--- sourceDocument: Yokohama Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/governance-risk-compliance Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # CAM workflow configuration # CAM workflow configuration {#ariaid-title1} * Release version: Yokohama * * Updated August 11, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CAM workflow configuration The CAM Workflow Configuration in Continuous Authorization and Monitoring (CAM) allows ServiceNow customers to configure custom workflows and frameworks beyond the default National Institute of Standards and Technology (NIST) Risk Management Framework. This flexibility enables alignment of CAM with specific compliance and authorization requirements, supporting multiple workflows rather than the original, tightly coupled seven-step NIST process. Show full answer Show less ## Key Features * **Workflow Configuration:** Define workflows, frameworks, regulations, versions, impacts, and view rules. You can create custom workflows such as Protective Security Policy Framework (PSPF) alongside the default NIST workflow. * **State Model:** Controls workflow lifecycle by defining steps (states), transitions with validation conditions, and attributes that enable special capabilities like approval requirements and report generation. * **State Transitions:** Enforce validations before moving authorization packages through workflow steps. Examples include mandatory field completion, baseline control settings, and approval completion. * **State Model Attributes:** Add functionality without custom code, such as requiring approvals, generating System Security Plans (SSP), Security Assessment Reports (SAR), OSCAL exports, and Plans of Action and Milestones (POAM). * **Workflow Limitations:** Without the CAM Advanced plugin, only two workflows are supported; installing the plugin removes this limit for unlimited custom workflows. * **Enabling Workflow Configuration:** Available only with CAM Workspace installed. Activation requires migration of existing packages and boundaries to associate them with workflows, with a mandatory migration job to assign them to the default NIST workflow. * **OSCAL Export and Import:** Workflow metadata is included in OSCAL exports when enabled. Importing packages requires matching workflows in the target instance to avoid broken packages. * **Assessment Capabilities:** Supports both classic platform assessments and Risk Assessment Methodology (RAM) risk assessments (with Advanced Risk Management installed). Customers must create or modify assessment templates for authorization packages. ## Key Outcomes * Ability to tailor CAM workflows to diverse compliance frameworks beyond NIST, increasing adaptability and relevance to your organizational policies. * Enhanced control over authorization package lifecycle with flexible, validated workflow steps and automated report generation. * Improved management and reporting through workflow-specific views, filtering, and integration with OSCAL standards. * Scalability of workflows when using the CAM Advanced plugin to accommodate complex compliance needs. * Smooth migration path for existing data to leverage new workflow configurations with minimal disruption. * Capability to conduct comprehensive assessments linked to authorization packages, supporting both traditional and risk-based evaluation methods. Configure custom workflows in Continuous Authorization and Monitoring to support compliance requirements beyond the default National Institute of Standards and Technology NIST Risk Management Framework. The CAM Workflow Configuration enables you to configure custom workflows and frameworks instead of restricting operations to the National Institute of Standards and Technology (NIST) framework. This flexibility enables you to adapt CAM to your specific compliance and authorization requirements. Previously, CAM maintained tight coupling with the NIST framework and its seven-step process: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Workflow Configuration decouples CAM from this single framework, enabling you to create and map custom workflows to authorization packages and boundaries. The configuration uses existing authorization package records and adds flexible state models that can map to different workflows. This approach maintains backward compatibility while enabling support for multiple workflows. ## Workflow configuration {#cam-workflow-configurator__section_mt2_nr1_nhc} A workflow configuration defines the workflow, framework, regulation, and its associated versions, impacts, and view rules. CAM ships NIST workflow configuration, but you can create additional workflows for other frameworks such as Protective Security Policy Framework (PSPF) or custom internal frameworks. Each workflow configuration includes: * Versions: Different revisions of the workflow (for example, NIST Rev 4 and Rev 5) * Workflow impacts: Impact levels used to filter control objectives (for example, Low, Moderate, High) * View rules: Custom views that apply only to specific workflows * State model: Links the workflow to a specific state model {#cam-workflow-configurator__ul_fkd_4r1_nhc} ## State model {#cam-workflow-configurator__section_h2x_4r1_nhc} A state model defines the steps, transitions, and validations for a workflow. The state model is applied to the authorization package table and controls how packages move through the workflow life-cycle. State models include: * Workflow states: Individual steps in the framework (for example, Prepare, Categorize, Select) * State transitions: Valid paths between steps, with required validation conditions. * State model