--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Hardening settings # Hardening settings {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Hardening settings The ServiceNow Security Center (SSC) Hardening Settings provide detailed descriptions and compliance benchmarks for security-related system properties and plugins within the ServiceNow AI Platform. These settings can be managed directly through the Hardening Settings app in the Security Center. The Security Center calculates a daily compliance score that reflects how well your instance's security configurations align with recommended values, helping you monitor and improve your security posture effectively. Show full answer Show less ## Key Features * **Hardening Settings Configuration:** Each setting includes attributes such as an overview, configuration name and type, data type, recommended and default values, category, and detailed security risk information based on the Common Vulnerability Scoring System (CVSS). * **Security Risk Assessment:** Settings are scored on a scale from 0.0 to 10.0 and classified from None to Critical, enabling prioritization of security improvements based on potential exploitation risk. * **Dependencies and Functional Impact:** The configuration details highlight prerequisites and the operational impact of each setting, allowing informed decision-making regarding changes. * **Centralized Management:** You can adjust security configurations directly within the Security Center to improve compliance scores and strengthen your instance security. * **Customer Support Involvement:** Some configurations require assistance from ServiceNow Customer Service and Support, which is clearly indicated. ## Security Categories Covered The Hardening Settings span a comprehensive range of security areas, including but not limited to: * **Access Control:** Protects resources by enforcing permission models and role security. * **API and Web Services:** Ensures authentication, authorization, session management, and input validation for APIs. * **Architecture, Design, and Threat Modeling:** Addresses secure application design, availability, confidentiality, and privacy. * **Authentication:** Focuses on verifying identities securely and preventing impersonation or password interception. * **Business Logic:** Secures the application's unique logic flow to prevent attacks and unauthorized bypasses. * **Communications:** Enforces encryption standards, TLS usage, strong cipher suites, and certificate trust. * **Configuration:** Maintains secure build environments and hardened third-party components. * **Data Protection:** Ensures confidentiality, integrity, and availability of data. * **Error Handling and Logging:** Controls the quality and security of logged information. * **File and Resources:** Manages untrusted file data securely with proper permissions. * **Malicious Code:** Verifies code integrity to avoid vulnerabilities and unwanted functions. * **Session Management:** Secures user sessions including cookie attributes and token management. * **Stored Cryptography:** Applies strong encryption methods and secure key management for stored data. * **Validation, Sanitization, and Encoding:** Protects against common input-based attacks such as XSS and SQL injection. ## Practical Benefits for ServiceNow Customers By leveraging the Hardening Settings in the Security Center, ServiceNow customers can: * Continuously monitor and improve security compliance of their instances through actionable compliance scores. * Understand security risks and prioritize remediation based on CVSS severity ratings. * Configure critical security properties and plugins centrally, streamlining security management. * Access detailed documentation and guidance for each setting, supporting informed and effective security configurations. * Ensure alignment with industry security best practices across multiple critical security domains. These capabilities equip customers to proactively protect their ServiceNow environments, reducing vulnerability exposure and supporting regulatory compliance. The ServiceNow Security Center (SSC) hardening settings content contains detailed descriptions and compliance values for the security-related system properties and plugins in the ServiceNow AI Platform. You can set these properties using the hardening settings app in the Security Center. ## Overview and purpose {#security-hardening-settings__section_e2w_hbx_nkb} The Security Center calculates a daily compliance score, expressed as a percentage that is based on how compliant your current instance security settings are with the compliance values in Security Center hardening settings. You can manage the specific security configuration settings that may affect the score for your instance directly from the Security Center. The hardening settings configurations are explained with several attributes described in the table. {#security-hardening-settings__table_mtb_wsf_swb__entry__2} | Configuration attribute | Description | |-|-| | Overview | Provides a high level overview of the recommendation. | | Configuration name | The property or plugin name. | | Configuration type | Describes where the property can be configured outside of the Security Center, such as in system properties (sys_properties_list.do). | | Data type | Describes the type of value required for the configuration. Examples are true/false boolean, installation, plugin, string, etc. | | Recommended value | The value that is recommended by the Security Center to enhance security compliance in your instance. | | Default value | The value that the configuration is set to in the base system. | | Category | The name and