ServiceNow Trust Portal — Vendor Security Posture and Certification Evidence

ServiceNow publishes its certifications and audit reports through its Trust Portal, and for NIS2, DORA, ISO 27001 and GDPR due diligence that portal is your primary evidence source for the vendor half of the assessment. What it gives you is ServiceNow's posture as a provider — not your instance's configuration, which remains entirely yours under the shared responsibility model. Auditors ask for both, and the portal answers only one of the two questions.

What This Is

ServiceNow operates the Trust Portal at trust.servicenow.com as the centralized source for its security posture, compliance certifications, and operational transparency. For organizations using ServiceNow as a critical ICT platform, this portal is the primary evidence source for third-party vendor due diligence required by NIS2, DORA, ISO 27001, and GDPR.

This article consolidates ServiceNow's vendor security posture — certifications held, security architecture, data protection controls, availability commitments, and vulnerability disclosure practices — into an auditor-ready reference that maps directly to regulatory requirements.

Why This Matters

ServiceNow is classified as a critical ICT third-party service provider under DORA and a key element of supply chain security under NIS2 Art.21§2(d). Regulators expect organizations to:

1. Document the vendor's security posture and certifications
2. Verify that vendor controls align with regulatory requirements
3. Monitor the vendor's security practices on an ongoing basis
4. Maintain evidence that due diligence was performed

Failing to assess ServiceNow as a third-party provider is a direct compliance gap under DORA Art.28 and NIS2 Art.21§2(d).

1. Certifications and Attestations

ServiceNow is reviewed annually by independent third-party auditors. The following certifications and attestations are maintained:

Information Security Management

Quality, Continuity, and AI Governance

Audit Reports and Attestations

Government and Sector-Specific

How to Access Audit Reports

SOC 1, SOC 2 Type II, ISO certificates, C5 attestation reports, and bridge letters are available through the CORE Compliance Portal on support.servicenow.com. Access must be requested through the ServiceNow account team.

2. Security Architecture

Multi-Instance Architecture

ServiceNow operates as a private enterprise cloud with a multi-instance architecture delivering logical single tenancy. Each customer's data is isolated from all other customers — this is not shared multi-tenant with logical separation but dedicated compute with isolated databases.

Encryption

Important: Encryption at rest is not included by default. ServiceNow enforces encryption in transit for all instances, but encryption at rest requires purchasing one of the Platform Encryption options. Without it, customer data is stored unencrypted on ServiceNow-managed infrastructure.

Compliance risk: If your organization has not purchased Platform Encryption or Cloud Encryption, data at rest in your ServiceNow instance is not encrypted. This is a common gap for GDPR Art.32§1(a) ("encryption of personal data"), NIS2 Art.21§2(h) ("policies on cryptography and encryption"), and DORA Art.9§4(c). Verify your licensing includes encryption before claiming compliance.

Access Controls

Data Center Infrastructure

3. Data Protection and Privacy

Data Processing

Privacy Compliance

4. Availability and Business Continuity

Advanced High Availability (AHA)

ServiceNow's architecture provides:

• Paired data center failover — near-instant failover between data center pairs
• Regional redundancy — customer instances backed by geographically distributed infrastructure
• On-site and off-site backups — ensuring data recovery in disaster scenarios
• Disaster recovery procedures — documented and tested as part of ISO 22301 certification

Monitoring and Incident Communication

5. Vulnerability Disclosure and CVE Process

Responsible Disclosure Program

ServiceNow maintains a responsible disclosure program. Security researchers should:

1. Report vulnerabilities to disclosure@servicenow.com
2. Provide sufficient detail to reproduce the issue, including proof of concept
3. Allow reasonable time for remediation before public disclosure

CVE Notification Process

CVE Advisory Resources

For details on specific ServiceNow CVEs and their impact, see KB articles: Jelly Template Injection RCE Chain (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) (CVE-2024-4879), BodySnatcher: Virtual Agent Impersonation (CVE-2025-12420) (CVE-2025-12420 BodySnatcher), Count(er) Strike: Data Inference via ACL Count Leakage (CVE-2025-3648) (CVE-2025-3648), Reflected XSS in ServiceNow AI Platform (CVE-2025-11449, CVE-2025-11450) (Reflected XSS), Remote Code Execution in ServiceNow AI Platform Sandbox (CVE-2026-0542) (CVE-2026-0542 AI Platform Sandbox RCE).

