--- sourceDocument: Zurich Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # CAM workflow configuration # CAM workflow configuration {#ariaid-title1} * Release version: Zurich * * Updated August 11, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CAM Workflow Configuration The CAM Workflow Configuration in ServiceNow Continuous Authorization and Monitoring (CAM) allows customers to customize workflows beyond the default National Institute of Standards and Technology (NIST) Risk Management Framework. This flexibility lets you tailor CAM to meet specific compliance and authorization needs by creating and mapping custom workflows and frameworks to authorization packages and boundaries, while maintaining backward compatibility with the existing NIST framework. Show full answer Show less ## Key Features * **Workflow Configuration:** Defines workflows including framework, versions, impacts, and view rules. You can add workflows like Protective Security Policy Framework (PSPF) or internal custom frameworks alongside the default NIST workflow. * **State Model:** Controls workflow lifecycle through defined steps (states), transitions between steps with validations, and special state attributes such as approval requirements and report generation. * **State Transitions:** Manage valid movement paths between workflow steps, enforcing validation conditions like mandatory approvals or control creation before proceeding. * **State Model Attributes:** Enable functionalities at specific workflow steps without custom coding, such as generating System Security Plan (SSP), Security Assessment Report (SAR), OSCAL format exports, and Plan of Action and Milestones (POAM) reports. * **Workflow Limitations:** Without the CAM Advanced plugin, you can create up to two workflows (including NIST). The plugin removes this limit, allowing unlimited workflow configurations. * **Enabling and Migrating Workflows:** Activating the workflow configurator requires CAM Workspace and a system property toggle. Upon enabling, existing authorization packages and boundaries must be migrated to associate with workflows, especially the default NIST workflow, to avoid limited functionality. * **OSCAL Export/Import:** When enabled, exports include workflow metadata. Importing packages requires matching workflows in the target instance to avoid broken package functionality. * **Assessment Integration:** Supports both classic platform assessments and risk assessments (with Advanced Risk Management). Assessment templates must be created or modified for authorization packages, as CAM does not ship default templates. ## Key Outcomes * Ability to adapt CAM workflows to diverse compliance frameworks and organizational requirements beyond NIST. * Control over workflow lifecycle with validation and state management, ensuring compliance steps are properly enforced. * Enhanced reporting capabilities through state model attributes enabling automatic generation of key security and assessment reports. * Expanded assessment options integrating with ServiceNow's risk management capabilities for comprehensive package evaluations. * Seamless migration and integration processes protect existing data and maintain workflow consistency during configuration changes. * Scalable workflow configurations unlocked by the CAM Advanced plugin for organizations with complex or multiple compliance frameworks. Configure custom workflows in Continuous Authorization and Monitoring to support compliance requirements beyond the default National Institute of Standards and Technology NIST Risk Management Framework. The CAM Workflow Configuration enables you to configure custom workflows and frameworks instead of restricting operations to the National Institute of Standards and Technology (NIST) framework. This flexibility enables you to adapt CAM to your specific compliance and authorization requirements. Previously, CAM maintained tight coupling with the NIST framework and its seven-step process: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Workflow Configuration decouples CAM from this single framework, enabling you to create and map custom workflows to authorization packages and boundaries. The configuration uses existing authorization package records and adds flexible state models that can map to different workflows. This approach maintains backward compatibility while enabling support for multiple workflows. ## Workflow configuration {#cam-workflow-configurator__section_mt2_nr1_nhc} A workflow configuration defines the workflow, framework, regulation, and its associated versions, impacts, and view rules. CAM ships NIST workflow configuration, but you can create additional workflows for other frameworks such as Protective Security Policy Framework (PSPF) or custom internal frameworks. Each workflow configuration includes: * Versions: Different revisions of the workflow (for example, NIST Rev 4 and Rev 5) * Workflow impacts: Impact levels used to filter control objectives (for example, Low, Moderate, High) * View rules: Custom views that apply only to specific workflows * State model: Links the workflow to a specific state model {#cam-workflow-configurator__ul_fkd_4r1_nhc} ## State model {#cam-workflow-configurator__section_h2x_4r1_nhc} A state model defines the steps, transitions, and validations for a workflow. The state model is applied to the authorization package table and controls how packages move through the workflow life-cycle. State models include: * Workflow states: Individual steps in the framework (for example, Prepare, Categorize, Select) * State transitions: Valid paths between steps, with required validation conditions. * State