---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Sign Flows and Actions

# Sign the flows, subflows, and actions in the protected instance {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 Minuten Lesedauer

Use update sets to sign and validate the flows, subflows, and actions by enabling the
Code Signing in protected and trusted instances.
* Establish Circle of Trust between the protected and trusted instances.
* Role required: security_admin
{#cs-fdih__ul_wmh_zkq_spb}

## Sign the existing flow, subflows, and actions {#ariaid-title2}

Sign and validate the existing flow, subflows, and actions by enabling the code
signing in production and trusted instances.

### Vorbereitungen

Role required: sn_kmf.cryptographic_manager

### Prozedur

1. In the trusted instance, sign the records in the Step Instance table.
   1. Navigate to System SecuritySecurity JobsAll.
   2. Click New.
   3. On the form, fill these values.  
      {#cs-exist-fdih__table_jpp_cwp_spb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Name to identify the record. |
      | Type | Type of the encryption job. Select Mass Sign Records. |
      | Table | Table from which the records should be signed. Select Step Instance. |
      [ ]

      {#cs-exist-fdih__table_jpp_cwp_spb}
   4. Click Export Code Signing job to production.  
      Two locally signed update sets are created.
      * One update set for the KMF signature.
      * Another update set from the encryption job to export the code signing job.
      {#cs-exist-fdih__ul_pqr_cxp_spb}
   {#cs-exist-fdih__substeps_qp2_jpq_spb}
2. In the trusted instance, export the local update set to an XML file.
   1. Navigate to System Update SetsLocal Update Sets.
   2. Open the update set you had created for mass signing the records.
   3. Click the Export to XML related link and save the XML file.
   {#cs-exist-fdih__substeps_ecc_ycv_5pb}
3. In the protected instance, import the XML file.
   1. Navigate to System Update SetsRetrieved Update Sets.
   2. Click the Import Update Set from XML related link to import the update set that is exported from the trusted instance.  
      For more information, see Import and commit the quick-start update set.  
      The update set is committed successfully.
   {#cs-exist-fdih__substeps_ms5_pdv_5pb}
4. In the protected instance, run the encryption job you had earlier created in the trusted instance.
   1. Navigate to System SecuritySecurity JobsAll.
   2. Open the encryption job you had earlier created in the trusted instance.
   3. Click Start to start the job.

   {#cs-exist-fdih__substeps_ugj_j2v_5pb}  
   A confirmation message is displayed mentioning that the records are signed.
{#cs-exist-fdih__steps_igl_mcv_5pb}

## Sign new flow, subflows, and actions {#ariaid-title3}

Sign and validate new flow, subflows, and actions by enabling the Code Signing in
protected and trusted instances.

### Vorbereitungen

Role required: sn_kmf.cryptographic_manager

### Prozedur

1. In the trusted instance, start an update set.
2. In the trusted instance, create the required flows, subflows, or actions, and publish them.  
   The flows, subflows, or actions are added to the update set.
3. In the trusted instance, change the state of the update set to Complete and click Update.
4. In the trusted instance, sign the update set by creating an encryption job.
   1. Navigate to System SecuritySecurity JobsAll.
   2. Click New.
   3. On the form, fill these values.  
      {#cs-new-fdih__table_jpp_cwp_spb__entry__2}

      | Field | Description |
      |-|-|
      | Name | Name to identify the record. |
      | Type | Type of the encryption job. Select Sign Update Set. |
      | Table | Update set from which the records should be signed. |
      [ ]

      {#cs-new-fdih__table_jpp_cwp_spb}
   4. Click Submit.
   5. Click Start to sign the update set.  
      * Summary is updated that the records are signed.
      * The update set is updated and includes the signature.
      {#cs-new-fdih__ul_vpg_x4p_5pb}
   {#cs-new-fdih__substeps_lnr_knp_5pb}
5. In the trusted instance, open the signed update set record and export it to an XML.
6. In the protected instance, import the signed update set.
   1. Navigate to System Update SetsRetrieved Update Sets.
   2. Select the Import Update Set from XML related link to import the update set that is exported from the trusted instance.  
      For more information, see Import and commit the quick-start update set.  
      The update set is committed successfully.
   {#cs-new-fdih__substeps_wln_npp_5pb}
{#cs-new-fdih__steps_f2b_zjv_5pb}