Key Features

• Access Control Enhancements: Includes settings such as ensuring archive table ACLs are checked, enforcing scoped ACL access for information request playbooks, requiring write access for service catalog item additions, and restricting knowledge base access.
• Session and Authentication Controls: Features proactive invalidation of inactive sessions, limiting active session lifespans for integrations, UI, and guests, defining exception roles for active session timeouts, and enforcing captcha requirements for guest access.
• Data and Integration Security: Enforces certificate revocation checks including OCSP on network errors, enabling hardened Java Security Manager, requiring credential alias usage, secure insert operations in import set API, and restricting OAuth parameters to POST body.
• Audit and Logging Improvements: Enables MID audit logs and session audit event logging to increase transparency and traceability of system activities.
• Additional Protections: Settings to disable target cloning, enforce device encryption and passcode requirements, restrict HR case updates from personal emails, hide user comments on articles, and enforce secure referrer and content security policies.

Key Outcomes

By adopting the new hardening settings in baseline version 2.0, ServiceNow customers can expect stronger platform security through improved access governance, session control, and data integrity safeguards. These settings help reduce attack surfaces, enforce stricter authentication and authorization policies, and ensure compliance with security best practices. Customers will benefit from enhanced protection of sensitive data, more secure integrations, and better auditability of system activities.