WHITE PAPER Securing the Now Platform® An overview of the ServiceNow security program Release: Xanadu WHITE PAPER 2Securing the Now Platform v4.3 | December 2024 Release: Xanadu Document summary ServiceNow® provides a cloud-based platform and solutions that deliver digital experiences to automate, predict, digitize, and optimize business processes and tasks across the enterprise. ServiceNow customers gain the benefits of a common, highly standardized cloud infrastructure, while realizing the security benefits of customer-specific isolation at the application and database layers. The ServiceNow Commercial Cloud is built on a multi-instance logically single-tenant architecture. This provisions a dedicated database for each customer instance, ensuring there is no possibility of accidental co-mingling of data. Having a single product, platform, and support infrastructure means that ServiceNow can employ a large global security team dedicated to securing the Now Platform. This document describes the ServiceNow security program across a number of key physical, administrative, and logical security domains. These include Advanced High Availability architecture, information life cycle, physical security, security operations, disaster recovery/business continuity, privacy, compliance, and software development. All these domains are represented from the context of ServiceNow as both a software vendor and as an operator of a large private cloud infrastructure. ServiceNow is proud to be a founding member of the AI Alliance, joining forces with other pioneering organizations to advance the principles of open, safe, and responsible AI (Artificial Intelligence) globally. Note: All information in this white paper relates to the standard ServiceNow Commercial Cloud. For information related to other globally located ServiceNow in-country cloud offerings and how these offerings may differ, please contact your ServiceNow account representative. WHITE PAPER Table of contents Document summary 2 Introduction 6 Complementary industry documents 6 The ServiceNow CORE Compliance Portal 7 ServiceNow Security Center (SSC) 7 High Security Settings plugin 8 ServiceNow Vault 8 Contractual obligations 9 ServiceNow terminology 9 The Shared Responsibility Model 10 Data privacy 11 What is data privacy? 11 Data roles and responsibilities 11 Customer responsibilities as the data controller 11 ServiceNow responsibilities as the data processor 12 Data privacy operations 12 Information security governance and risk management 12 Security frameworks 12 Security policy, standards, and procedures 12 Security management 13 Risk management 13 ServiceNow organization entitlement reviews 14 Human resources security 14 Compliance 15 Regulatory and industry compliance 15 WHITE PAPER Physical and logical architecture 15 Overview of physical architecture 15 Global colocation facility pairs 16 Data sovereignty 17 Data center physical security and environmental controls 17 Logical access to ServiceNow infrastructure 19 Infrastructure key management 19 Overview of logical architecture 20 Availability 22 Advanced High Availability (AHA) overview 22 Transfer and failover 22 Data backup and recovery 23 Business continuity and disaster recovery 24 Software Development Life Cycle (SDLC) 25 Secure software development 25 Customer application penetration testing 26 Information life cycle and data management 27 Information classification 27 Data retention 27 Media disposal 27 Data return and destruction 27 ServiceNow security operations management 28 Infrastructure vulnerability management 28 Operating system security 28 Infrastructure and application security services 28 Distributed denial of service (DDoS) 28 WHITE PAPER Vulnerability management 28 Now Platform vulnerability management 28 Cloud infrastructure vulnerability management 29 Instance integrations 29 Overview of instance integrations 29 Now Platform MID Server 30 MID Server diagram 30 Web services integration 30 Now Platform malware protection 31 Instance communication hierarchy 31 Accessing data 31 Authentication 31 Authorization 34 Security logging and monitoring 36 Logging and monitoring: Now Platform instances 36 Logging and monitoring: ServiceNow security infrastructure 37 Encryption 38 Encryption in transit 38 Encryption at-rest and in-use 39 CLE/CLEE encryption overview 39 Mobile application security 40 Mobile security 40 Conclusion 41 Resources 41 Appendix A: Legal rights of an individual and how ServiceNow supports these rights 42 WHITE PAPER 6Securing the Now Platform v4.