link to the category for the hardening setting. | | Security risk | Severity score: The score indicates the potential security risk to your instance as per the likelihood of the vulnerability to be exploited. The security vulnerability is considered and scored individually using the CVSS (Common Vulnerability Scoring System) score on a scale ranging from 0.0 to 10.0. See for additional information. | | Security risk | Severity rating per CVSS score: * Critical: 9.0-10.0 * High: 7.0-8.9 * Medium: 4.0-6.9 * Low: .01-3.9 * None: 0.0 {#security-hardening-settings__ul_osy_nnt_swb} | | Security risk | Security risk details: Describes the importance of the setting configuration and the risk of not utilizing the recommended configuration. | | Dependencies and prerequisites | Related settings or configurations that are required before or in conjunction with the hardening configuration. | | Functional impact | The impact this hardening setting has on the operation of your instance. | | References | Links to configuration documentation or other helpful information. | [Table 1. Hardening settings configuration details] {#security-hardening-settings__table_mtb_wsf_swb} Note: Some of the configurations can only be completed by Customer Service and Support and will be indicated as such. To learn more about ensuring your instances meet hardening requirements, see [Security hardening](https://www.servicenow.com/docs/AjfS6boXzBtp_sc3LHDtfQ "View your hardening compliance score, compare it with previous scores, and change settings to improve your compliance score and security posture in the security hardening page."). ## Other resources {#security-hardening-settings__section_uzn_rbx_nkb} For user reference, the ServiceNow AI Platform maintains extensive configuration capabilities information in the product documentation. You access most of the security content using the links found in [Secure your instance](https://www.servicenow.com/docs/o8UYblChv0A7eT3MIFEMcw "Platform security provides capabilities to secure the instance."). Also, see the following: * [Available system properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US) * General security settings properties * [High Security Settings](https://www.servicenow.com/docs/_g5o20kuRsWDHQZC7ejjuw "High Security Settings refer to several security options available in your instance.") {#security-hardening-settings__ul_m13_pgc_qkb} * **[Hardening settings baseline versions](https://www.servicenow.com/docs/6CQgfBA3xxbDdbce6NJt8A)** Explore how baseline versions for hardening settings align with family and store releases. * **[Access control](https://www.servicenow.com/docs/x7vcJqvJ0dwOasc9M2~48A)** The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering. * **[API and web service](https://www.servicenow.com/docs/8tbkriHSZwhTDBI3AxKzzQ)** The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types. * **[Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA)** This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included. * **[Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q)** The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords. * **[Business Logic](https://www.servicenow.com/docs/40fn4iiBxOFihxegwlFPPQ)** This category looks at the logic and flow unique to each application with general secure principles. Specifically ensure that the intended sequence of business logic flow cannot by bypassed, that limits exist to detect and prevent automated attacks, and that protections against spoofing, tampering, information disclosure and elevation of privilege attacks exist. * **[Communications](https://www.servicenow.com/docs/Ol4HTvWwwFO1g_KjaK_8RQ)** This control ensures proper encryption using strong algorithms and ciphers. This includes ensuring the recommended version of TLS is used for client connectivity, use of strong cipher suites, use of trusted and signed certificates, ensuring connections are encrypted between components and logging of connection failures. * **[Configuration](https://www.servicenow.com/docs/6g9V8~pRg55o7Q9NVpD4uQ)** The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities. * **[Data protection](https://www.servicenow.com/docs/V~KXGFQil6~fjraiRnJvpw)** The data protection category addresses the elements of confidentiality, integrity and availability (CIA) of data. * **[Error handling and logging](https://www.servicenow.com/docs/6IiaQ2VC~8mgbeGyGuLaKw)** The error handling and logging category addresses the quality and verbosity of logged information exposed to stakeholders. * **[File and resources](https://www.servicenow.com/docs/E1vObReCaeSjc8uLdHisig)** The file and resources category ensures applications handle untrusted file data securely and store untrusted data from untrusted sources with limited permissions in an appropriate location. * **[Malicious code](https://www.servicenow.com/docs/K1DqQQ9~Zs_MfYpJc8oc5w)** The Malicious Code category ensures that best efforts are made to confirm that your code is free of vulnerabilities and unwanted functionality. * **[Session management](https://www.servicenow.com/docs/BjjvH7NbZWponRYVuTElEA)** This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication. * **[Stored cryptography](https://www.servicenow.com/docs/aYKqs_rdZ8Wb9JEV63LvRA)** This category focuses on the encryption of stored data. It encompasses several key aspects, such as employing established algorithms and cryptographic modules, ensuring the proper generation of pseudo-random values, implementing encryption based on data classification, and securely storing and isolating key material. * **[Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw)** Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.