ServiceNow Controlled Access

(SNCA)
Policy
CONFIDENTIAL

Version Number: 3.0

Policy Number: POL0020760
Approval Date: October 14, 2023
Effective Date: October 15, 2023

© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

Table of Contents
1. Purpose & Scope........................................................................................................................................... 1
1.1. Policy Purpose ............................................................................................................................................ 1
1.2. Scope and Application ............................................................................................................................ 1
1.3. Roles and Responsibilities ......................................................................................................................... 1
1.4. Related Documents .................................................................................................................................. 2
1.5. Definitions .................................................................................................................................................... 2
2. Policy ............................................................................................................................................................... 3
2.1. Data access and handling ...................................................................................................................... 3
2.2. Location and transmission of data ......................................................................................................... 3
2.3. Network access .......................................................................................................................................... 4
2.4. Monitoring ................................................................................................................................................... 5
2.5. Permitted actions withing SNCA ............................................................................................................. 5
2.6. Application Guidelines ............................................................................................................................. 5
3. Adherence to Policies and Procedures ................................................................................................... 7
4. Document Control Information .................................................................................................................. 7
5. Revision History ............................................................................................................................................... 7

Policy Number: POL0020760

Effective Date: October 15, 2023

© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

1. Purpose & Scope

1.1. Policy Purpose

The ServiceNow Controlled Access Policy (Policy) describes the goals and use of ServiceNow
Controlled Access (SNCA) and the ServiceNow hopping (HOP) functionality. SNCA is an
extension of the production cloud environment and allows authorized ServiceNow employees
(“users”) to access, triage, and handle customer data, with the prior consent of the customer, in
a controlled environment which maintains controls to restrict data from being exfiltrated.

This Policy is considered a subset of the Acceptable Use Policy (POL0020242), which outlines
behavioral expectations of ServiceNow Staff. All Staff must understand their roles and
responsibilities regarding information security, privacy, and protecting our customers information
assets.

1.2. Scope and Application

This Policy applies to all ServiceNow employees who are authorized to access the ServiceNow
production cloud environment. The policy statements outlined below are intended to reduce
the probability that customer data and assets will be compromised while ServiceNow
employees utilize SNCA and HOP.

Any exceptions to this policy shall be approved by the SSO and Legal departments.

1.3. Roles and Responsibilities

The below roles, departments, and teams are key to the implementation of this policy and
include those parties who are responsible for completing activities described within this
document and/or those who enforce, distribute, those who must adhere to this policy and those
who govern the implementation of this policy. If your name or team is listed, you have a
responsibility to implement.

The Company intends that all ServiceNow Controlled Documents will be retained in the policy
management system and active ServiceNow Controlled Documents will be made available on
the Employee Portal and applicable intranet sites.

Certain ServiceNow Controlled Documents may require that the parties to whom the policy
applies, complete training or acknowledge that they have read, understood, and agree to
comply with the policy.

Any such training, attestations, or communications are determined and managed by the Policy
Owner and Owning Department.

Policy Number: POL0020760

Effective Date: October 15, 2023 1
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

Role Name Responsibility Training Training Frequency

Chief
Information Chris Bedi Policy enforcement Review policy Annual
Officer

Chief
Information Ben de
Policy review Review policy Annual
Security Bont
Officer

Users with
need to
Responsible for
access N/A SNCA V3 Annual
adhering to this policy
customer
data

1.4. Related Documents

Document # Document Name Document Hierarchy

POL0020243 Information Security Policy Parent

POL0020242 Acceptable Use Policy Parent

POL0020328 Data Classification Standard Related

1.5. Definitions

The following terms are found within this document, including acronyms. Terms without a
definition default to the meanings in the Enterprise Business Glossary.

• Policy: A document that records core principles, high-level intent, and sets overall
management direction and organizational goals. The intended purpose is to influence and
guide both present and future decision making in line with the philosophy, objectives, and
strategic plans established by the enterprise’s management teams. (i.e., “why” programs or
processes are in place).
• Standard: A document that supports ServiceNow policies with prescriptive and clear
statements that describe key requirements and objectives (i.e., ‘what’ is required to be
compliant).
• Standard Operating Procedure: Documents that describe the activities that need to be
performed to address the expectations outlined in the policy and/or standard. Provides the
“how to” of such documents and guides their implementation. Procedures are audience-
specific and provide exact instructions that ensures compliance with a given policy (i.e.,
“how” the company implements its policies and standards).

