--- sourceDocument: Zurich Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Control requirement generation and upgrade steps # Control requirement generation and upgrade steps {#ariaid-title1} * Release version: Zurich * * Updated July 31, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Control requirement generation and upgrade steps This document explains how control requirements are generated and managed within authorization packages in ServiceNow's Zurich release. It focuses on the automatic creation of controls and control requirements based on settings in the control objective form and the state transitions of authorization packages. Show full answer Show less ## Control Requirement Generation Logic * Enabling the **Creates controls automatically** and **Create control requirements** options in the control objective form triggers the automatic generation of controls and control requirements. * Control requirements are generated only if control objective requirements exist and the **Create control requirements** flag is set to true. * When an authorization package moves from the **Select** to the **Implement** state, controls and their requirements are generated if the flag is enabled. * If the flag was initially false, control requirements can still be generated later by enabling the flag and saving the control objective, provided associated controls are **Active** and in the **Draft** state. * If controls are in any state other than Draft, control requirements are not generated unless the control is moved back to Draft. * Adding new control objective requirements triggers generation of corresponding control requirements under the same conditions. ## Updating and Deleting Control Objective Requirements * Updating a control objective requirement's description updates the corresponding control requirement description if the control is in Draft; otherwise, the update applies when the control returns to Draft. * Removing control objective requirements does not delete corresponding control requirements; instead, these are marked as **Manual requirement** regardless of control state. * If controls move back to Draft, the manual tag on these requirements can be removed. * New controls created after removal of some objective requirements will only include existing (non-removed) requirements. * When the authorization package moves from Implement to Select, all associated controls and their requirements are retired automatically. ## Upgrade Steps for Zurich Release * New fields **Authorization package** and **Control allocation** are added to the Control form; existing CAM controls have these fields populated. * For all NIST 800-53-revision 5 control objectives, the **Create control requirements** option is set to true by default. * Control requirements are generated for all existing controls in Draft state associated with these NIST 800-53-revision 5 control objectives. The Creates controls automatically and Create control requirements options in the control objective form and the state of the authorization package are important to create control requirements. ## Control requirement generation logic {#cam-upgrade-scene__section_cjx_dwr_szb} If you enable the Creates controls automatically and Create control requirements options in the control objective form, then the item generation flow is triggered automatically to create controls and control requirements, respectively. Depending on the state of the control, the generated control requirements' state changes. If the Create control requirements option is selected when the authorization package moves from the Select to the Implement state, the controls are generated. At the same time, control requirements for the control objective requirements are also generated. Control requirements would be generated only if the control objective requirements are present and if the flag is true. If the control objective requirements are present but the flag is false, then the control requirements would not be generated. If while creating the control objective, the flag was set as false and the requirements weren't generated, you can still generate the control requirements by selecting the flag and saving the control objective record, provided the controls associated with this particular control objective have control objective requirements, and the controls are Active and in the Draft state. If the controls are in any state other than Draft, then control requirements would not be generated. However, if, for example, the control was in the Monitor state and is moved back to Draft state, then control requirements would be generated provided the Create control requirements option is selected. New control objective requirements added : The same is the case when you add control objective requirements to a control objective using New or Edit in the Control objective requirements related list. Update : If you update the description of a control objective requirement, then the description of the corresponding control requirement is updated provided the control is in the Draft state. If the control is in any other state, then the description is updated when the control moves back to Draft state. Delete : If a few of the control objective requirements of a control objective are removed, then correspondingly the control requirements of the control cannot be removed, instead they are marked as a Manual requirement. This condition is true for controls in any state. Later, if the control moves to Draft state, then you can remove the manual tag from these requirements. On the other hand, if a new control is created after some of the control objective requirements are removed, then the new control does not have the requirements that were removed but only the existing number. If the authorization package moves from the Implement to Select state, then all the associated controls of CAM are retired, and correspondingly all the requirements associated with them are also retired. All these actions are handled by item generation. ## Required upgrade steps {#cam-upgrade-scene__section_gpd_13w_d1c} The following actions happen when you upgrade to the Zurich release: 1. The Authorization package field and Control allocation field in the Control form are newly added. The values in these fields are populated for existing CAM controls. 2. For all NIST 800-53-revision 5 control objectives, the Create control requirements option is set to True by default in the Control objective form. 3. The control requirements are created for all the existing controls, from NIST 800-53-revision 5 control objectives, which are in the Draft state. {#cam-upgrade-scene__ol_vsq_f3w_d1c}