NIST CSF tables

Release version: Australia

Updated July 20, 2026

2 minutes to read

Summarize

Summarized using AI

Summary of NIST CSF tables

The NIST CSF tables within ServiceNow’s Governance, Risk, and Compliance (GRC) application facilitate tracking and managing cybersecurity activities, controls, risks, and remediation aligned with the NIST Cybersecurity Framework. These tables are essential for performing gap analyses, monitoring compliance, and supporting detailed reporting and drill-down capabilities across cybersecurity programs.

Show full answer Show less

Key Tables and Their Purposes

Target [sngrctarget]: Serves as a core shared component to represent entities specific to GRC use-case content packs. Ensures unique association of targets to entities.
NIST CSF Activity [snirmnistcsfnistcsfactivity]: Tracks cybersecurity activities for targets and supports identifying gaps, non-compliant controls, risks, issues, failed indicators, and action plans.
Gaps [snirmnistcsfm2mpolicystatenistcsfact]: Records unimplemented control objectives as gaps, enabling focused reporting and analysis. Functions as a many-to-many (m2m) association between gaps and targets.
Non-compliant Control [snirmnistcsfm2mcxontrolsnistcsfact]: Tracks controls that are implemented but found non-compliant based on the framework core. Supports reporting by linking these controls to targets through an m2m relationship.
Risk [snirmnistcsfm2mrisksnistcsfactivities]: Associates risks with implemented controls for cybersecurity objectives, enabling risk visibility and reporting through m2m links to targets.
Issue [snirmnistcsfm2missuesnistcsfact]: Captures issues related to controls and their associated risks, aiding in comprehensive issue management and reporting via m2m associations with targets.
Action Plan [snirmnistcsfm2mremediationnistcsfact]: Tracks remediation tasks (action plans) related to issues, supporting organized remediation efforts and reporting, linked to targets through m2m relationships.
Failed Indicators [snirmnistcsfm2mindicatorsnistcsfact]: Records failed indicators for targets, controls, or risks, facilitating performance tracking and detailed reporting through m2m associations.
Related Control Objectives [sncompliancem2mpolicystmtpolicystmt]: Enables association of control objectives at the same hierarchical level, enhancing the relationship mapping beyond parent-child structures for control objectives.

Benefits for ServiceNow Customers

Enables comprehensive tracking of cybersecurity activities and compliance status aligned with the NIST CSF.
Supports detailed gap analysis and identification of non-compliance areas, risks, and issues.
Facilitates efficient remediation management through linked action plans.
Provides structured reporting capabilities with many-to-many relationships for deep insights into controls, risks, issues, and indicators.
Improves governance and risk management by clearly mapping relationships between targets, controls, and control objectives.

A few tables are impacted by the NIST CSF guidance.


Table	Purpose
Target [sn_grc_target]	Target is a core table of design to be shared component among the ServiceNow GRC application and GRC use-case content packs.Target is like entity in its purpose, but is used to track any attributes specific to use-case content packs. No two target records can reference the same entity at any time.
NIST CSF Activity [sn_irm_nist_csf_nist_csf_activity]	NIST CSF Activity table is used to track cybersecurity activity relevant for a target. The activity also helps in performing gap analysis that identifies the gaps, non-complaint controls, risks, issues, failed indicators and action plans for a cybersecurity activity.
Gaps [sn_irm_nist_csf_m2m_policy_state_nist_csf_act]	Gaps table in NIST CSF is used to track control objectives that aren’t yet implemented as gaps. This table comes handy for reporting and drill down purposes. It's an m2m table that associates Gaps to Targets.
Non-compliant Control [sn_irm_nist_csf_m2m_cxontrols_nist_csf_act]	Non-compliant Control table in NIST CSF is used to track controls that are identified as non-compliant. Only cybersecurity control objectives as defined by the framework core which are implemented as controls and non-compliant are tracked. This table comes handy for reporting and drill down purposes. It's an m2m table that associates Non-compliant Controls to Targets.
Risk [sn_irm_nist_csf_m2m_risks_nist_csf_activities]	Risk table in NIST CSF is used to track risks that are associated with controls that have been implemented for cybersecurity control objectives as defined by the framework core. This table comes handy for reporting and drill down purposes. It's an m2m table that associates Risks to Targets.
Issue [sn_irm_nist_csf_m2m_issues_nist_csf_act]	Issue table in NIST CSF is used to track issues that are associated with controls that have been implemented for cybersecurity control objectives as defined by the framework core. Issues of risks associated with these controls are also included in the metric. This table comes handy for reporting and drill down purposes. It's an m2m table that associates Issues to Targets.
Action Plan [sn_irm_nist_csf_m2m_remediation_nist_csf_act]	Action Plan table in NIST CSF is used to track the action plans that are identified for the issues. This table comes handy for reporting and drill down purposes. It's an m2m table that associates Action Plans (remediation tasks) to Targets.
Failed Indicators [sn_irm_nist_csf_m2m_indicators_nist_csf_act]	Failed indicators table in NIST CSF is used to track the failed indicators of the target and the control or risk. This table comes handy for reporting and drill down purposes. It's an m2m table that associates Failed Indicators to Targets.
Related Control Objectives [sn_compliance_m2m_policy_stmt_policy_stmt]	Related Control Objectives table in NIST CSF is used to track the associations between control objectives. In base implementation, parent and child control objectives are supported, but this table introduces a concept to relate the control objectives at the same level.