=zurich&ft:locale=en-US) : Generating and downloading OSCAL SSP and POA\&M files is supported directly from within a authorization package. The supported file types include: * Catalog * Overlay Catalog * Profile * SSP * POA\&M [OSCAL import enhancements](https://www.servicenow.com/docs/access?context=import-oscal&family=zurich&ft:locale=en-US) : Enhancing the OSCAL import experience, the OSCAL import playbook now allows you to: * Import individual POA\&M JSON files. * User Mapping: Automatically map users to existing ServiceNow users based on exact name matches, with the option to manually adjust mappings. * Group Mapping: Automatically map groups to existing ServiceNow groups based on exact name matches, with the option to manually adjust mappings. * Roles and Responsibilities: Populate relevant package fields with roles and responsibilities. [Overlay enhancement](https://www.servicenow.com/docs/access?context=prepare-auth-pkg&family=zurich&ft:locale=en-US) : Apply policies as an overlay in an authorization package to determine how the control objectives in the policy impact the baseline. This can be done in the following ways: * Addition: Create control objectives to address specific requirements not covered in the baseline. * Subtraction: Move existing control objectives to Not Applicable. * Customization: Create, move existing control objectives to not applicable, or skip control objectives. [OSCAL enhancements](https://www.servicenow.com/docs/access?context=oscal-cam-ws&family=zurich&ft:locale=en-US) : Use the OSCAL import playbook to follow a user-friendly, step-by-step approach for importing OSCAL models. Using the playbook, you can: * Add multiple Catalog overlay files. * Preview OSCAL data before importing them to confirm accuracy. You can preview the following: * Authorization boundary * Authorization package * System elements * Information types * Baseline controls * Inherited controls * Hybrid controls * Not applicable controls * Policies * Control objectives * Control objectives requirements * Skipped objects in the preview, such as control objectives, policies, authorization boundaries and packages can be individually overridden. | | Australia | [Support for exporting and importing the OSCAL Assessment Results (AR) model](https://www.servicenow.com/docs/access?context=oscal-cam-ws&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, Continuous Authorization and Monitoring supports import and export of OSCAL data for Assessment Results (AR) format. [Skip attestations configuration for controls within a package](https://www.servicenow.com/docs/access?context=skip-attestations&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, skip the attestation stage at the package level and move controls directly from Draft to Review without completing the attestation workflow. [Control tailoring request enhancements](https://www.servicenow.com/docs/access?context=request-control-tailoring&family=australia&ft:locale=en-US) : After upgrading to version 22.3.3, control tailoring requests support changes to overlay controls. You can add new overlay controls or modify existing ones within a control tailoring request. [OSCAL export and import enhancements](https://www.servicenow.com/docs/access?context=oscal-cam-ws&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, OSCAL import and export support additional details for various records, including status, frequency, weighting, implementation statement, control tailoring requests, overlays, and activities. [Support for exporting and importing the OSCAL Assessment Plan (AP) model](https://www.servicenow.com/docs/access?context=oscal-cam-ws&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, Continuous Authorization and Monitoring supports import and export of OSCAL data for Assessment Plan (AP) format. [Request control tailoring](https://www.servicenow.com/docs/access?context=request-control-tailoring&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, make incremental changes to control sets while preserving the state of unchanged controls without having to reset the entire package life cycle. Supported modifications include adding new controls, marking controls as not applicable, changing control allocation (baseline to inherited or hybrid), and modifying inheritance configurations. [Inherit from multiple providers](https://www.servicenow.com/docs/access?context=inherit-from-multiple-providers&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, Controls can inherit individual control requirements from multiple Common Control Providers (CCPs) across different authorization packages. Previously, inheritance was limited to a single provider per control, which required creating duplicate inherited controls when requirements came from different sources. [Control grid view](https://www.servicenow.com/docs/access?context=view-controls-in-grid-view&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, edit implementation statements and attestation respondents directly in a hierarchical data grid through the Controls tab in an authorization package. [Control tests grid view in Engagements](https://www.servicenow.com/docs/access?context=view-control-tests-in-grid-view&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, toggle between traditional related list and hierarchical data grid on the Control tests tab. Changes to assessment procedure effectiveness automatically cascade to parent control test effectiveness.Package detail forms now use a structured vertical layout instead of the previous horizontal tab arrangement. [CAM workflow configuration enhancements](https://www.servicenow.com/docs/access?context=cam-workflow-configurator&family=australia&ft:locale=en-US) : After upgrading to version 22.0.2, configure control button visibility, UI page access, and related list actions across different workflow steps. Previously, related list actions (such as add or remove buttons for information types or baseline control actions) required manual scripting