Security, data and compliance in ServiceNow for Federal Service Management

How ServiceNow for Federal Service Management protects data and supports your compliance obligations.

Security controls

PIV sign-in

Users sign in through the agency's identity provider with their PIV card, so the agency's credential and multi-factor policies apply.

Role-based access

What each person can see and do follows their role and group; fulfillment groups see only the tasks routed to them.

Cleared US-person support

Federal support tickets are handled only by Moraph staff who are US citizens with active clearances, and Moraph's access to the instance is logged.

Encryption and keys

Data is encrypted using the ServiceNow platform's encryption, and Moraph staff cannot access agency data without explicit, time-bound authorization from the agency.

Complete audit trail

Changes to tickets, configuration and access are logged with the person and time, and the logs are available to the agency's assessors.

US-only hosting

The instance runs in a ServiceNow US government cloud offering selected with the agency, and Moraph's operations for it stay in the United States.

Requirements it supports

• Federal Information Security Modernization Act of 2014 (FISMA)
• NIST SP 800-53 Rev. 5 security and privacy controls
• HSPD-12 and FIPS 201-3 (Personal Identity Verification)
• OMB Memorandum M-19-17 (Identity, Credential, and Access Management)
• 21st Century Integrated Digital Experience Act
• Section 508 of the Rehabilitation Act

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• ServiceNow US government cloud: The instance runs in a ServiceNow US government cloud offering chosen with the agency, with Moraph operating it from the United States.
• Multi-bureau instance: One instance shared by several bureaus or components, each with its own queues, catalog items and reporting.
• Existing ServiceNow instance: Where the agency already licenses ServiceNow, Moraph can take over configuration and operation of that instance after an assessment.

Limitations

• Moraph is not ServiceNow. ServiceNow's own service commitments, release schedule, roadmap and outages apply to the platform.
• Licences are subject to ServiceNow's terms, which Moraph cannot change.
• Moraph does not issue PIV credentials or classified-network tokens. Those actions remain with the agency's credentialing and issuing offices, which record their outcomes in the workflow.
• The instance is for unclassified information only. Classified details must not be entered in tickets; classified-network requests carry only the unclassified information needed to route them.
• Moraph does not grant or hold an authorization to operate for the agency. Moraph maps controls and provides evidence; the agency's authorizing official makes the risk decision.
• Moraph does not staff the agency's tier 1 service desk under this service unless that is contracted separately.
• Configuration changes follow the agreed change process; Moraph does not release changes the agency has not approved.
• Integrations depend on interfaces the agency's other systems provide. Where a system has no interface, the step is recorded manually.