Title: ServiceNow Integrated Risk Management & Continuous Authorization & Monitoring Specialist
Location: Sacramento, CA (Part-Time (20 hours/week, Monday-Friday, approximately 4 hours per day between 8:00 AM - 5:00 PM Pacific Time)
Duration: 24 months
SCOPE OF WORK
SMUD is issuing this Request for Proposal to engage a qualified resource to provide a leased employee to support our continued build out and maturing of ServiceNow's Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) modules. This initiative will help to better align SMUD's Cybersecurity Risk Program with NIST's Cybersecurity and Risk Management Frameworks (CSF/RMF).
In an effort to mature the Sacramento Municipal Utility District's (SMUD) Cybersecurity Risk Program, SMUD is seeking a leased employee for technical database administrator and developer assistance in maturing our development of ServiceNow's Continuous Authorization and Monitoring (CAM) module. In support of the aforementioned, SMUD is looking for technical expertise to review, consult, improve upon, and continue development of our existing integration to further our progress towards centralizing organizational-level common control, business system and application-level assessment & authorization packages; to include security control attestation and supporting documentation/evidence collection.
To successfully integrate with SMUD's Cybersecurity Risk Team's current approach, it is important that the leased employee have a strong understanding of NIST's Cybersecurity (CSF) and Risk Management Frameworks (RMF), and familiarity with navigating Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53).
Technical assistance is also being sought to support the modification of existing ServiceNow workflows maintained by other SMUD business areas, as well as creation of new workflows to support Cybersecurity Risk Team process efficiencies. This support will require regular attendance at SMUD's weekly ServiceNow platform enhancement reviews, as well as weekly ServiceNow change management review board meetings.
SMUD's Cybersecurity Risk Team welcomes proposals from potential collaborators that outline their technical qualifications, experience assisting clients with ServiceNow CAM module integration work, as well as evidence their understanding of helping clients succeed in their execution and implementation of NIST CSF and RMF. We strongly encourage highlighting any ServiceNow platform specific qualifications that evidence your technical understanding such as ServiceNow's Certified Implementation Specialist – Risk and Compliance, GRC Integrated Risk Management (IRM) Implementer, Certified Technical Architect, Certified Application Developer, etc.
The resource shall provide all labor, and material required to plan and facilitate this leased employee request for a ServiceNow Process Integrated Risk Management/Continuous Authorization and Monitoring (IRM/CAM) Buildout and Cybersecurity Risk Management Queue Optimization to support NIST Risk Management Framework Implementation.
The resource will be responsible for initiating and executing an independent project focused on the assessment of the existing cybersecurity risk assessment process at SMUD; the current methodology of ServiceNow Cybersecurity Risk ticket assignment, ticket types, ticket prioritization, processing times, and assessing the average level of effort (i.e. # of hours, collaboration with stakeholders internal or external to SMUD) required to resolve/close tickets. This assessment will also examine the current assignment workflow within SMUD's existing ServiceNow deployment with a focus on optimization/refinement of the existing processes, as well as helping to establish realistic processing expectancies for stakeholders based on request type.
This effort will also pay careful attention to the information/details being requested to process a ServiceNow ticket, request and propose standardization improvements by helping establish cybersecurity risk documentation templates for SMUD stakeholders to use when initiating ServiceNow ticket requests that will require cybersecurity risk assessments more efficiently.
Review of historical ServiceNow Cybersecurity Risk ticket processing metrics will be necessary to help identify trends that illustrate peak ticket submission timeframes and propose efficiencies that can be implemented to effectively manage the cybersecurity risk ticket queue while considering the inherent resource constraints of having limited personnel to review, investigate, and process ticket submissions. Any proposed considerations will be formally presented to Cybersecurity Department Leadership for review and approval. All cybersecurity risk ticket processing recommendations that receive formal approval will be captured in a documented process methodology that outlines expected processing timelines, defines ticket processing minimum entrance criteria, as well as best practice recommendations for ticket submissions that will better assist the Cybersecurity Risk Team in being able to improve ticket processing timelines.
The leased employee will collaborate directly with SMUD's Cybersecurity Awareness, Training, and Education program in determining the best course of action to raise awareness for SMUD users planning to submit a ticket that will require cybersecurity risk review/assessment.
