---
sourceDocument: Yokohama Governance, Risk, and Compliance
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/governance-risk-compliance

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Manage information objects

# Manage the Privacy Management library {#ariaid-title1}

* Release version: Yokohama
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Privacy Management library consists of authority documents, citations, control objectives, policies, and \[PI\] Information objects that help to manage the privacy content.

## Authority documents {#privacy-library-setup__section_rtj_nfw_gqb}

Authority documents are the principles, guidelines, regulations, standards, and frameworks that organizations must comply with. Some examples of authority documents are:

* Statutes (Bills or Acts)
* Regulations
* Audit Guidelines
{#privacy-library-setup__ul_p44_cfw_gqb}Organizations can either create the authority documents, citations, and control objectives or they can download and import them from a third-party provider such as the Network Frontiers Unified Compliance Framework (UCF).

## Citations {#privacy-library-setup__section_xgt_4fw_gqb}

Citations are records with the specific requirements cited by an authority document. A citation relates authority documents to its applicable controls. Each citation has control objectives.

## Policies {#privacy-library-setup__section_ywx_sfw_gqb}

Policies include control objectives. Policies can also be associated to authority documents. Policies are published and regularly updated with incremented versions. For more information on policies, refer to [Policy and Compliance Management](https://servicenow-prod.fluidtopics.net/R76eUDFdwZNZaPnjB33vhg "The ServiceNow Policy and Compliance Management product provides a centralized process for creating and managing policies, standards, and internal control procedures that are cross-mapped to external regulations and benchmarks. Additionally, the application provides structured workflows for the identification, assessment, and continuous monitoring of control activities.").

## Risk statements {#privacy-library-setup__section_pm4_qtk_ctb}

Using risk statements you can create a central risk register to manage potential privacy risks that may occur any time and any where in an organization.

## Privacy assessments {#privacy-library-setup__section_ov3_stk_ctb}

Privacy assessments are used to collect information from business owners. This information helps the privacy teams to understand how personal information (PI) is being used or stored in a processing activity.

## Risk assessments {#privacy-library-setup__section_jr5_stk_ctb}

The risk assessments capability enables you to determine the organizational privacy risk posture using criticality and privacy risk assessments.

## PI Information objects {#privacy-library-setup__section_vm5_cgb_sqb}

\[PI\] Information objects refer to information objects that are of type Personal information. To understand the benefit of using information objects in the Privacy Management solution, refer to [Information objects in Privacy Management](https://servicenow-prod.fluidtopics.net/nadPBi5M6cWJB1XutCh47A "The purpose of an information object is to logically describe the type of data that is exchanged between an application and a database."). Maintaining a library of \[PI\] Information objects and associating them with the processing activities helps the privacy teams to understand what personal information
(PI) is being processed by the processing activity.

Only the information objects that are tagged with the Personal information tag are available to be added to a processing activity. For more information on how to tag information objects see, [Classify information objects as personal information](https://servicenow-prod.fluidtopics.net/6vP1tWN1jWZbiRjFQYr4Vw "Categorize information objects as personal information. Only information objects classified as personal information can be associated with the processing activities.").
* **[Create an information object](https://servicenow-prod.fluidtopics.net/l_3_2bVmBPXEROAGWFh2eQ)**   
  Create information objects manually to associate the right data subject types with business processes or applications.
* **[Configure information object categories](https://servicenow-prod.fluidtopics.net/QsNPX6qZswvBdF3HV_863w)**   
  Configure information object categories to classify information objects effectively. For example, attributes like iris scans and fingerprints are often referred to as biometric data, or email addresses and phone numbers can be grouped as contact information. Information object categories enable you to categorize these information objects under these broader classifications.
* **[Classify information objects as personal information](https://servicenow-prod.fluidtopics.net/6vP1tWN1jWZbiRjFQYr4Vw)**   
  Categorize information objects as personal information. Only information objects classified as personal information can be associated with the processing activities.