--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # CAM workflow configuration # CAM workflow configuration {#ariaid-title1} * Release version: Australia * * Updated August 11, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CAM workflow configuration The CAM Workflow Configuration in ServiceNow Continuous Authorization and Monitoring (CAM) allows you to create and manage custom compliance workflows beyond the default National Institute of Standards and Technology (NIST) Risk Management Framework. This flexibility helps you tailor CAM to meet various compliance and authorization requirements by decoupling it from the fixed NIST seven-step process and enabling multiple workflows and frameworks, including custom and other standards like PSPF. Show full answer Show less ## Key Features * **Workflow Configuration:** Defines workflows, frameworks, regulations, versions, impact levels, and view rules. Supports multiple revisions and filtering by impact level. * **State Model:** Controls workflow lifecycle with defined states, transitions, and validation rules. States represent workflow steps, transitions define valid paths with conditions, and attributes add special capabilities (e.g., approvals, report generation) without custom code. * **Workflow Transitions and Validations:** Ensure packages move between steps only when specific criteria are met, such as completed approvals or required data fields. * **Workflow Limitations:** Without the CAM Advanced plugin, you can configure up to two workflows (including NIST). The Advanced plugin removes this limit for unlimited workflows. * **Enabling Workflow Configuration:** Requires CAM Workspace installation and activation of a system property. Activating this property triggers a migration process that associates existing authorization packages and boundaries to workflows, enabling workflow-specific functionality. * **Migration Behavior:** Automatically assigns existing packages and boundaries to the default NIST workflow, updates UI tabs, and enables filtering and reporting based on workflows. * **OSCAL Export and Import Support:** Workflow and framework metadata are included in OSCAL exports when workflow configuration is enabled. Importing requires matching workflows in the target instance to avoid broken packages. * **Assessment Capabilities:** Supports classic assessments (using templates with Authorization Package table) and risk assessments (with Advanced Risk Management). Assessment templates for authorization packages must be created or modified as CAM does not provide them out-of-the-box. ## Key Outcomes * Adapt CAM workflows to align with various compliance frameworks and internal processes. * Maintain backward compatibility with existing NIST-based packages while supporting new workflow configurations. * Ensure consistent and validated transitions throughout the authorization lifecycle. * Leverage enhanced reporting, filtering, and UI experiences tailored to workflow states. * Enable comprehensive assessment capabilities integrated with CAM workflows. * Manage large-scale workflow configurations effectively by removing limits with the CAM Advanced plugin. Configure custom workflows in Continuous Authorization and Monitoring to support compliance requirements beyond the default National Institute of Standards and Technology NIST Risk Management Framework. The CAM Workflow Configuration enables you to configure custom workflows and frameworks instead of restricting operations to the National Institute of Standards and Technology (NIST) framework. This flexibility enables you to adapt CAM to your specific compliance and authorization requirements. Previously, CAM maintained tight coupling with the NIST framework and its seven-step process: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The Workflow Configuration decouples CAM from this single framework, enabling you to create and map custom workflows to authorization packages and boundaries. The configuration uses existing authorization package records and adds flexible state models that can map to different workflows. This approach maintains backward compatibility while enabling support for multiple workflows. ## Workflow configuration {#cam-workflow-configurator__section_mt2_nr1_nhc} A workflow configuration defines the workflow, framework, regulation, and its associated versions, impacts, and view rules. CAM ships NIST workflow configuration, but you can create additional workflows for other frameworks such as Protective Security Policy Framework (PSPF) or custom internal frameworks. Each workflow configuration includes: * Versions: Different revisions of the workflow (for example, NIST Rev 4 and Rev 5) * Workflow impacts: Impact levels used to filter control objectives (for example, Low, Moderate, High) * View rules: Custom views that apply only to specific workflows * State model: Links the workflow to a specific state model {#cam-workflow-configurator__ul_fkd_4r1_nhc} ## State model {#cam-workflow-configurator__section_h2x_4r1_nhc} A state model defines the steps, transitions, and validations for a workflow. The state model is applied to the authorization package table and controls how packages move through the workflow life-cycle. State models