Combined Continuous Authorization and Monitoring release notes for upgrades from Washington DC to Zurich

Consolidated page of all release notes for Continuous Authorization and Monitoring from Washington DC to Zurich.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Continuous Authorization and Monitoring release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Washington DC to Zurich.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Continuous Authorization and Monitoring to Zurich

Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

New features

Between your current release family and Zurich, new features were introduced for Continuous Authorization and Monitoring.

Release	Release notes
Washington DC	Managing controls at a granular level Configure a control requirement at the control objective level based on the NIST 800-53 Risk Management Framework to assess the control at a granular level. You can also take attestations at the requirement level while the control moves to the Attest state in the workflow. You can monitor and track the control effectively and clearly identify specific requirements that are non-compliant, which leads to the control being non-compliant. Set up baseline controls to generate controls and implement requirements Create a control that is implemented as an inherited control in part and as a system-specific control in part, which helps to adopt partial requirements from a common control provider. You can also inherit one or more requirements provided by a common control provider. Ability to have assessment procedures based on NIST 800-53A Determine the control’s effectiveness based on the individual assessment procedure’s effectiveness. You can tailor the assessment procedures in test templates and mark them as Effective, Ineffective, or Not applicable. New related lists in the CAM view of Control objective and Control forms Use the CAM view of the Control objective form that has all the control objective requirements from the NIST 800-53 revision 5. Similarly, the CAM view of the Control form has all the requirements generated for the control in the control requirements related list.
Xanadu	CAM Workspace Use the CAM Workspace for an end-to-end user experience. The Home page, overview pages of authorization boundary and authorization package, unified tasks page, and the dashboards help you capture information and give you a better insight into the data that aids in decision making. CAM Workspace includes exclusive features with which you can: Add related control objectives. View controls by family for a control objective and report based on families for NIST 800-53. Add attachments to assessment procedures and document notes. View all Plan of Actions and Milestones (POA&M) in a single pane. CAM supports the OSCAL format to export control-related information Export SSP files in the OSCAL format based on various models such as SSP, Profile, Catalog, and Catalog overlay. The generated report is compatible to share the information with other systems. CAM supports the National Institute of Standards and Technology (NIST) recommended OSCAL format to provide control-based information in machine-readable formats. CAM ATO artifacts Generate ATO artifacts from an authorization package in Microsoft Word format for the following reports: SSP Security Assessment Report (SAR) POA&M Enhancements in CAM user roles The existing user roles in CAM application have been enhanced with the following privileges: Use the Information Owner (sn_irm_cont_auth.information_owner) role to view and update the information types of an authorization package. Use the Audit reader (sn_audit.reader) lite role to view audit-related entities, such as engagements. Create and manage issues as a system user.
Yokohama	OSCAL Import landing page Import files for catalog and SSP models on the new OSCAL Import landing page. Once the import process is initiated, you can check the status under the Import status section. OSCAL Export button Export selected control objectives in the OSCAL format with the new OSCAL Export button while in the control objectives list view. ATO artifacts in Microsoft Word Generate ATO artifacts from an authorization package in the Microsoft Word format. In CAM Workspace, you can use the Generate SSP drop-down list in a selected authorization package to generate the following reports: Security Assessment Plan (SAP) Authorization to Operate (ATO) Letter Executive Summary This enhancement verifies that all ATO artifacts are formatted consistently and can be shared and reviewed.
Zurich	[Placeholder link text to key cam-workflow-configurator] Streamline governance, risk, and compliance processes with the CAM Workflow Configuration. This feature allows administrators to: Create and manage multiple workflows within a package. Define GRC State Models for custom workflows. Configure and version workflows. Evaluate workflow version impacts to retrieve baseline controls. Set up workflow-specific approval configurations. Perform risk assessments across CAM objects. Migrate the NIST RMF flow to workflow configuration for improved standardization. [Placeholder link text to key add-child-boundary] Introducing a new Child Boundaries list that enables a one-to-many boundary hierarchy, allowing you to create relationships between boundaries. This hierarchy is visualized in both the sidebar and diagram view, showing one parent boundary with multiple child boundaries. OSCAL export and import now include the parent boundary relationship if present. Dynamic Boundary Filters Dynamic boundary filters Select the Dynamic Filter option in boundary filters to update system elements according to filter conditions. When disabled, the system elements remain unchanged. This update enhances the flexibility of boundary filter management. Boundary operational status automation Linking boundary operational status to the package life cycle ensures seamless integration. Key changes include: Automatic update of boundary status to Operational when a package moves to the Monitor state. Transition of Boundary status to Reauthorize as the Package Authorization date approaches. This update maintains synchronization between package and boundary states, enhancing overall system coherence. [Placeholder link text to key export-oscal-files-from-authorization-package] Generating and downloading OSCAL SSP and POA&M files is supported directly from within a authorization package. The supported file types include: Catalog Overlay Catalog Profile SSP POA&M OSCAL import enhancements Enhancing the OSCAL import experience, the OSCAL import playbook now allows you to: Import individual POA&M JSON files. User Mapping: Automatically map users to existing ServiceNow users based on exact name matches, with the option to manually adjust mappings. Group Mapping: Automatically map groups to existing ServiceNow groups based on exact name matches, with the option to manually adjust mappings. Roles and Responsibilities: Populate relevant package fields with roles and responsibilities. Overlay enhancement Apply policies as an overlay in an authorization package to determine how the control objectives in the policy impact the baseline. This can be done in the following ways: Addition: Create control objectives to address specific requirements not covered in the baseline. Subtraction: Move existing control objectives to Not Applicable. Customization: Create, move existing control objectives to not applicable, or skip control objectives. OSCAL enhancements Use the OSCAL import playbook to follow a user-friendly, step-by-step approach for importing OSCAL models. Using the playbook, you can: Add multiple Catalog overlay files. Preview OSCAL data before importing them to confirm accuracy. You can preview the following: Authorization boundary Authorization package System elements Information types Baseline controls Inherited controls Hybrid controls Not applicable controls Policies Control objectives Control objectives requirements Skipped objects in the preview, such as control objectives, policies, authorization boundaries and packages can be individually overridden.

