Which is not used to source control data for a customer's control framework?

Which is not used to source control data for a customer's control framework?

• A. ServiceNow Product documentation
• B. ServiceNow content packs and accelerators
• C. Customer's existing controls
• D. An external regulatory content provider

Answer: (A)

In ServiceNow IRM, the control framework is built from content that defines actual control statements and how they map to frameworks and regulations. You bring in controls from ServiceNow content packs and accelerators to get a ready-made, framework-aligned catalog; you incorporate the customer’s existing controls to reflect what’s already in place; and you add external regulatory content providers to cover standards such as NIST, ISO, or other requirements. ServiceNow Product documentation, while useful for understanding how to use the platform, does not provide a source of control data or mappings for your control framework. It isn’t used to populate controls, so it’s not a source of control data.

In ServiceNow IRM, the control framework is built from content that defines actual control statements and how they map to frameworks and regulations. You bring in controls from ServiceNow content packs and accelerators to get a ready-made, framework-aligned catalog; you incorporate the customer’s existing controls to reflect what’s already in place; and you add external regulatory content providers to cover standards such as NIST, ISO, or other requirements. ServiceNow Product documentation, while useful for understanding how to use the platform, does not provide a source of control data or mappings for your control framework. It isn’t used to populate controls, so it’s not a source of control data.