ServiceNow identity, MFA & sign-in security checks
Who can sign in, how strongly they authenticate, and whether sessions, passwords and sign-in locations meet the baseline every admin account should clear.
On ServiceNow, Black Cat runs 6 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the ServiceNow connector needs.
Checks (6)
severity: high Inactive User With Roles fix difficulty: easy #
Remove all role assignments from inactive user accounts to prevent privilege accumulation
- Navigate to User Administration > Users
- Search for the flagged user by username
- Open the user record and scroll to the Roles related list
- Remove all assigned roles by selecting them and clicking Remove
- Save the user record
- Optionally deactivate the account if it is no longer needed
Satisfies: NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: critical MFA Not Enforced For Admins fix difficulty: medium #
Enable multi-factor authentication for all admin accounts via the Multi-Factor Authentication configuration
- Navigate to Multi-Factor Authentication > MFA Configurations
- Locate the disabled MFA criteria record
- Open the record and check the Active checkbox
- Ensure the criteria targets admin and security_admin roles
- Enable "MFA Globally Enabled" in the MFA properties if individual criteria are not sufficient
- Save the configuration and test MFA enforcement with an admin account
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: info User Locked Out fix difficulty: easy #
Investigate and resolve user lockouts to restore legitimate access or confirm account should remain locked
- Navigate to User Administration > Users
- Search for the locked out user
- Review recent login history to determine cause of lockout
- If the lockout is legitimate, coordinate with the user to reset their password
- Uncheck the "Locked out" field to restore access once the cause is understood
- Save the user record
Satisfies: NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: critical Default Admin Account Active fix difficulty: medium #
Disable or rename the default admin account to prevent use of a well-known credential target
- Navigate to User Administration > Users
- Search for the user with username "admin"
- Create a new named admin account for each administrator who needs elevated access
- Assign admin roles to the new named accounts
- Uncheck the Active field on the default admin account
- Save the record and verify named accounts can perform necessary admin tasks
Satisfies: NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: critical Weak Password Policy fix difficulty: easy #
Strengthen the password policy to require a minimum of 12 characters and enforce complexity requirements
- Navigate to System Security > Password Policy
- Open the active password policy record
- Set the "Minimum length" field to 12 or greater
- Enable complexity requirements (uppercase, lowercase, numbers, special characters)
- Save the policy
- Notify users that their password must meet the new requirements at next change
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Session Timeout Too Long fix difficulty: easy #
Reduce the session timeout to 60 minutes or less to limit the window for session hijacking
- Navigate to System Properties > Security
- Locate the property "glide.sys.session_timeout"
- Change the value to 60 or less (value is in minutes)
- Save the property
- Inform users that sessions will now expire sooner
Satisfies: NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5