ServiceNow access control & privilege security checks
Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.
On ServiceNow, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the ServiceNow connector needs.
Checks (4)
severity: high Admin Role Sprawl fix difficulty: medium #
Review and revoke admin or security_admin roles from users who do not require administrative privileges
- Navigate to User Administration > Users
- Open the flagged user record
- Scroll to the Roles related list
- Remove the admin or security_admin role if the user does not require it
- Assign a least-privilege role appropriate to the user's job function
- Save the user record and document the change
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: medium Empty Group With Roles fix difficulty: easy #
Remove roles from groups with no members or populate the group with appropriate members
- Navigate to User Administration > Groups
- Open the flagged group record
- Either add appropriate members to the Group Members related list
- Or remove the assigned roles from the Roles related list if the group is no longer needed
- Save the group record
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Overly Permissive ACL fix difficulty: medium #
Add role requirements to ACL rules that currently allow unauthenticated or role-less access
- Navigate to Security > Access Control (ACL)
- Open the flagged ACL record
- In the Requires role related list, add one or more roles that should be required to perform the operation
- Consider using the principle of least privilege when selecting roles
- Save the ACL record
- Test that users without the required role can no longer perform the operation
Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Scheduled Job Runs As Admin fix difficulty: medium #
Configure scheduled jobs to run under a dedicated service account with least-privilege roles instead of the admin account
- Navigate to System Definition > Scheduled Jobs
- Open the flagged scheduled job record
- Create a dedicated service account with only the permissions required by the job
- Change the "Run as" field to point to the new service account
- Save the record and test the job to confirm it completes successfully
Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3