Policy Number: POL0020760

Effective Date: October 15, 2023 2
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

2. Policy

2.1. Data access and handling

2.1.1. Customer Restricted Data (“customer data”) as defined by the Data Classification
Standard (POL0020328) shall be accessed and used for the specific business purposes
authorized by management and our customers in accordance with applicable external laws
and regulations, supporting policies, documentation, and best practices, including the Data
Classification Standard (POL0020328).

2.1.2. Data within a customer’s instance shall only be accessed as part of a user’s authorized
business function. (e.g., ServiceNow Technical support, or implementation engineering).

2.1.3. When customer data is viewed or accessed for support purposes, the information viewed
shall be kept confidential and must not be shared. All data shall be accessed on a least
privileged basis strictly for the intended scope and purpose.

2.1.4. All command-line system and database access shall be facilitated via SSH sessions.

2.1.5. All customer instance access shall be facilitated via SNCA and HOP (i.e., no direct logins
permitted).

2.1.6. HOP access to a customer instance requires an active task, managerial approval, and
customer authorization.

2.1.7. HOP access will be provisioned for maximum time of seven (7) days.

2.2. Location and transmission of data

2.2.1. Customer data is not permitted to be retained outside of the ServiceNow cloud
environment. At no time shall customer data be permitted to reside on corporate
workstations, servers, or portable media.

2.2.2. Transmitting customer data outside of the production environment or SNCA is prohibited
and shall be considered a security incident and violation of the ServiceNow Acceptable Use
Policy (POL0020242).

2.2.3. Customer data must not be moved outside of the designated regional data center pair
(e.g., AMS/LHR, SJC/IAD, etc.) or isolated environment (e.g., Government Community Cloud,

Policy Number: POL0020760

Effective Date: October 15, 2023 3
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

GCC or National Security Cloud (NSC) NSC, or ServiceNow Protected Platform (SPP)) without
explicit recorded consent from the customer.

2.2.4. Customer data that needs to be transmitted to a customer shall be encrypted in transit.
Customer data that needs to be staged outside of a secured datacenter shall be encrypted
at rest.

2.2.5. Non-standard bulk transfers of customer data shall be reviewed and approved by the
ServiceNow SSO.

2.2.6. Users are permitted to export, edit, and import data across instances within SNCA.

2.2.7. Users are permitted to import and export update sets (via XML) within SNCA.

2.2.8. Sharing or transmitting customer data to unauthorized third parties or systems is

prohibited.

2.2.9. Sharing or transmitting customer data through unauthorized transport channels is

prohibited. For example: sharing/transmitting data using unapproved instant messaging
solutions, or unauthorized 3rd party file sharing solutions

2.2.10. Approved data or scripts may be transferred into the SNCA environment where
necessary to support the customer. For approval, these files must either be put into a HI ticket
or in a HI KB article for general use and the requesting employee’s manager must explicitly
approve their use. Once approved by management, these files can be downloaded into
the users SNCA environment.

2.3. Network access

2.3.1. Network access from SNCA is only permitted via an approved VPN solution to the
ServiceNow production cloud environment. Local network access nor host network access
through any type and form of media is strictly prohibited.

2.3.2. Network access to SNCA management services, software updates, internal services shall
be controlled through network policies. Any network resources added shall not create a
potential path for exfiltration of customer data from SNCA.

Policy Number: POL0020760

Effective Date: October 15, 2023 4
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

2.4. Monitoring

2.4.1. Network access from SNCA shall be monitored and filtered. The purpose of this monitoring
and filtering is to determine and enforce compliance with data classification policies.

2.4.2. Users understand that ServiceNow reserves the right, where permitted by law, to monitor
and screen Internet content and traffic patterns. The purpose of this monitoring and
screening is to determine and enforce compliance with all applicable security policies. This
monitoring will respect the privacy rights of users including compliance with national and/or
local laws.

2.5. Permitted actions withing SNCA

2.5.1. Installing analysis tools for heap dump analysis is permitted.

2.5.2. Users are permitted to run bash/Python against customer instances or data with HOP
credentials.

2.5.3. Users can download ZIP packages.

2.5.4. Users can cut/paste within SNCA.

2.5.5. Users can download CSV/JSON (table contents, transaction logs, etc.).

2.6. Application Guidelines

The table below lists types of applications and communications that are allowed, prohibited, or
monitored when accessing customer data using SNCA. These guidelines apply to actions
between SNCA and external systems.

