Configuring Operational Technology Vulnerability Response

Configure Operational Technology (OT) assignment rules, remediation targets, risk calculators, and risk rollup calculation then configure integrations to create vulnerable item records.

Note:

If you have the sn_vul.vulnerability_admin role, you can use the Industrial Guided Setup to lead you through the setup of the Operational Technology Vulnerability Response application.

To access the Guided Setup, navigate to Industrial Workspace Admin > Guided Setup.

Task	Purpose
1. Install Operational Technology Vulnerability Response from the ServiceNow Store.	Install the Operational Technology Vulnerability Response application.
2. Assign roles to admin users  or user groups, if needed.	Assigns roles to control the actions that are available for each user.
3. Assign roles for the OT Vulnerability Remediation Owner.	Assigns roles to control the actions that are available for the OT Vulnerability Remediation Owner.
4. Create assignment groups and assign users to sites and groups. Create an Operational Technology Vulnerability Response site assignment group for each site that you have in the Equipment Model Manager. Assign users who already have either the cmdb_ot_isa_viewer or cmdb_ot_isa_editor role to sites. Add users to the assignment group for their site.	Allows OT Remediation Owner users to see only vulnerable Items for their site. Allows users to see the Vulnerability Items for the sites they're assigned to.
5. Configure OT remediation target rules.	Assigns OT vulnerable items to site-level groups, or groups based on classification. Defines the expected timeframe for remediating vulnerable items.
6. Load the demo data records for the Operational Technology Vulnerability Response application.	Calculates the remediation target for OT vulnerable items.
7. Configure OT risk calculators.	Determines which OT risk factors to use when calculating the risk of a vulnerable item on an OT device.
8. Configure OT risk roll up calculator.	Calculates the risk score of the OT devices at each level for the equipment model entity.
9. Install Operational Technology Certified integrations for the Operational Technology Vulnerability Response application that are applicable to your environment.	Integrates certified third-party applications that enhance functionality of OT vulnerability management.

In tasks 5,7, and 8, the guided setup redirects you to the Security Exposure Management Workspace (SEM Workspace). The SEM Workspace is part of ServiceNow’s next-generation platform, Unified Security Exposure Management (USEM). USEM consolidates multiple security exposure applications—Vulnerability Response (VR), Application Vulnerability Response (AVR), Container Vulnerability Response (CVR), and Configuration Compliance (CC)—into a unified architecture. It provides a single source of truth for security exposure, enabling real-time visibility, streamlined workflows, and automated remediation through the SEM Workspace. The SEM Workspace is available for Security Operations Vulnerability Response from version 30.0.0.

As Vulnerability Response is now consolidated under USEM, starting from Operational Technology Vulnerability Response version 2.0.0, users may be redirected to the SEM Workspace to perform some configuration tasks.

• Install Operational Technology Vulnerability Response
  Install the Operational Technology Vulnerability Response application if you have the admin role. This application includes demo data and installs the related store applications and plugins if they are not already installed.
• Assign Operational Technology Vulnerability Response roles
  Assign roles to your users so that you can control their access to the features, capabilities, and data in the Operational Technology Vulnerability Response application.
• Create a site assignment group
  Create one Operational Technology Vulnerability Response assignment group per site that you have in the Equipment Model Manager. This allows OT Remediation Owner users to only see vulnerable items for their site.
• Assign users to sites
  If you have not already done so during configuration of the Industrial Process Manager, assign users who already have either the cmdb_ot_isa_viewer or cmdb_ot_isa_editor role to sites.
• Assign users to assignment groups
  Add users to assignment groups so they can see the vulnerability items for their assigned site.
• Assign vulnerable items to groups
  Configure OT Vulnerability assignment rules.
• Configure OT remediation task rules
  For remediation tasks that are created in the Industrial Workspace, update existing remediation task rules to prevent imported vulnerable items from automatically adding OT devices.
• Configure OT remediation target rules
  Configure remediation target rules for OT vulnerable items.
• Configure risk calculators
  Determine which OT risk factors to use when calculating the risk of a vulnerable item on an OT device.
• Configure OT vulnerability risk rollup calculator
  Use the OT vulnerability risk rollup calculator to calculate the risk score of the OT devices at each level of the equipment model. The overall risk score is rolled up to the parent equipment model entity.
• Install certified Vulnerability Response integrations
  Integrate certified third-party applications that enhance functionality of OT vulnerability management.