--- sourceDocument: yokohama Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/delta-xanadu-yokohama Release : - yokohama ft:locale : - en-US ft:publication_title : - yokohama Combined Product Files ft:clusterId : - delta3yx bundleId : - delta3yx --- # Combined Continuous Authorization and Monitoring release notes for upgrades from Xanadu to Yokohama # Combined Continuous Authorization and Monitoring release notes for upgrades from Xanadu to Yokohama {#ariaid-title1} Release version: Yokohama Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Continuous Authorization and Monitoring Release Notes for Upgrades from Xanadu to Yokohama This consolidated release note provides ServiceNow customers with essential information on upgrading the Continuous Authorization and Monitoring (CAM) product from the Xanadu release family to Yokohama. It captures new features, changes, removals, and activation details to help you prepare for and execute your upgrade smoothly. Show full answer Show less ## Key Features * **CAM Workspace Enhancements (Xanadu):** Offers an end-to-end user experience with intuitive pages for authorization boundaries, packages, unified tasks, and dashboards. It supports adding related control objectives, viewing controls by family, attaching documentation to assessment procedures, and viewing all Plan of Actions and Milestones (POA\&M) in one place. * **OSCAL Format Support:** CAM supports importing and exporting System Security Plan (SSP) and catalog models in the National Institute of Standards and Technology (NIST) recommended OSCAL machine-readable format. Yokohama introduces a dedicated OSCAL Import landing page and an OSCAL Export button for control objectives. * **ATO Artifact Generation:** Generate Authorization to Operate (ATO) artifacts in Microsoft Word format including Security Assessment Plan (SAP), ATO Letter, and Executive Summary, facilitating consistent report formatting and easier sharing and review. * **Role and Permission Enhancements:** Enhanced user roles provide more granular privileges, such as the Information Owner role managing information types, Audit Reader for audit visibility, and refined mappings between CAM and audit/compliance roles to ensure secure access and approval workflows. * **Document Designer Plugin (Yokohama):** Enables creation of report templates in Microsoft Word and HTML, allowing you to select template types for ATO artifact generation for better customization. ## Key Changes * Expanded access for roles Reader, Authorization Official, and Executive Reader to the CAM Workspace. * Improved control objective export mapping in OSCAL Catalog models to better represent child and related controls. * Additional fields and UI improvements in CAM Workspace, such as Family and Family ID on control objectives, Notes and Attachments on assessment procedures, and a 360° View button across pages. * Revised user role compositions where Authorization Official and Information System Security Officer roles no longer include audit and compliance roles, restricting their permissions to read and approve authorization packages. ## Removed Functionality * The Authorization Official role no longer includes audit and compliance user roles, limiting its capabilities to reading and approval only. * Information System Security Officer role no longer incorporates the audit user role. * The Reader role no longer contains audit user privileges. ## Activation and Requirements * Continuous Authorization and Monitoring must be installed via a request from the ServiceNow Store. * There are no new additional requirements, browser needs, accessibility considerations, or localization updates for either Xanadu or Yokohama releases. ## Practical Benefits for ServiceNow Customers Upgrading to Yokohama enables you to streamline authorization and monitoring workflows with enhanced CAM Workspace features and role management. The improved OSCAL import/export capabilities facilitate interoperability with other systems and compliance frameworks. Generating ATO artifacts in Microsoft Word and HTML formats supports standardized and customizable reporting, aiding compliance documentation and review processes. These advancements collectively improve efficiency, security, and compliance management in your authorization lifecycle. Consolidated page of all release notes for Continuous Authorization and Monitoring from Xanadu to Yokohama. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Continuous Authorization and Monitoring release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Yokohama. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Continuous Authorization and Monitoring to Yokohama Before you upgrade to Yokohama, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## New features Between your current release family and Yokohama, new features were introduced for Continuous Authorization and Monitoring. