---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Domain separation

# Domain separation and Configuration Compliance {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Domain separation and Configuration Compliance

Domain separation in Configuration Compliance allows ServiceNow customers to logically separate data, processes, and administrative tasks into distinct domains.
This ensures that data and operations for different tenants or customers remain isolated and secure within a single ServiceNow instance.
Domain separation controls user access and visibility, supporting multi-tenant environments such as service providers managing multiple customers.
Show full answer Show less  
Starting with Configuration Compliance version 14.9, some terminology has been updated to better reflect remediation tasks and rules.

## Key Features

* **Domain-aware data ingestion:** Test results from third-party scanners like Qualys are ingested into the domain corresponding to the integration user, maintaining strict data isolation.
* **Domain-specific operations:** Rescanning hosts, CMDB CI lookups, risk score calculations, remediation task rules, and deferral workflows all occur within the respective domain.
* **Domain-separated reporting:** Dashboards and reports show data only for the domain to which the user or data belongs, preserving confidentiality.
* **Integration support:** Knowledge from third-party scanners can be ingested into a global domain for cross-client sharing, while operational data remains domain-separated.
* **Business logic and configuration:** Each domain can have custom configurations for remediation rules, risk scoring, workflows, and user permissions, allowing tailored management per tenant.

## Use Cases

* Ingest and deduplicate vulnerability test results from multiple sources and domains.
* Match test results with CMDB configuration items within the correct domain.
* Calculate risk scores and enrich assets per domain.
* Group test results and automatically assign remediation tasks in a domain-aware manner.
* Manage the full remediation lifecycle, including deferral workflows and notifications confined to each domain.
* Measure security posture and compliance status with domain-specific reporting.

## Setup and Configuration

Configuring domain separation for Configuration Compliance requires no additional setup beyond standard domain separation in the ServiceNow instance. All relevant Configuration Compliance tables automatically include a Domain column after domain separation is enabled.

Import integrations can be directed to specific domains to maintain data segregation. Analysts within each domain can independently setup application installations, integrations, remediation rules, workflows, and risk calculators tailored to their domain's requirements.

## Impact for ServiceNow Customers

* Enables multi-tenant management within a single Configuration Compliance instance, reducing operational overhead and improving service quality.
* Ensures strict data isolation and access control, critical for service providers managing multiple clients or tenants.
* Supports customized remediation and compliance workflows per domain, enhancing flexibility and accuracy in compliance management.
* Provides domain-specific reporting and dashboards for clearer visibility and decision-making.  
Domain separation is supported in Configuration Compliance. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.  
Note:  
Starting with v14.9 of Configuration Compliance, the following terms have been renamed:{#domain-separation-config-compliance__entry__2}

| Terminology prior to v14.9 | Terminology v14.9 onwards |
|-|-|
| Test Result Group | Remediation Task |
| Group Rules | Remediation Task Rules |
| Policy | Test group |
[Table 1. Changes in terminology]

## Support level: Standard {#domain-separation-config-compliance__section_ozv_zfg_mmb}

* Includes all aspects of Basic level support.
* Application properties are domain-aware as needed.
* Business logic: The service provider (SP) creates or modifies processes per customer. The use cases reflect proper use of the application by multiple SP customers in a single instance.
* The instance owner must configure the minimum viable product (MVP) business logic and data parameters per tenant as expected for the specific application.
{#domain-separation-config-compliance__ul_tfh_drj_xkb}

Sample use case: An Admin must be able to make comments required when a record closes for
one tenant, but not for another.{#domain-separation-config-compliance__p_ssc_nfg_h1c}

For more information on support levels, see [Application support for domain
separation](https://www.servicenow.com/docs/access?context=domain-separated-apps&version=zurich&pubname=zurich-platform-security&ft:locale=en-US).{#domain-separation-config-compliance__p_tsc_nfg_h1c}

## How domain separation works in Configuration Compliance {#domain-separation-config-compliance__section_ydt_kth_scb}

With domain separation you can standardize (Configuration Compliance) procedures, across the customer base you serve, with lowered operational costs and a higher quality of service.

Separate customer work spaces for workflows, dashboards, reports, and so on, ensures that customer data is separated and never exposed to other clients.  
{#domain-separation-config-compliance__table_em3_l3x_vdb__entry__3}

| Release | Support level | Notes |
|:-|:-|:-|
| Orlando | Standard |   |
| Paris | Standard |   |
| Quebec | Standard |   |
| Rome | Standard |   |
| San Diego | Standard |   |
| Tokyo | Standard |   |
| Utah | Standard |   |
| Vancouver | Standard |   |
[Table 2. Domain separation support in Configuration Compliance by version releases]

{#domain-separation-config-compliance__table_em3_l3x_vdb}

Domain separation for the Configuration Compliance application covers the following product functionality:  
* Ingests the test results from third-party scanners (Qualys) in the correct domain.

