A city must adopt NIST CSF as an external mandate library in ServiceNow IRM. Where should the Policy and Compliance content lifecycle start?
Select an answer to reveal the explanation.
Short Explanation
External mandates aren’t a pile of orphan controls—you start with the authority document, the library card for NIST CSF. Citations hang under that parent so every obligation traces home. Skipping straight to a random control loses the chain auditors expect.
Full Explanation
In ServiceNow Policy and Compliance, external frameworks and regulations are typically introduced as authority documents. When a city must adopt NIST CSF as an external mandate library, the content lifecycle should start with an authority document record that represents the external mandate, then citations beneath it that capture discrete obligations. Starting with a random control test result that has no parent authority content skips the library foundation and leaves tests unanchored. An orphaned issue ticket that references NIST only in the short description is not structured mandate management and will not support citation-to-control lineage. Scoring a risk statement before any mandate records exist may be valid risk work, but it is not the Policy and Compliance mandate onboarding path this question asks for. Exam caveat: authority document first does not mean every control is generated immediately—citations and control objectives still follow before entity-level obligations appear for owners. Operational check: create the NIST CSF authority document with version metadata, add priority citations, map to control objectives, scope to agreed entity types, generate a pilot control set for one municipal system, and record the adoption decision in the city's compliance library change log for auditors.