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__8} | Release | Release notes | |-|-| | Xanadu | [CAM Workspace](https://www.servicenow.com/docs/access?context=cam-ws-home-page&family=xanadu&ft:locale=en-US) : Use the CAM Workspace for an end-to-end user experience. The Home page, overview pages of authorization boundary and authorization package, unified tasks page, and the dashboards help you capture information and give you a better insight into the data that aids in decision making. CAM Workspace includes exclusive features with which you can: * Add related control objectives. * View controls by family for a control objective and report based on families for NIST 800-53. * Add attachments to assessment procedures and document notes. * View all Plan of Actions and Milestones (POA\&M) in a single pane. [CAM supports the OSCAL format to export control-related information](https://www.servicenow.com/docs/access?context=oscal-support-cam&family=xanadu&ft:locale=en-US) : Export SSP files in the OSCAL format based on various models such as SSP, Profile, Catalog, and Catalog overlay. The generated report is compatible to share the information with other systems. CAM supports the National Institute of Standards and Technology (NIST) recommended OSCAL format to provide control-based information in machine-readable formats. [CAM ATO artifacts](https://www.servicenow.com/docs/access?context=generate-ato-artifacts-cam-ws&family=xanadu&ft:locale=en-US) : Generate ATO artifacts from an authorization package in Microsoft Word format for the following reports: * SSP * Security Assessment Report (SAR) * POA\&M [Enhancements in CAM user roles](https://www.servicenow.com/docs/access?context=assign-cam-roles&family=xanadu&ft:locale=en-US) : The existing user roles in CAM application have been enhanced with the following privileges: * Use the Information Owner (sn_irm_cont_auth.information_owner) role to view and update the information types of an authorization package. * Use the Audit reader (sn_audit.reader) lite role to view audit-related entities, such as engagements. * Create and manage issues as a system user. | | Yokohama | [OSCAL Import landing page](https://www.servicenow.com/docs/access?context=import-oscal&family=yokohama&ft:locale=en-US) : Import files for catalog and SSP models on the new OSCAL Import landing page. Once the import process is initiated, you can check the status under the Import status section. [OSCAL Export button](https://www.servicenow.com/docs/access?context=export-catalog-cam-ws&family=yokohama&ft:locale=en-US) : Export selected control objectives in the OSCAL format with the new OSCAL Export button while in the control objectives list view. [ATO artifacts in Microsoft Word](https://www.servicenow.com/docs/access?context=generate-ato-artifacts-cam-ws&family=yokohama&ft:locale=en-US) : Generate ATO artifacts from an authorization package in the Microsoft Word format. In CAM Workspace, you can use the Generate SSP drop-down list in a selected authorization package to generate the following reports: * Security Assessment Plan (SAP) * Authorization to Operate (ATO) Letter * Executive Summary This enhancement verifies that all ATO artifacts are formatted consistently and can be shared and reviewed. | [ ] ## Changes Between your current release family and Yokohama, some changes were made to existing Continuous Authorization and Monitoring features. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__14} | Release | Release notes | |-|-| | Xanadu | [Role changes for Continuous Authorization and Monitoring Workspace users](https://www.servicenow.com/docs/access?context=cam-roles-list&family=xanadu&ft:locale=en-US) : Reader (sn_irm_cont_auth.reader), Authorization Official (sn_irm_cont_auth.authorization_official), and Executive Reader (sn_irm_cont_auth.executive_read) can now access Continuous Authorization and Monitoring Workspace. [OSCAL Catalog model export](https://www.servicenow.com/docs/access?context=oscal-support-cam&family=xanadu&ft:locale=en-US) : In exporting the control-related information as part of the Catalog model, the child control objectives of a control objective are mapped to the Control field. Furthermore, related control objectives of the control objective are mapped to the Links field. [Enhancements in CAM Workspace](https://www.servicenow.com/docs/access?context=cam-ws-home-page&family=xanadu&ft:locale=en-US) : The following enhancements have been made in CAM Workspace: * New pop-ups with additional capabilities are added to the hybrid controls creation. * POA\&Ms include all authorization package issues. * The Family field and Family ID field are added to the Control objective page. * The Notes field and Attachment field are added to the Assessment procedure page. * The 360° View button is configured in all pages of CAM Workspace. [CAM user role changes](https://www.servicenow.com/docs/access?context=assign-cam-roles&family=xanadu&ft:locale=en-US) : Defining roles and assigning privileges and permissions for approvals is critical to ensure security in the CAM application. The user role changes are: * The Information Owner (sn_irm_cont_auth.information_owner) role can also update information types of an authorization package, and the role also contains the Audit user (sn_audit.user) role in addition to the Reader (sn_irm_cont_auth.reader) role. * The Information System Security Manager (sn_irm_cont_auth.info_system_sec_manager) role can update the authorization package, and the role contains the Compliance user (sn_compliance.user) and Reader (sn_irm_cont_auth.reader) roles. * The Information System Security Officer (sn_irm_cont_auth.info_system_sec_officer) role can update the authorization package. * The Reader (sn_irm_cont_auth.reader) role contains the Audit reader (sn_audit.reader) role. * The System User (sn_irm_cont_auth.system_user) role contains the Audit user (sn_audit.user) role. * The System Owner (sn_irm_cont_auth.system_owner) role also contains the Audit user (sn_audit.user) and Compliance user (sn_compliance.user) roles. | | Yokohama | [Generate the OSCAL SSP model of an authorization package](https://www.servicenow.com/docs/access?context=generate-oscal-models&family=yokohama&ft:locale=en-US) : Export the SSP model of an authorization package in the OSCAL format. The exported report contains only the control objectives linked to the authorization package and their additional information, such as inherited controls and the hierarchy of the control objectives. [Generate ATO artifacts in Microsoft Word and HTML templates](https://www.servicenow.com/docs/access?context=generate-ato-artifacts-cam-ws&family=yokohama&ft:locale=en-US) : Use the Document designer plugin (com.sn_grc_doc_design) to create report templates in Microsoft Word. A new property module has been introduced to select the template type as a Microsoft Word template in addition to an HTML template. | [ ] ## Removed Between your current release family and Yokohama, some Continuous Authorization and Monitoring features or functionality were removed. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__20} | Release | Release notes | |-|-| | Xanadu | * The Authorization Official (AO) (sn_irm_cont_auth.authorization_official) role no longer contains the sn_audit.user and sn_compliance.user roles. The AO role can only read and approve an authorization package. * The Information System Security Officer (sn_irm_cont_auth.info_system_sec_officer) role no longer contains the sn_audit.user role. * The Reader (sn_irm_cont_auth.reader) role no longer contains the sn_audit.user role. | | Yokohama | No updates for this release. | [ ] ## Deprecations Between your current release family and Yokohama, some Continuous Authorization and Monitoring features or functionality were deprecated. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Activation information Review information on how to activate Continuous Authorization and Monitoring. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__32} | Release | Release notes | |-|-| | Xanadu | Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=xanadu&ft:locale=en-US). | | Yokohama | Activation information : Install CAM by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Continuous Authorization and Monitoring is available in the ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__38} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__44} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Continuous Authorization and Monitoring, such as specific requirements or compliance levels. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__56} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Continuous Authorization and Monitoring we have noted them here. {#dfrn3-continuousauthorizationandmonitoring-summary__entry__62} | Release | Release notes | |-|-| | Xanadu | * Use the added features in the CAM Workspace to help streamline your work and have an efficient end-to-end user experience. * Export System Security Plan (SSP) files in the OSCAL format, which includes models like Catalog, Profile, and SSP. * Use the lite roles introduced in CAM for lighter business operations. * Group similar controls into a family-related and club-related to help identify and understand the controls. See [Continuous Authorization and Monitoring](https://www.servicenow.com/docs/access?context=grc-cam-landing-page&family=xanadu&ft:locale=en-US) for more information. | | Yokohama | * Import catalog and System Security Plan (SSP) models with the new CAM Open Security Controls Assessment Language (OSCAL) import landing page. * Export and import SSP models and catalog models in the OSCAL format. * Export control objectives as a catalog in the OSCAL format. * Generate additional reports in Microsoft Word format, such as a Security Assessment Plan (SAP), Authorization to Operate (ATO) Letter, and Executive Summary. * Generate reports based on a Microsoft Word template. See [Continuous Authorization and Monitoring](https://www.servicenow.com/docs/access?context=grc-cam-landing-page&family=yokohama&ft:locale=en-US) for more information. | [ ]