include: * Workflow states: Individual steps in the framework (for example, Prepare, Categorize, Select) * State transitions: Valid paths between steps, with required validation conditions. * State model attributes: Special capabilities like approval requirements or report generation. State model attributes are to control the functionality available at specific workflow steps. {#cam-workflow-configurator__ul_jmp_pr1_nhc} ## State transitions {#cam-workflow-configurator__section_jy2_qr1_nhc} State transitions define how packages move from one step to another. Each transition can include validation conditions that must be satisfied before proceeding. Examples of validation conditions: * Authorization boundary field can't be empty * All baseline controls must have "Create controls automatically" enabled * Required approvals must be completed {#cam-workflow-configurator__ul_hbc_rr1_nhc} ## State model attributes {#cam-workflow-configurator__section_nbr_rr1_nhc} Attributes add special capabilities to workflow states without requiring custom code. Attributes control features like approval requirements, report generation, related list actions, and UI page visibility for specific workflow states. For a complete list of available attributes, see [Add existing attributes to a GRC workflow state](https://servicenow-prod.fluidtopics.net/2q0XMRySCYMIk2kyhrp7_w "Add existing Governance, Risk, and Compliance state model attributes to add special capabilities to workflow steps without custom code. Attributes control features like approval requirements, report generation, and Open Security Controls Assessment Language (OSCAL) file exports for specific workflow states."). ## Workflow limitations {#cam-workflow-configurator__section_g31_4s1_nhc} Without the CAM Advanced plugin (app-grc-cont-auth-monitor-advanced), you can create a maximum of two workflows (including the NIST workflow). Installing the CAM Advanced plugin removes this limitation and enables unlimited workflow configurations. ## Enabling workflow configuration {#cam-workflow-configurator__section_ylh_ps1_nhc} The workflow configurator is available only when CAM Workspace is installed. A system property controls whether custom workflows are enabled. For more information, see [Continuous Authorization and Monitoring system properties](https://servicenow-prod.fluidtopics.net/yPlbo7NHXYwZd83HrvteRA#cam-system-properties "Default properties are set with activation of CAM plug-in."). When you enable the workflow configuration property: * The system displays a confirmation dialog explaining the impacts * Existing packages and boundaries must be migrated to associate them with workflows * The property can't be inactive after activation * The system refreshes to apply the new configuration {#cam-workflow-configurator__ul_sc1_qs1_nhc} Important: After enabling the property, you must run the migration scheduled job to associate existing packages and boundaries with the NIST workflow. Packages and boundaries without workflow associations have limited functionality. ## Migration behavior {#cam-workflow-configurator__migration_behavior} When migrating existing data, CAM automatically assigns all packages and boundaries to the workflow. The migration process: * Identifies all authorization packages and boundaries without workflow assignments * Associates them with the default NIST workflow configuration * Updates the home page to display workflow-specific tabs * Enables workflow-based filtering and reporting ## OSCAL export and import {#cam-workflow-configurator__section_x5d_cs1_nhc} When the workflow configuration property is enabled, OSCAL export includes workflow and framework metadata. ## Export and import scenarios {#cam-workflow-configurator__section_erl_ds1_nhc} Property off (export) → Property on (import) : Imported packages default to NIST workflow because no workflow data exists in the export Property on (export) → Property off (import) : Import succeeds but packages lack workflow functionality Property on (both instances) : * If the workflow exists in the import instance: Package uses that workflow * If the workflow doesn't exist in the import instance: Package experience is broken and must be manually corrected {#cam-workflow-configurator__ul_xnl_2s1_nhc} Note: CAM doesn't support importing packages with missing workflow configurations. You must create matching workflows in the target instance before importing. ## Assessment capabilities {#cam-workflow-configurator__section_rsg_fs1_nhc} The Send Assessment button enables both classic assessments and risk assessments (when Advanced Risk Management is installed). ## Classic assessments {#cam-workflow-configurator__section_pyx_fs1_nhc} Platform assessments that use assessment metric types. You must create or modify assessment templates where the table is set to Authorization Package. ## Risk assessments {#cam-workflow-configurator__section_i31_hs1_nhc} Risk Assessment Methodology (RAM) assessments that evaluate risks associated with packages and boundaries. Risk assessments appear in a separate related list on the package form. Note: CAM doesn't ship assessment templates for authorization packages. You must create or modify existing templates for both assessment types.