A city must adopt NIST CSF as an external mandate library in ServiceNow IRM. Where should the Policy and Compliance content lifecycle start?
Select an answer to reveal the explanation.
Short Explanation
External mandates aren’t a pile of orphan controls—you start with the authority document, the library card for NIST CSF. Citations hang under that parent so every obligation traces home. Skipping straight to a random control loses the chain auditors expect.
Full Explanation
In ServiceNow Policy and Compliance, external frameworks and regulations are typically introduced as authority documents. Citations capture discrete obligations under that authority, and control objectives and controls map from there. Starting with an authority document establishes lifecycle lineage; beginning with disconnected tests or issues skips the mandated content chain.