Changes

Between your current release family and Zurich, some changes were made to existing Continuous Authorization and Monitoring features.

Release	Release notes
Washington DC	Analytics and Reporting Solutions for CAM in Next Experience UI Framework Starting with version 18.1.0 of Continuous Authorization and Monitoring application, the Analytics and Reporting solutions for CAM such as the CAM Overview, AO Overview, and SCA Overview dashboards are available in the Next Experience UI Framework. Generating assessment procedure plans for a test plan The Control test section of the Test template form is updated with additional fields such as Examine, Interview, and Test that draw control test guidelines from NIST. Determine control effectiveness of a control test Additional new fields such as Examine, Interview, and Test are added to the Test plan and Control test forms to test the control effectiveness. Document implementation statement for a control The Control form now has a new field called Implementation statement, which is required before moving the control to the Assess state. Discussion field in the Control objective and Control forms Based on the 800-53 controls, the Discussion content provided by NIST for each control is shipped by the base system at the control objective level, which is also updated in the Control form when the control is created.
Xanadu	Role changes for Continuous Authorization and Monitoring Workspace users Reader (sn_irm_cont_auth.reader), Authorization Official (sn_irm_cont_auth.authorization_official), and Executive Reader (sn_irm_cont_auth.executive_read) can now access Continuous Authorization and Monitoring Workspace. OSCAL Catalog model export In exporting the control-related information as part of the Catalog model, the child control objectives of a control objective are mapped to the Control field. Furthermore, related control objectives of the control objective are mapped to the Links field. Enhancements in CAM Workspace The following enhancements have been made in CAM Workspace: New pop-ups with additional capabilities are added to the hybrid controls creation. POA&Ms include all authorization package issues. The Family field and Family ID field are added to the Control objective page. The Notes field and Attachment field are added to the Assessment procedure page. The 360° View button is configured in all pages of CAM Workspace. CAM user role changes Defining roles and assigning privileges and permissions for approvals is critical to ensure security in the CAM application. The user role changes are: The Information Owner (sn_irm_cont_auth.information_owner) role can also update information types of an authorization package, and the role also contains the Audit user (sn_audit.user) role in addition to the Reader (sn_irm_cont_auth.reader) role. The Information System Security Manager (sn_irm_cont_auth.info_system_sec_manager) role can update the authorization package, and the role contains the Compliance user (sn_compliance.user) and Reader (sn_irm_cont_auth.reader) roles. The Information System Security Officer (sn_irm_cont_auth.info_system_sec_officer) role can update the authorization package. The Reader (sn_irm_cont_auth.reader) role contains the Audit reader (sn_audit.reader) role. The System User (sn_irm_cont_auth.system_user) role contains the Audit user (sn_audit.user) role. The System Owner (sn_irm_cont_auth.system_owner) role also contains the Audit user (sn_audit.user) and Compliance user (sn_compliance.user) roles.
Yokohama	Generate the OSCAL SSP model of an authorization package Export the SSP model of an authorization package in the OSCAL format. The exported report contains only the control objectives linked to the authorization package and their additional information, such as inherited controls and the hierarchy of the control objectives. Generate ATO artifacts in Microsoft Word and HTML templates Use the Document designer plugin (com.sn_grc_doc_design) to create report templates in Microsoft Word. A new property module has been introduced to select the template type as a Microsoft Word template in addition to an HTML template.
Zurich	New Authorization Documents tab for ATO reports Access all Authority to Operate (ATO) artifacts reports from the new Authorization Documents tab available in the Authorization Package. New CAM System Properties page for administrators Access the new CAM System Properties page to enable administrators to configure various system properties. Track package progress with the Ageing of Packages widget View the duration that a package stayed in each step, like Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor, using the Ageing of Packages widget. Set Next Engagement Date for Automated Audit Generation Enter the Next engagement date to automatically generate the audit engagement on the specified date.

