The 18 ServiceNow security checks Black Cat runs

Review and revoke admin or security_admin roles from users who do not require administrative privileges

Remove roles from groups with no members or populate the group with appropriate members

Add role requirements to ACL rules that currently allow unauthenticated or role-less access

Reduce the percentage of stale CMDB CI records by running discovery or updating records manually

Remove all role assignments from inactive user accounts to prevent privilege accumulation

Investigate and resolve user lockouts to restore legitimate access or confirm account should remain locked

Disable or rename the default admin account to prevent use of a well-known credential target

Migrate integrations from basic authentication to OAuth or certificate-based authentication

Enable incident auto-assignment to ensure incidents are routed to the appropriate team automatically

Enable change approval requirements to ensure all changes are authorized before implementation

Enable change risk assessment to ensure all changes are evaluated for risk before approval

Enable multi-factor authentication for all admin accounts via the Multi-Factor Authentication configuration

Reduce the OAuth access token lifespan to 3600 seconds (1 hour) or less

Update OAuth application redirect URLs to use HTTPS and avoid wildcard patterns

Strengthen the password policy to require a minimum of 12 characters and enforce complexity requirements

Deactivate plugins with known security risks that are not required for business operations

Configure scheduled jobs to run under a dedicated service account with least-privilege roles instead of the admin account

Reduce the session timeout to 60 minutes or less to limit the window for session hijacking