6. Regulatory Evidence Mapping

How to Use This for Compliance Audits

Detection Script — Vendor Evidence Documentation Check

/*
 * COMP-004: ServiceNow Trust Portal Evidence Audit
 * Checks whether vendor due diligence documentation is tracked in the instance
 *
 * Run in: ServiceNow instance → System Definition → Scripts - Background
 * Role required: admin
 * Impact: Read-only, safe for production
 */

gs.info('=== COMP-004: VENDOR SECURITY EVIDENCE AUDIT ===');
gs.info('');

var gaps = [];
var findings = [];

// Check if GRC/Vendor Risk module is active
var grcPlugin = new GlideRecord('v_plugin');
grcPlugin.addQuery('id', 'com.snc.governance_risk_compliance');
grcPlugin.query();
var grcActive = grcPlugin.next() && (grcPlugin.getValue('active') === 'active' || grcPlugin.getValue('active') === '1');

if (grcActive) {
    findings.push('GRC module is active — vendor risk management available');

    // Check for ServiceNow vendor profile
    var vendor = new GlideRecord('core_company');
    vendor.addEncodedQuery('nameLIKEServiceNow^ORnameLIKEservicenow');
    vendor.query();
    if (vendor.next()) {
        findings.push('ServiceNow vendor profile exists: ' + vendor.getValue('name'));

        // Check for associated risk assessments
        var assess = new GlideRecord('sn_risk_assessment');
        if (assess.isValid()) {
            assess.addQuery('entity', vendor.getUniqueValue());
            assess.query();
            if (assess.getRowCount() > 0) {
                findings.push('Risk assessment records found for ServiceNow: ' + assess.getRowCount());
            } else {
                gaps.push('DORA Art.28: No risk assessment records for ServiceNow vendor profile');
            }
        }
    } else {
        gaps.push('DORA Art.28: No ServiceNow vendor profile in core_company — create one for third-party tracking');
    }
} else {
    findings.push('GRC module not active — vendor risk tracked externally');
    gaps.push('Consider: GRC module enables structured vendor risk management for DORA Art.28 compliance');
}

// Check for ServiceNow connection (indicates active vendor relationship tracking)
var snConn = new GlideRecord('sn_connection');
if (snConn.isValid()) {
    snConn.query();
    findings.push('ServiceNow connection records: ' + snConn.getRowCount());
}

// Check knowledge base for vendor security documentation
var kb = new GlideRecord('kb_knowledge');
kb.addEncodedQuery('short_descriptionLIKEServiceNow trust^ORshort_descriptionLIKEvendor security^ORshort_descriptionLIKESOC 2^ORshort_descriptionLIKEISO 27001 ServiceNow');
kb.addQuery('workflow_state', 'published');
kb.query();
if (kb.getRowCount() > 0) {
    findings.push('Vendor security KB articles found: ' + kb.getRowCount());
} else {
    gaps.push('NIS2 §2(d): No published KB articles documenting ServiceNow vendor security posture');
}

// Output
gs.info('FINDINGS:');
for (var f = 0; f < findings.length; f++) {
    gs.info('  [INFO] ' + findings[f]);
}
gs.info('');
gs.info('GAPS (' + gaps.length + '):');
for (var g = 0; g < gaps.length; g++) {
    gs.info('  [GAP] ' + gaps[g]);
}

gs.info('');
gs.info('--- Manual Verification Required ---');
gs.info('1. Confirm SOC 2 Type II report obtained from CORE portal (support.servicenow.com)');
gs.info('2. Confirm ISO 27001 certificate on file from trust.servicenow.com/certifications');
gs.info('3. Confirm DPA/DSA executed with ServiceNow account team');
gs.info('4. Verify Trust Portal notifications are monitored: trust.servicenow.com/notifications');
gs.info('5. Confirm CVE advisory process is documented: support.servicenow.com/kb (KB1226057)');

Remediation — Closing Vendor Due Diligence Gaps

Expert Notes

Auditor tip: The most common DORA Art.28 gap is not lacking the SOC 2 report, but lacking evidence that someone reviewed it and documented findings. Create an internal review memo for each annual SOC 2 report cycle.

Bridge letter gap: SOC 2 Type II reports typically cover Jan 1 - Sep 30. The Oct 1 - Dec 31 bridge letter is available by end of Q1 the following year. Plan audit schedules around this gap.

Self-hosted customers: If running ServiceNow on your own infrastructure (rare but possible), the shared responsibility model shifts significantly. ServiceNow's certifications cover the platform software, but infrastructure security (physical, network, backup) becomes your responsibility. This changes the evidence requirements for DORA Art.28 and NIS2 §2(d).