Allowed Prohibited Monitored

Any IT approved application

(text editors, browsers,
Any application that enables No applications
Applications development tools, etc.)
functionality described below monitored
which does not enable
prohibited functionality

VDI Management Email

IM All Internet access
Corporate Casper
(includes Corp IT
Services Flex Communities services)
DMZ Repos – Self Service app File shares

Policy Number: POL0020760

Effective Date: October 15, 2023 5
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

Allowed Prohibited Monitored

(read only)

Customer instances Labs access

Support Services Development

Email access
Cloud Internal sites (HI, Datacenter,
IM Employee instances
Environment Surf, etc.)
File sharing / P2P services (emp*.) access
Repos (read only)
Demo (demo*.)
All internal data transfer access

Search engines
Email
IM
Social Media / Online notes
POST sites (pastebin, etc.)
Code analysis sites (scripts, sql, etc.)
- Create custom list
File sharing / P2P services
Patch updates Online doc services (o365, gdrive,
Internet box, etc.)
AV updates All Internet access
Sites/Services
Public Repos Cloud Storage -
Druva/Mozy/OneDrive/Box/DropBox
etc.
Backup services
External cloud AWS (with
exceptions) - Create custom list
Blacklists (APT, Embargo, etc.) -
Create custom list
DNS blackhole - Create custom list
ftp variants

Keyboard/Mouse File services

Video USB storage No monitoring

Localhost
Network Interfaces (for Clipboard (copy/paste) required
Global Connect) Local Network

Policy Number: POL0020760

Effective Date: October 15, 2023 6
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

3. Adherence to Policies and Procedures

All ServiceNow Employees and Contractors are required to comply with all established
ServiceNow policies, procedures, and standards, as amended from time to time. Failure to do so
will be considered just cause for disciplinary action, up to and including termination.

4. Document Control Information

The following areas and roles are involved in the review and approval of this document.

Role Name Title

Executive
Ben de Bont SVP, Chief Information Security Officer
Sponsor

Document Senior Director, Security Governance, Risk, &

Adam Soh
Owner Compliance

Policy Policy Manager, CONNECT - Legal Ethics and

Corinne Ferrell
Administrator Compliance

Subject Matter
Laila Abdanan Security Policy Manager
Expert

5. Revision History

Version Effective Date Written/Updated by Section(s) Summary

Initial version of
1.0 July 9, 2017 Bill Stout All
document

Applied new branding

1.1 March 26, 2019 Abbie Sommer All
and annual refresh

Clarification on HOP
1.2 May 24, 2019 Michael Moresco 2.1
access

Minor changes to reflect

1.3 September 30, 2020 Michael Moresco All new requirements for
SNCA v2

Documented new
1.4 October 13, 2020 Michael Moresco 2.2.10 process for data and
script transfers

Cleanup of language
throughout document
2.0 July 8, 2021 Michael Moresco All and addition of HOP
requirements in 2.1.6 –
2.1.8

Policy Number: POL0020760

Effective Date: October 15, 2023 7
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.
 ServiceNow Controlled Access (SNCA)
Policy

Version Effective Date Written/Updated by Section(s) Summary

Made admin edits to

reflect new Effective
date, version number,
2.1 September 28, 2021 Corinne Ferrell Cover
and formatted
document spacing and
TOC.

Minor clarifications and

2.2 October 7, 2021 Abbie Sommer All
grammatical edits

Made admin edits to

update formatting,
paragraph spacing all
2.2.1 October 7, 2021 Corinne Ferrell All
throughout, version #.
No changes made to
content.

Moved into a new

template. After
3.0 October 15, 2023 Laila Abdanan All
reviewing content, no
changes are required.

END OF DOCUMENT

Policy Number: POL0020760

Effective Date: October 15, 2023 8
© 2023 ServiceNow, Inc. All rights reserved. CONFIDENTIAL. ServiceNow, the ServiceNow logo, Now, Now Platform, and other ServiceNow marks are trademarks
and/or registered trademarks of ServiceNow, Inc. in the United States and/or other countries. Other company and product names may be trademarks of the
respective companies with which they are associated.