The leased employee will also be directly responsible for helping execute the initial organizational pilot of the RMF process leveraging the ServiceNow IRM and CAM modules to include assignment and refinement of the security control process (i.e. organization-level owned controls, system-level controls, hybrid controls), security artifact/evidence requirements; development of template/example documentation and job aids for organization stakeholders to leverage; as well as providing recommendations for the execution of continuous monitoring leveraging ServiceNow IRM.
The leased employee will be required to attend SMUD's weekly ServiceNow platform enhancement reviews, as well as weekly ServiceNow change management review board meetings as needed in support of change requests or new items brought forward by SMUD's Cybersecurity Risk Team. Meetings will be supported remotely via MS Teams.
Mandatory Requirements
• Minimum of four (4) years' experience developing, analyzing, and creating efficiencies within ServiceNow workflow processes.
•c Minimum of three (3) years' experience customizing Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) capabilities within ServiceNow to align with business objectives and risk appetite of mid to large-sized organizations.
• Minimum of three (3) years' experience working within a governance, risk, and compliance (GRC) environment, with a proven track record of executing corporate projects and growth-based initiatives.
• Minimum of three (3) years' experience working on cross-collaborative efforts, involving establishing partnerships between business units, independently analyzing and engaging organizational stakeholders as needed to ensure smooth process development and implementation across the organization for risk assessment functions.
• Demonstrated experience developing professional templates to support organizational-level, cybersecurity-focused risk assessment processes.
Proposed resource must have a recent ServiceNow Integrated Risk Management (IRM) engagement with a minimum of three (3) years' experience and an active ServiceNow Continuous Authorization and Monitoring (CAM) engagement with a minimum of one (1) year continuous operation.
• Must have strong foundational understanding of NIST's Cybersecurity and Risk Management Framework (CSF/RMF), including hands-on experience aligning CSF and RMF functions within ServiceNow IRM/CAM modules.
Desirable Qualifications:
• ServiceNow Practitioner Implementer or above (e.g. Professional Implementer)
• ServiceNow Certified System Administrator (CSA)
• ServiceNow GRC: Integrated Risk Management (IRM) Implementer
• ServiceNow Certified Technical Architect (CTA)
• ISC2 Certified Information Systems Security Professional (CISSP)
• ISC2 Certified – Governance Risk and Compliance (CGRC) or Certified Authorization Professional (CAP)
• ISACA Certified Information Security Manager (CISM)
• ISACA Certified in Risk and Information Systems Control (CRISC)
• CompTIA Certified Advanced Security Practitioner (CASP+)
• CompTIA Security+
• B.S. Computer Science (CS), Management of Information Systems (MIS), or Cybersecurity from an accredited university.
TECHNICAL SUBMITTAL REQUIREMENTS
1. Please provide examples of your work portfolio in helping clients analyze existing ServiceNow workflow processes to determine opportunities for process improvement and any time or resource-saving efficiencies that were realized as a result. Please include details on whether these workflow/process improvements had to be reviewed and approved by a Change Advisory Board (or similar group). If so, did you play a role in articulating these workflow/process improvements and changes and championing them? Please provide 1-2 examples.
2. Please describe in detail your professional experience in helping a client implement ServiceNow's Integrated Risk Management (IRM) and Continuous Authorization and Monitoring (CAM) functions. Please include details on how you aligned IRM and CAM functions to best fit the client's risk assessment framework, and what noticeable improvements or benefits the client realized because of your efforts. Please be specific if this implementation was mostly out-of-the box or if customizations to the ServiceNow IRM/CAM modules were required to achieve the desired result.
3. Please explain your background in helping a client implement or align with NIST's Cybersecurity (CSF) and/or Risk Management Frameworks (RMF). Please include specific details on how you helped a client achieve this alignment using ServiceNow's IRM and CAM modules and if platform customizations were required to achieve the desired effect. Please include any details that speak to if your implementation included a risk register and/or a system or application-level Plan of Action and Milestones (POA&M) to assist risk owners with continuous monitoring of known findings. How was this carried out in ServiceNow IRM/CAM?
