NIST RMF supporting concepts

  • Release version: Xanadu
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of NIST RMF supporting concepts

    This content outlines key concepts supporting the NIST Risk Management Framework (RMF) as integrated within ServiceNow's GRC products and Use Case Accelerators. It highlights foundational terms and definitions that help customers understand how to apply NIST RMF principles effectively within ServiceNow. Note that starting with version 10.1.0, the NIST RMF Use Case Accelerator is supported only for existing customers, with new customers encouraged to use the GRC: Continuous Authorization Monitoring application instead.

    Show full answer Show less

    Key Concepts

    • Target: The central element in NIST RMF Use Case Accelerator, representing a unique security profile throughout its RMF lifecycle. It is shared across ServiceNow GRC products and Use Case Accelerators, holding attributes specific to these accelerators.
    • Security Objectives (Confidentiality, Integrity, Availability): Each Target is assessed against these objectives, expressed as High, Moderate, or Low:
      • Confidentiality (C): Protects against unauthorized information access and disclosure.
      • Integrity (I): Guards against improper modification or destruction of information, ensuring authenticity and non-repudiation.
      • Availability (A): Ensures timely and reliable access to information.
    • Baseline Controls: Recommended NIST security controls aligned with the Target’s impact level (High, Moderate, Low) that mitigate security risks and meet compliance requirements.
    • Impact Analysis: Determines the security impact level of a Target based on its CIA ratings. Controls are applied according to whether the Target is Low, Moderate, or High impact.
    • Assurance: Controls aimed at enhancing security strength and confidence that Target functionalities are accurate, complete, and consistent.
    • Common Controls: Controls that can be inherited by multiple Targets, streamlining risk management.
    • Compensating Controls: Alternative controls providing equivalent protection when baseline controls cannot be implemented.
    • Supplemental Controls: Additional controls applied to better address specific risk management requirements of a Target.
    • Tailoring: The process of customizing a security control baseline. This includes scoping guidance, specifying compensating controls if needed, and defining organizational parameters to meet unique requirements.

    Practical Application

    ServiceNow customers using NIST RMF features can leverage these concepts to define and manage security profiles (Targets) aligned with NIST standards. Understanding the CIA triad impact levels helps select appropriate baseline controls and tailor them with compensating or supplemental controls. Assurance and common controls further support compliance and risk mitigation. This framework facilitates structured impact analysis and control customization, enabling continuous and effective risk management consistent with NIST guidance.

    Familiarize yourself with these concepts, developed from the NIST RMF guidance.

    Note:
    Starting with version 10.1.0, the NIST RMF Use Case Accelerator will be supported only for customers who currently use the product. New and existing customers should consider using the GRC: Continuous Authorization Monitoring application. For details, Continuous Authorization and Monitoring.
    Concept Description
    Target

    The target is the foundation of the NIST RMF Use Case Accelerator and all related concepts.

    The target is a shared table between the ServiceNow® GRC products and several Use Case Accelerators. They are similar to the concept of profiles in the core GRC applications. They are optionally linked to profiles, but are used for any attributes that are specific to the Use Case Accelerators.
    Note:
    Each NIST RMF Target uniquely represents a single profile throughout its RMF life-cycle.
    Confidentiality (C) Confidentiality is a security objective of a Target, and is defined as the act of preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. Confidentiality is expressed as High, Moderate, and Low values
    Integrity (I) Integrity is a security objective of a Target is defined as act of guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. Integrity is expressed as High, Moderate, and Low values
    Availability (A) Availability is a security objective of a Target is defined as act of ensuring timely and reliable access to and use of information. Availability is expressed as High, Moderate, and Low values
    Baseline controls Baseline Controls are recommended set of security controls from National Institute of Standards and Technology (NIST) which when implemented and determined to be effective, would mitigate security risk while complying with security requirements. Baseline controls have a designated impact value which is a combination of High, Moderate, or Low values.
    Impact analysis Impact analysis determines the extent to which proposed or actual changes to the Target or its environment of operation can affect or have affected the security state of the Target. A Target in which all three CIA security objectives evaluate to Low is considered Low-impact and uses any of the security controls which are tagged as Low impact value. Likewise, a Target in which any of the three CIA security objectives evaluate to Moderate is considered Moderate-impact and uses any of the security controls which are tagged as Moderate impact value. Likewise, a Target in which any of the three CIA security objectives evaluate to High is considered High-impact and uses any of the security controls which are tagged as High impact value.
    Assurance Assurance controls increase both the strength of security and degree of confidence that the functionality of Targets is correct, complete, and consistent and would mitigate the security risk and assists in complying with security requirements
    Common Common controls are controls that are inheritable by one or more Targets
    Compensating Compensating controls are controls which can be employed in lieu of recommended baseline security controls and provide equivalent or comparable protection for the Targets
    Supplemental Supplemental controls are controls which can be employed as added security controls to adequately meet the risk management needs of a Target
    Tailoring Tailoring is a process by which a security control baseline is modified based on: (i) Targets scoping guidance; (ii) specification of the security controls, for example, compensating, if needed; and (iii) the specification of organization — defined parameters in the security controls via explicit assignment and selection statements