Removed

Between your current release family and Zurich, some Continuous Authorization and Monitoring features or functionality were removed.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	The Authorization Official (AO) (sn_irm_cont_auth.authorization_official) role no longer contains the sn_audit.user and sn_compliance.user roles. The AO role can only read and approve an authorization package. The Information System Security Officer (sn_irm_cont_auth.info_system_sec_officer) role no longer contains the sn_audit.user role. The Reader (sn_irm_cont_auth.reader) role no longer contains the sn_audit.user role.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Deprecations

Between your current release family and Zurich, some Continuous Authorization and Monitoring features or functionality were deprecated.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Activation information

Review information on how to activate Continuous Authorization and Monitoring.

Release	Release notes
Washington DC	Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Xanadu	Install Continuous Authorization and Monitoring by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Yokohama	Install CAM by requesting it from the ServiceNow Store. Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Zurich	Install CAM by requesting it from the ServiceNow Store.

Additional requirements

If any additional requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Continuous Authorization and Monitoring we have noted them here.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Accessibility information

Review details on accessibility information for Continuous Authorization and Monitoring, such as specific requirements or compliance levels.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Localization information

If there are specific localization considerations for Continuous Authorization and Monitoring we have noted them here.

Release	Release notes
Washington DC	No updates for this release.
Xanadu	No updates for this release.
Yokohama	No updates for this release.
Zurich	No updates for this release.

Highlight information

If there are specific highlight considerations for Continuous Authorization and Monitoring we have noted them here.

Release	Release notes
Washington DC	Enable management of controls at a granular level that is at the control requirements level, which are shipped by the base system for controls belonging to NIST 800-53 revision 5. Define requirements at a control objective level that enables the breakdown of the control and create control requirements automatically, which can also be attested individually. Create hybrid controls by inheriting control requirements partially and self-implementing the rest of the requirements. Enable testing of the control based on the assessment procedures as defined by NIST 800-53A. See Understanding Continuous Authorization and Monitoring for more information.
Xanadu	Use the added features in the CAM Workspace to help streamline your work and have an efficient end-to-end user experience. Export System Security Plan (SSP) files in the OSCAL format, which includes models like Catalog, Profile, and SSP. Use the lite roles introduced in CAM for lighter business operations. Group similar controls into a family-related and club-related to help identify and understand the controls. See Continuous Authorization and Monitoring for more information.
Yokohama	Import catalog and System Security Plan (SSP) models with the new CAM Open Security Controls Assessment Language (OSCAL) import landing page. Export and import SSP models and catalog models in the OSCAL format. Export control objectives as a catalog in the OSCAL format. Generate additional reports in Microsoft Word format, such as a Security Assessment Plan (SAP), Authorization to Operate (ATO) Letter, and Executive Summary. Generate reports based on a Microsoft Word template. See Continuous Authorization and Monitoring for more information.
Zurich	Simplify Governance, Risk, and Compliance processes by enabling admins to create, version, and manage custom workflows, define state models, configure approvals, assess risks, and standardize with NIST RMF migration. The CAM workspace homepage now features card-based containers with headers, sidebars, and overviews for a more organized and modern experience. Authorization boundaries and package layout are now vertical. New Boundary Type and Classification records are included in OSCAL export file. Add a Child Boundaries to create one-to-many relationships between boundaries. You can view the parent-child boundary mapping of a authorization boundary in the Highlighted details panel under the Boundary hierarchy section. Select the Dynamic Filter option to make boundary filters update system elements automatically based on conditions, enhancing filter flexibility. Boundary operational status now automatically syncs with the package life cycle. Generate and download Open Security Controls Assessment Language (OSCAL) System Security Plans (SSP) and Plan of Action and Milestones (POA&M) files directly from within a package. The OSCAL import playbook now supports importing single POA&M JSON files, automatically maps users and groups by exact names to ServiceNow, and populates package roles and responsibilities for a streamlined import experience. CAM overlays new capability has been introduced to perform various operations like addition, subtraction, custom while applying a policy overlay to an authorization package. Import OSCAL models using a user-friendly playbook that guides you through preview and customization steps. See Continuous Authorization and Monitoring for more information.