ServiceNow Success
Mastering Security & Risk NOW book cover, A Practitioner's Guide to Security Operations, Risk, and Compliance on the ServiceNow Platform by Michael J. Murphy

Part of the ServiceNow Success series

Mastering Security & Risk NOW

A Practitioner's Guide to Security Operations, Risk, and Compliance on the ServiceNow Platform

Field-tested patterns for running Security Operations and Integrated Risk Management on ServiceNow, not a rewrite of the product docs, but the playbook that tells you what actually holds up under audit, incident load, and executive scrutiny. Whether you are standing up Security Incident Response and Vulnerability Response for the first time, maturing a GRC / IRM practice, or finally connecting SecOps threat response to IRM risk quantification, this is the practitioner's reference that pairs process with configuration, operating cadence with platform design, and AI assistance with governance guardrails.

BUY ON AMAZON
Aligned to the current ServiceNow release
For security architects, GRC/IRM practitioners, SecOps analysts, ServiceNow admins & CISO deputies

What You'll Learn

Process first, platform second. Every chapter pairs the security or risk discipline with the ServiceNow configuration, so SecOps, GRC, and platform teams finally read the same book, a practical training resource for architects, analysts, and admins alike.

01

Run Security Incident Response

SIR that closes the loop: intake, triage, playbooks, evidence, and the handoffs that keep response fast without losing auditability.

02

Prioritize Vulnerability Response

VR that ranks what matters: scanner integration, risk-based scoring, assignment groups, SLAs, and the hygiene that keeps the backlog honest.

03

Quantify risk in IRM

Risk register, assessments, and residual risk that leadership can fund, not a spreadsheet of opinions wearing a platform badge.

04

Prove compliance continuously

Policy & compliance, Configuration Compliance, audit engagement, and continuous monitoring that survive the next attestation cycle.

05

Join SecOps to IRM

Connect threat response and vulnerability findings to risk quantification so incidents and exposures move the same register the board reads.

06

Architect and deploy for scale

Configuration over customization, environment strategy, integrations, access design, Now Assist with guardrails, and an operating cadence that sticks.

Inside the Book

Two parts. Part I for the mixed audience of security, GRC, and platform people. Part II written architect to architect, and considerably more technical.

Part I The disciplines and the platform, SecOps, IRM, and the operating join
1

Why Security & Risk on ServiceNow

What SecOps and IRM are for, what they are not, and the three questions a healthy practice answers continuously.

2

The SecOps and IRM Data Model

Core tables, workspaces, CMDB joins, and the platform seams underneath response and risk.

3

Security Incident Response

Intake to closure: categories, playbooks, evidence, major-incident patterns, and response SLAs that hold.

4

Vulnerability Response

Scanner integrations, risk scoring, assignment, exception handling, and the backlog hygiene that stops VR from becoming noise.

5

Configuration Compliance and Hardening

Baselines, test results, remediation ownership, and how config drift becomes an actionable queue.

6

Threat Intelligence in the Loop

Feeds, observables, enrichment, and when intelligence changes triage instead of decorating tickets.

7

Integrated Risk Management Foundations

Risk frameworks, the register, inherent vs. residual risk, and assessment design that auditors recognize.

8

Policy, Compliance, and Control Testing

Policy lifecycle, control objectives, attestations, and evidence that survives scrutiny.

9

Audit Management and Engagements

Engagement planning, findings, remediations, and the cadence that keeps audit from becoming a fire drill.

10

Continuous Monitoring and Metrics

Indicators, dashboards, Performance Analytics patterns, and the few measures executives actually use.

11

Connecting SecOps to IRM

From security incidents and vulnerabilities to quantified risk, ownership, thresholds, and the board-ready narrative.

12

Operating Cadence and Governance

The standing meetings, decision rights, and RACI that keep SecOps and GRC from drifting apart.

Part II The Technical Architect's Deployment Playbook
13

The Architect's Mindset

Configuration over customization as a scalability law, and the five-rung ladder for change decisions.

14

Environment Strategy and Access Design

Instance stack, roles before custom ACLs, segregation of duties, and licensing as architecture.

15

Integrations That Survive the Bad Day

Scanners, SIEM/SOAR, identity, ticketing, and failure modes designed in from day one.

16

AI Assistance and Now Assist Guardrails

Where AI helps triage and draft, and the governance, logging, and human-in-the-loop rules that keep it defensible.

17

The Implementation and Cutover Runbook

Phased adoption, first ninety days, failure catalog, and the architect's pre-flight checklist.

A-D

Four Appendices

Core tables quick reference, starter metric catalog, configuration-or-customization guide, and glossary of SecOps / IRM terms.

"A vulnerability backlog is not a risk program. An incident queue is not a response capability. The organizations that held up under audit and under attack were the ones who agreed on ownership, kept a few measures true, and tied every finding and every incident back to a risk someone was funded to own."
From the Field, one of dozens of real customer stories inside
Michael J. Murphy, author of Mastering Security & Risk NOW

About Michael J. Murphy

Michael J. Murphy is a Principal Technical Architect with about thirty years of IT experience and deep ServiceNow expertise spanning platform architecture, integrations, compliance, security and risk governance, and operating models that survive contact with auditors and production. He is the author of the ServiceNow Success book series.

Every "From the Field" story in the book happened. Names and details are changed; the lessons are not. His rule for the whole series: process first, platform second, and nothing that hasn't been seen working in a real environment.

Stop collecting findings. Start managing risk.

Get the playbook that turns ServiceNow SecOps and IRM from licenses into an operating model.

BUY ON AMAZON

Frequently Asked Questions

Common questions about ServiceNow Security Operations, Integrated Risk Management, and this book.

What does Mastering Security & Risk NOW cover on the ServiceNow platform?

Mastering Security & Risk NOW covers ServiceNow Security Operations (Security Incident Response, Vulnerability Response, Configuration Compliance, Threat Intelligence) and ServiceNow GRC / Integrated Risk Management (risk register, policy and compliance, audit, continuous monitoring), plus the operating join between SecOps threat response and IRM risk quantification.

Who should read Mastering Security & Risk NOW?

Security architects, GRC and IRM practitioners, SecOps analysts, ServiceNow administrators and architects, and CISOs' technical deputies who implement or run Security Operations and risk management on ServiceNow.

Does the book cover AI / Now Assist for security and risk?

Yes. The book covers AI assistance and Now Assist where they help triage, draft, and summarize, with explicit governance guardrails so automation never outruns accountability, evidence, or audit readiness.

Is Mastering Security & Risk NOW a technical guide or a process guide?

Both. Part I covers the SecOps and IRM disciplines and platform configuration for security and GRC practitioners. Part II is a technical architect's deployment playbook covering environment strategy, integrations, access design, configuration over customization, and operating cadence.

Where can I buy Mastering Security & Risk NOW?

Mastering Security & Risk NOW is available on Amazon.