  The data ingests in the same domain as that of the integration user, whose credentials are used for integration.
* Re-scans specific hosts from Configuration Compliance in the domain from which it was requested.
* Uses the CMDB CI lookup process to ensure that the CI information from the scanners matches the CIs in CMDB of the integration user's domain.
* Calculates risk scores at the test result level as per the risk score calculator defined in the same domain as that of the integration user.
* Remediation Task rule(s) can be defined, assigned, and stay in, the same domain as the domain of the integration user.
* Remediation tasks created using the doc remediation task rules stay in the same domain as where the remediation task rules are created.
* Deferral workflow goes through the approval process in the same domain for which the deferral is requested.
* Reports and dashboards display the test result states such as age of test results, open test results by CI, test results by impact in the domain to which it belongs.
* Knowledge from third-party scanners (Qualys) can be ingested in the global domain and data can be shared across multiple clients.
{#domain-separation-config-compliance__ul_wpc_cjx_vdb}  
Note:  
In all the above cases the overarching principles of visibility in separated domains separation in the NOW Platform apply.

## Use cases {#domain-separation-config-compliance__section_tw4_4jx_vdb}

The Configuration Compliance application manages the life cycle of a test result end to end. The following use cases are domain-separation aware:  
* Ingest test results from Qualys
  * Ingest data from multiple instances
  * De-duplicate the test results
  * Match up with CMDB CI
  {#domain-separation-config-compliance__ul_o5l_tjx_vdb}
* Enrichment of test results with risk scores
  * Asset enrichment (CMDB)
  * Risk score
  {#domain-separation-config-compliance__ul_f2w_vjx_vdb}
* Group test results and assign the remediation task
  * Automatically group the test results
  * Automatically assign the remediation task
  {#domain-separation-config-compliance__ul_rg5_xjx_vdb}
* Remediate
  * Remediation task assigned as a remediation task
  * Comprehensive remediation life cycle
  * Deferral workflow
  {#domain-separation-config-compliance__ul_y5d_zjx_vdb}
* Measure the security posture of the organization and compliance management program
  * Results trend, by compliance, category, criticality and technology
  * Status and distribution on policies, tests, hosts, test results, and risk score
  {#domain-separation-config-compliance__ul_qqc_bkx_vdb}
{#domain-separation-config-compliance__ul_syk_rjx_vdb}

## Setup {#domain-separation-config-compliance__section_o3v_tkx_vdb}

Setting up domain separation for Configuration Compliance does not require any additional steps. All Configuration Compliance tables acquire the Domain column after the instance is domain separated. You can direct test result integration import data to specific domains. For more information, see [Create domain-separated imports for an integration](https://www.servicenow.com/docs/oQIc3OaUq2eBD184r2URMQ "If you require imported data to be in a specific domain, the user assigned to run the integrations must belong to that domain."). For more information on additional precautions and settings, see [Additional settings for domain separation](https://www.servicenow.com/docs/W8DInBIqzfOV_JNwkp9LAA "For precise execution and results, the following precautions and settings are required for domain separation in Vulnerability Response, Application Vulnerability Response, Container Vulnerability Response, and Configuration Compliance.").

## Domain-separated data {#domain-separation-config-compliance__section_khg_wkx_vdb}

Data can be domain separated, which means:

* Test results ingested from third-party scanners stays in the same domain as the domain of the integration user, and is not accessible from any other domain.
* Test results or hosts in one domain cannot be viewed from other domains.
* The risk scoring algorithm and the test results group rules cannot be viewed by anyone outside the domain.
* Deferral workflows created in one domain are not visible in another domain.
* All email notifications are contained within the domain they belong to.
{#domain-separation-config-compliance__ul_grr_snx_vdb}

## How compliance analysts manage their own application data {#domain-separation-config-compliance__section_ic3_44x_vdb}

* Analysts create their own application installation, multi-source application management, and CI lookup rules.
* Analysts can configure specific integrations exclusively for use within the domain.
* Analysts can create their own deferral and change management workflows.
* Analysts can create their own remediation task rules, risk-scoring logic to accurately prioritize results, auto-assign remediation tasks and assign to the correct assignment group.
* Domain users create a manual remediation task and then close it.
{#domain-separation-config-compliance__ul_avd_p4x_vdb}

## Business logic and processes that can be domain-separated by instance owner {#domain-separation-config-compliance__section_yfw_t4x_vdb}

* Configuration Compliance users and groups
* Configuration Compliance integrations (starting with the Madrid release)
* Complete setup configuration (user and group management, application installation, multi-source application management, CI lookup rules, remediation task rules, risk calculators, etc.)
* Complete remediation life cycle including deferral
{#domain-separation-config-compliance__ul_t3h_v4x_vdb}
**Related topics**   

* [Domain separation for service providers](https://www.servicenow.com/docs/access?context=domain-sep-landing-page&version=zurich&pubname=zurich-platform-security&ft:locale=en-US)