---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Default policies and configurations

# Default policies and configurations in ServiceNow Vault {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
ServiceNow Vault has a set of ready-to-use policies and configurations for selected tools to help you get started quickly.  
Note:  
Default policies and configurations are available only on instances with a ServiceNow Vault subscription.

Defaults help new users get started by providing a baseline of ready-to-use settings. The following tools support default policies and configurations:

* [Anonymization](https://www.servicenow.com/docs/BpykkG3m2NrSFGOP4lpzxg "Anonymization provides a way to easily transform data so that it is unidentifiable and more compliant with data privacy regulations.")
* [Log Export Service](https://www.servicenow.com/docs/ynjbcEEda3QvH_Hh34PfOQ "LES provides scalable, near real-time integration with analytic tools for security threat detection, performance optimization, and user experience monitoring. If you're new to LES, read this overview section to learn what the tool can do")
* [Zero Trust Access](https://www.servicenow.com/docs/fqv5nFOScCwMmQBcpWsbfQ "Continuous authentication in ServiceNow enables you to reverify and authenticate a user if they access resources that are protected by you.")

## How defaults are applied {#vault-default-policies-configs__how-defaults-work}

Default behavior differs by tool:

Anonymization
:   Default real-time protection policies are added to your instance when you have the Data Privacy plugin and the Vault Console store app installed. These defaults are applied in addition to any existing real-time protection policies. Select Activate on the tool card on the [tools page](https://www.servicenow.com/docs/pDnt4CzJx~fBnwk7Deoyew "Learn about the tools and metrics ServiceNow Vault uses to protect and discover sensitive data.") to apply them.

Log Export Service
:   Default configurations are applied only when no existing Log Export Service configurations exist on your instance. If existing configurations are present, the existing setup applies and no defaults are created. Select Activate on the tool card
    to apply defaults, or Go to Log Export Service if configurations already exist.

[Zero Trust Access](https://www.servicenow.com/docs/fqv5nFOScCwMmQBcpWsbfQ "Continuous authentication in ServiceNow enables you to reverify and authenticate a user if they access resources that are protected by you.")
:   Default step-up authentication policies are created automatically when all of the following conditions are met:

    * A ServiceNow Vault subscription is present on the instance.
    * Both Vault Console and the Zero Trust - Continuous Authentication plugin (`com.snc.zero_trust_continuous_authentication`) are installed.
    * No existing Zero Trust Access policies are present. If any policy already exists, the default policies aren't created.

    {#vault-default-policies-configs__ul_att_txd_5jc}

    The default policies protect the following Vault configuration tables: Cryptographic Module \[sys_kmf_crypto_module\], Encrypted Field Configuration \[sys_platform_encryption_configuration\], and Module Access Policy
    \[sys_kmf_crypto_caller_policy\].

    When a user tries to access one of these tables, the policy requires re-authentication via MFA (multi-factor authentication) for local logins, or redirects SSO users to their identity provider. Maint users are excluded from
    policy evaluation.

    To review the default policies, select View default policies on the Zero Trust Access tool card.

    Note:  
    A user with the ca_admin role can deactivate or reactivate a default policy. To do so, navigate to AllContinuous AuthenticationPolicies, select the policy name to open its record, and then select Deactivate or Activate.

## View default policies and configurations {#vault-default-policies-configs__view-defaults}

Select View default policies or View default configurations on the tool card to review defaults. Selecting a policy or configuration name opens its management page.

## Log Export Service version requirement {#vault-default-policies-configs__les-version-requirement}

Default Log Export Service configurations require Log Export Service version 3.5.0 and later. On earlier versions, the Activate option isn't available and the tool card shows Go to Log Export Service instead.
**Related concepts**   

* [Vault tools and metrics](https://www.servicenow.com/docs/pDnt4CzJx~fBnwk7Deoyew "Learn about the tools and metrics ServiceNow Vault uses to protect and discover sensitive data.")
* [ServiceNow Vault console dashboard](https://www.servicenow.com/docs/ecZiMkJl935Ir86Dso7sBw "Use the ServiceNow Vault console dashboard to track and manage your ServiceNow Vault security tools.")

*[\>]: and then