---
sourceDocument: Australia Build or modify applications
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/application-development

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Standard operating procedure for deployment

# Standard operating procedure for deployment {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Every ServiceNow organization should have a documented deployment standard operating procedure. The procedure should specify the approved method for orchestrating deployments, the pipeline stages and approval gates, and
the roles authorized to perform deployments.

## Pre-deployment checklist {#standard-operating-procedure-for-deployment__section_yhj_gbg_k3c}

* Confirm your organization's approved deployment method with your platform owner or release manager. The approved methods include ReleaseOps, App Engine Management Center Pipelines and Deployments, and System Update Sets. For more information, see [Deployment management options](https://servicenow-prod.fluidtopics.net/i42vj1k9qpchwM3~wbgV~w "ServiceNow offers multiple management options for orchestrating deployments. Your choice depends on your organization’s maturity, licensing, and operational preferences. You can choose between ReleaseOps, App Engine Management Center Pipelines and Deployments, or System Update Sets.").
* Run Instance Scan against your application to check for security violations, coding standard issues, and guideline deviations.
* Execute all Automated Test Framework suites and verify they pass.
* Review access control lists (ACLs) to confirm they follow least-privilege principles with no empty or overly permissive rules.
* Verify that credentials, API keys, and environment-specific properties are isolated using private system properties.
* Submit and obtain required change request approvals according to your organization's change management process.
* Deploy to non-production first, validate thoroughly, then promote to production only after all quality gates pass.
{#standard-operating-procedure-for-deployment__ul_exd_5bg_k3c}

## Deployment pipeline security {#standard-operating-procedure-for-deployment__section_xg3_h2g_k3c}

Your deployment standard operating procedure should explicitly address the following security requirements:  

Multifactor authentication (MFA)
:   Use multifactor authentication for all interactive accounts that perform deployments.

IP allow listing
:   Use IP allow listing for service accounts used in automated pipelines.

Credential rotation schedules
:   Use credential rotation schedules for integration accounts.

Audit logging
:   Use audit logging of all deployment actions.

Rollback procedures
:   Use rollback procedures in case a deployment introduces a security regression.