to support custom workflows. The following new state model attributes have been introduced: * Required Authorization Documents Page * Required Overlay Page * Required Information Type Actions * Required Baseline Actions * Required Overlay Actions * Request Control Tailoring * Generate OSCAL AP * Generate OSCAL AR | | Brazil | [Document reuse and version control across records](https://www.servicenow.com/docs/access?context=c_cam_document_management_system&family=brazil&ft:locale=en-US) : Link documents as shared resources across authorization packages, boundaries, and engagements. Set approval workflows to control who reviews and activates documents before they take effect. [Analyze documents with AI](https://www.servicenow.com/docs/access?context=t_use_smart_docs_with_documents&family=brazil&ft:locale=en-US) : Summarize documents, generate frequently asked questions with answers, or ask specific questions about document content, all from the Documents side panel in an authorization package, boundary, or engagement. [Voice-based document analysis](https://www.servicenow.com/docs/access?context=t_use_smart_docs_with_documents&family=brazil&ft:locale=en-US) : Generate spoken audio summaries of documents and conduct voice-based Q\&A using the Voice Assist panel, from the Documents side panel in an authorization package, boundary, or engagement. [Connect documents to external cloud storage](https://www.servicenow.com/docs/access?context=t_connect_documents_to_external_cloud&family=brazil&ft:locale=en-US) : Link documents from Google Drive, OneDrive, or SharePoint and keep them synchronized with authorization packages, boundaries, and engagements. Pull updates from cloud storage or push approved versions back, without manual downloads and uploads. [AI-generated authorization package summary](https://www.servicenow.com/docs/access?context=t_generate_authorization_package_summary&family=brazil&ft:locale=en-US) : Using generative AI, the Authorization package summarization skill generates a summary of authorization package records. Each summary consolidates system purpose, impact level, operational status, and open POA\&M counts to show the package's current state. [POAM user role](https://www.servicenow.com/docs/access?context=cam-roles-list&family=brazil&ft:locale=en-US) : Users with the POAM User role can view and update their assigned Plan of Action and Milestones (POA\&Ms), including viewing and updating tasks, accepting or rejecting acceptance tasks, and completing milestone tasks. | [ ] ## Changes Between your current release family and Brazil, some changes were made to existing Continuous Authorization and Monitoring features. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__22} | Release | Release notes | |-|-| | Yokohama | [Generate the OSCAL SSP model of an authorization package](https://www.servicenow.com/docs/access?context=generate-oscal-models&family=yokohama&ft:locale=en-US) : Export the SSP model of an authorization package in the OSCAL format. The exported report contains only the control objectives linked to the authorization package and their additional information, such as inherited controls and the hierarchy of the control objectives. [Generate ATO artifacts in Microsoft Word and HTML templates](https://www.servicenow.com/docs/access?context=generate-ato-artifacts-cam-ws&family=yokohama&ft:locale=en-US) : Use the Document designer plugin (com.sn_grc_doc_design) to create report templates in Microsoft Word. A new property module has been introduced to select the template type as a Microsoft Word template in addition to an HTML template. | | Zurich | Coral theme : Coral is now the default theme for new portal, web, and mobile experiences with Next Experience or Core UI enabled. This theme provides a fresh look and feel, featuring brand-neutral illustrations to enhance your user experience. A dark theme option is available for web and mobile experiences. [New Authorization Documents tab for ATO reports](https://www.servicenow.com/docs/access?context=prepare-auth-pkg&family=zurich&ft:locale=en-US) : Access all Authority to Operate (ATO) artifacts reports from the new Authorization Documents tab available in the Authorization Package. [New CAM System Properties page for administrators](https://www.servicenow.com/docs/access?context=cam-components-installed&family=zurich&ft:locale=en-US) : Access the new CAM System Properties page to enable administrators to configure various system properties. [Track package progress with the Ageing of Packages widget](https://www.servicenow.com/docs/access?context=cam-ws-home-page&family=zurich&ft:locale=en-US) : View the duration that a package stayed in each step, like Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor, using the Ageing of Packages widget. [Set Next Engagement Date for Automated Audit Generation](https://www.servicenow.com/docs/access?context=prepare-auth-pkg&family=zurich&ft:locale=en-US) : Enter the Next engagement date to automatically generate the audit engagement on the specified date. | | Australia | [Properties page enhancements](https://www.servicenow.com/docs/access?context=cam-system-properties&family=australia&ft:locale=en-US) : The Properties page includes new configuration options: * Use Homepage Title to customize the workspace homepage name. * The Days Before Next Authorization property is now available on the UI page. | | Brazil | [OSCAL enhancements](https://www.servicenow.com/docs/access?context=oscal-cam-ws&family=brazil&ft:locale=en-US) : The OSCAL enhancements include: * Import system-generated authority documents (SSP, POA\&M, SAR, SAP, ATO Letter, Executive Summary reports) and user-attached files at Authorization Package and Authorization Boundary levels during OSCAL import. * Control objective IDs include source values during OSCAL import and export. * Policy fields are included during OSCAL import and export. | [ ] ## Removed Between your current release family and Brazil, some Continuous Authorization and Monitoring features or functionality were removed. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__32} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Deprecations Between your current release family and Brazil, some Continuous Authorization and Monitoring features or functionality were deprecated. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__42} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Activation information Review information on how to activate Continuous Authorization and Monitoring. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__52} | Release | Release notes | |-|-| | Yokohama | Activation information : Install CAM by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Continuous Authorization and Monitoring is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Zurich | Activation information : Install CAM by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=zurich&ft:locale=en-US). Important: CAM is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Australia | Activation information : Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=australia&ft:locale=en-US). Important: Continuous Authorization and Monitoring is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | | Brazil | Activation information : Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=brazil&ft:locale=en-US). Continuous Authorization and Monitoring is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__62} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__72} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Continuous Authorization and Monitoring, such as specific requirements or compliance levels. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__82} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__92} | Release | Release notes | |-|-| | Yokohama | No updates for this release. | | Zurich | No updates for this release. | | Australia | No updates for this release. | | Brazil | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__102} | Release | Release notes | |-|-| | Yokohama | * Import catalog and System Security Plan (SSP) models with the new CAM Open Security Controls Assessment Language (OSCAL) import landing page. * Export and import SSP models and catalog models in the OSCAL format. * Export control objectives as a catalog in the OSCAL format. * Generate additional reports in Microsoft Word format, such as a Security Assessment Plan (SAP), Authorization to Operate (ATO) Letter, and Executive Summary. * Generate reports based on a Microsoft Word template. See [Continuous Authorization and Monitoring](https://www.servicenow.com/docs/access?context=grc-cam-landing-page&family=yokohama&ft:locale=en-US) for more information. | | Zurich | * Simplify Governance, Risk, and Compliance processes by enabling admins to create, version, and manage custom workflows, define state models, configure approvals, assess risks, and standardize with NIST RMF migration. * The CAM workspace homepage now features card-based containers with headers, sidebars, and overviews for a more organized and modern experience. * Authorization boundaries and package layout are now vertical. New Boundary Type and Classification records are included in OSCAL export file. * Add a Child Boundaries to create one-to-many relationships between boundaries. You can view the parent-child boundary mapping of a authorization boundary in the Highlighted details panel under the Boundary hierarchy section. * Select the Dynamic Filter option to make boundary filters update system elements automatically based on conditions, enhancing filter flexibility. * Boundary operational status now automatically syncs with the package life cycle. * Generate and download Open Security Controls Assessment Language (OSCAL) System Security Plans (SSP) and Plan of Action and Milestones (POA\&M) files directly from within a package. * The OSCAL import playbook now supports importing single POA\&M JSON files, automatically maps users and groups by exact names to ServiceNow, and populates package roles and responsibilities for a streamlined import experience. * CAM overlays new capability has been introduced to perform various operations like addition, subtraction, custom while applying a policy overlay to an authorization package. * Import OSCAL models using a user-friendly playbook that guides you through preview and customization steps. See [Continuous Authorization and Monitoring](https://www.servicenow.com/docs/access?context=grc-cam-landing-page&family=zurich&ft:locale=en-US) for more information. | | Australia | * Import and export OSCAL data for Assessment Plan (AP) and Assessment Results (AR) formats to streamline compliance reporting. * Skip the attestation stage for all controls in a package and move controls directly to the Monitor step to accelerate package progression. * Populate additional control fields when importing and exporting OSCAL data for SSP, AP, and AR formats to capture richer compliance details. * Raise control tailoring requests to make incremental changes to control sets in authorized packages without resetting the entire package life cycle. See [Continuous Authorization and Monitoring](https://www.servicenow.com/docs/access?context=grc-cam-landing-page&family=australia&ft:locale=en-US) for more information. | | Brazil | * Applies a standardized approach to automate the NIST Risk Management Framework, a U.S. Federal mandate for information system security. * Defines clear accountability across System Owners, Authorizing Officials, Security Control Assessors, Information System Security Officers, and other roles * Provides continuous monitoring and centralized management of NIST RMF compliance, including control implementation and assessment, authorization boundaries and impact levels, and Plans of Action \& Milestones (POA\&M) See [Continuous Authorization and Monitoring](https://www.servicenow.com/docs/access?context=grc-cam-landing-page&family=brazil&ft:locale=en-US) for more information. | [ ]