attributes: Special capabilities like approval requirements or report generation. State model attributes are to control the functionality available at specific workflow steps. {#cam-workflow-configurator__ul_jmp_pr1_nhc} ## State transitions {#cam-workflow-configurator__section_jy2_qr1_nhc} State transitions define how packages move from one step to another. Each transition can include validation conditions that must be satisfied before proceeding. Examples of validation conditions: * Authorization boundary field can't be empty * All baseline controls must have "Create controls automatically" enabled * Required approvals must be completed {#cam-workflow-configurator__ul_hbc_rr1_nhc} ## State model attributes {#cam-workflow-configurator__section_nbr_rr1_nhc} Attributes add special capabilities to workflow states without requiring custom code. CAM authorization package has several attributes: * Required approval: Indicates that the step requires approval before proceeding * Generate SSP: Enables System Security Plan report generation * Generate SAR: Enables Security Assessment Report generation * Generate OSCAL SSP: Enables OSCAL format System Security Plan (SSP) export * Generate POAM: Enables Plan of Action and Milestones report generation {#cam-workflow-configurator__ul_rfr_sr1_nhc} ## Workflow limitations {#cam-workflow-configurator__section_g31_4s1_nhc} Without the CAM Advanced plugin (app-grc-cont-auth-monitor-advanced), you can create a maximum of two workflows (including the NIST workflow). Installing the CAM Advanced plugin removes this limitation and enables unlimited workflow configurations. ## Enabling workflow configuration {#cam-workflow-configurator__section_ylh_ps1_nhc} The workflow configurator is available only when CAM Workspace is installed. A system property controls whether custom workflows are enabled. For more information, see [Continuous Authorization and Monitoring system properties](https://www.servicenow.com/docs/0K3_6zAZ0xCGr09990W19w#cam-system-properties "Default properties are set with activation of CAM plug-in."). When you enable the workflow configuration property: * The system displays a confirmation dialog explaining the impacts * Existing packages and boundaries must be migrated to associate them with workflows * The property can't be inactive after activation * The system refreshes to apply the new configuration {#cam-workflow-configurator__ul_sc1_qs1_nhc} Important: After enabling the property, you must run the migration scheduled job to associate existing packages and boundaries with the NIST workflow. Packages and boundaries without workflow associations have limited functionality. ## Migration behavior {#cam-workflow-configurator__migration_behavior} When migrating existing data, CAM automatically assigns all packages and boundaries to the workflow. The migration process: * Identifies all authorization packages and boundaries without workflow assignments * Associates them with the default NIST workflow configuration * Updates the home page to display workflow-specific tabs * Enables workflow-based filtering and reporting ## OSCAL export and import {#cam-workflow-configurator__section_x5d_cs1_nhc} When the workflow configuration property is enabled, OSCAL export includes workflow and framework metadata. ## Export and import scenarios {#cam-workflow-configurator__section_erl_ds1_nhc} Property off (export) → Property on (import) : Imported packages default to NIST workflow because no workflow data exists in the export Property on (export) → Property off (import) : Import succeeds but packages lack workflow functionality Property on (both instances) : * If the workflow exists in the import instance: Package uses that workflow * If the workflow doesn't exist in the import instance: Package experience is broken and must be manually corrected {#cam-workflow-configurator__ul_xnl_2s1_nhc} Note: CAM doesn't support importing packages with missing workflow configurations. You must create matching workflows in the target instance before importing. ## Assessment capabilities {#cam-workflow-configurator__section_rsg_fs1_nhc} The Send Assessment button enables both classic assessments and risk assessments (when Advanced Risk Management is installed). ## Classic assessments {#cam-workflow-configurator__section_pyx_fs1_nhc} Platform assessments that use assessment metric types. You must create or modify assessment templates where the table is set to Authorization Package. ## Risk assessments {#cam-workflow-configurator__section_i31_hs1_nhc} Risk Assessment Methodology (RAM) assessments that evaluate risks associated with packages and boundaries. Risk assessments appear in a separate related list on the package form. Note: CAM doesn't ship assessment templates for authorization packages. You must create or modify existing templates for both assessment types. **Related tasks** * [Workflow configuration](https://www.servicenow.com/docs/TVletN~KMK4sYBo2~yJR5A "Define workflow, framework, regulation, and its associated versions, impacts, and view rules. CAM ships National Institute of Standards and Technology (NIST) workflow configuration by default, but you can create additional workflows for other frameworks such as Protective Security Policy Framework (PSPF) or custom internal frameworks.") * [GRC state model configuration](https://www.servicenow.com/docs/NF4u95L8l_YwfUODLUIquw "Create a Governance, Risk, and Compliance state model to define the steps, transitions, and validations for a custom workflow in CAM. State models control how authorization packages move through workflow life cycles and determine which actions are available at each step.")