model attributes: Special capabilities like approval requirements or report generation. State model attributes are to control the functionality available at specific workflow steps. {#cam-workflow-configurator__ul_jmp_pr1_nhc} ## State transitions {#cam-workflow-configurator__section_jy2_qr1_nhc} State transitions define how packages move from one step to another. Each transition can include validation conditions that must be satisfied before proceeding. Examples of validation conditions: * Authorization boundary field can't be empty * All baseline controls must have "Create controls automatically" enabled * Required approvals must be completed {#cam-workflow-configurator__ul_hbc_rr1_nhc} ## State model attributes {#cam-workflow-configurator__section_nbr_rr1_nhc} Attributes add special capabilities to workflow states without requiring custom code. CAM authorization package has several attributes: * Required approval: Indicates that the step requires approval before proceeding * Generate SSP: Enables System Security Plan report generation * Generate SAR: Enables Security Assessment Report generation * Generate OSCAL SSP: Enables OSCAL format System Security Plan (SSP) export * Generate POAM: Enables Plan of Action and Milestones report generation {#cam-workflow-configurator__ul_rfr_sr1_nhc} ## Workflow limitations {#cam-workflow-configurator__section_g31_4s1_nhc} Without the CAM Advanced plugin (app-grc-cont-auth-monitor-advanced), you can create a maximum of two workflows (including the NIST workflow). Installing the CAM Advanced plugin removes this limitation and enables unlimited workflow configurations. ## Enabling workflow configuration {#cam-workflow-configurator__section_ylh_ps1_nhc} The workflow configurator is available only when CAM Workspace is installed. A system property controls whether custom workflows are enabled. For more information, see [Continuous Authorization and Monitoring system properties](https://www.servicenow.com/docs/lNlwCjVf4Q2ztkVB_4AeZg#cam-system-properties "Default properties are set with activation of CAM plug-in."). When you enable the workflow configuration property: * The system displays a confirmation dialog explaining the impacts * Existing packages and boundaries must be migrated to associate them with workflows * The property can't be inactive after activation * The system refreshes to apply the new configuration {#cam-workflow-configurator__ul_sc1_qs1_nhc} Important: After enabling the property, you must run the migration scheduled job to associate existing packages and boundaries with the NIST workflow. Packages and boundaries without workflow associations have limited functionality. ## Migration behavior {#cam-workflow-configurator__migration_behavior} When migrating existing data, CAM automatically assigns all packages and boundaries to the workflow. The migration process: * Identifies all authorization packages and boundaries without workflow assignments * Associates them with the default NIST workflow configuration * Updates the home page to display workflow-specific tabs * Enables workflow-based filtering and reporting ## OSCAL export and import {#cam-workflow-configurator__section_x5d_cs1_nhc} When the workflow configuration property is enabled, OSCAL export includes workflow and framework metadata. ## Export and import scenarios {#cam-workflow-configurator__section_erl_ds1_nhc} Property off (export) → Property on (import) : Imported packages default to NIST workflow because no workflow data exists in the export Property on (export) → Property off (import) : Import succeeds but packages lack workflow functionality Property on (both instances) : * If the workflow exists in the import instance: Package uses that workflow * If the workflow doesn't exist in the import instance: Package experience is broken and must be manually corrected {#cam-workflow-configurator__ul_xnl_2s1_nhc} Note: CAM doesn't support importing packages with missing workflow configurations. You must create matching workflows in the target instance before importing. ## Assessment capabilities {#cam-workflow-configurator__section_rsg_fs1_nhc} The Send Assessment button enables both classic assessments and risk assessments (when Advanced Risk Management is installed). ## Classic assessments {#cam-workflow-configurator__section_pyx_fs1_nhc} Platform assessments that use assessment metric types. You must create or modify assessment templates where the table is set to Authorization Package. ## Risk assessments {#cam-workflow-configurator__section_i31_hs1_nhc} Risk Assessment Methodology (RAM) assessments that evaluate risks associated with packages and boundaries. Risk assessments appear in a separate related list on the package form. Note: CAM doesn't ship assessment templates for authorization packages. You must create or modify existing templates for both assessment types. **Related tasks** * [Workflow configuration](https://www.servicenow.com/docs/u6Hm~mnnn67jjYFnptSb5A "Define workflow, framework, regulation, and its associated versions, impacts, and view rules. CAM ships National Institute of Standards and Technology (NIST) workflow configuration by default, but you can create additional workflows for other frameworks such as Protective Security Policy Framework (PSPF) or custom internal frameworks.") * [GRC state model configuration](https://www.servicenow.com/docs/pXD~sQzZiKzNERbxLUHtug "Create a Governance, Risk, and Compliance state model to define the steps, transitions, and validations for a custom workflow in CAM. State models control how authorization packages move through workflow life cycles and determine which actions are available at each step.")