Vol IX Book 00 — Federal Compliance — Volume IX Overview: ServiceNow Day-2 Operations
Extending the coordination layer from compliance drift to the governed day-2 catalog — helpdesk, landing zone, app registrations, and telephony
0.1 Draft Proposal — Subject to Review
This document is a draft proposal developed by the CSI Team (Cloud Services Infrastructure). It has not been reviewed or approved by the Agency CIO Office, the Office of Information Security (OIS), or organizational leadership.
Date Code: 2026-07-19 17:05 ET
Series Context — This is the Volume IX overview of the Federal Compliance series. Volume VII established the ServiceNow coordination layer for control-compliance drift on M365 and Azure. Volume IX extends that same layer to day-2 operations — the governed catalog for the common Entra / M365 / Azure helpdesk tasks, the landing-zone front door, app-registration governance, and Teams telephony. Where Vol VII asks “is this control drifting?”, Volume IX asks “is this operator request governed, least-privilege, and evidenced?” — the same coordination discipline, applied to the work a service desk does every day.
0.2 Scope — FedRAMP Moderate & Microsoft GCC Moderate
This volume targets FedRAMP Moderate + Microsoft GCC Moderate exclusively (M365 GCC + Moderate-targeted Azure). Actuation is via Microsoft Graph through the in-boundary MID Server; other CSPs and higher boundaries are deferred, consistent with the rest of the current program.
Volume IX runs on the same ServiceNow Government Cloud coordination hub as Volume VII, which holds FedRAMP High authorization. The High-on-Moderate boundary treatment — why a High-authorized hub coordinating a Moderate boundary is a conservative, documented posture — is stated once in Vol VII Book 00 §“Authorization Boundary Treatment — ServiceNow High-on-Moderate” and inherited here without restatement. The platform-optionality position — ServiceNow is the recommended, not mandatory coordination platform; the requirement is the coordination contract, and named alternatives (authorized workflow/CMDB platform, or a composed Azure DevOps/GitHub + Logic Apps + Sentinel pipeline) satisfy it — is likewise stated once in Vol VII Book 00 §“ServiceNow is the recommended coordination platform — not a mandatory one” and inherited here.
1 What This Volume Addresses
Volume VII established the pattern for operating compliance drift as owned, evidenced work. But the highest-volume work a federal cloud team does is not drift remediation — it is day-2 operations: onboarding a user, resetting an authenticator, granting a group, standing up a subscription, registering an app, assigning a phone number. Done as portal clicks, each of these is an ungoverned, unevidenced change to an identity-attributed or configuration-controlled surface — exactly the gap an assessor probes.
This volume applies the Vol VII discipline to that work: every operator request is a typed, control-mapped catalog item; the approval gate is the one the control requires; actuation is Graph through the in-boundary MID (never standing tenant admin); and every action is an audited change record reconciled to the CM-8 join key. The result is that routine operations produce compliance evidence instead of eroding it.
2 The Day-2 Discipline
Four rules govern every catalog item in this volume — the same coordination contract as Vol VII, expressed for request-driven work:
- Typed, control-mapped request. No day-2 action is a free-text ticket or a portal click; it is a catalog item bound in the compliance spine to the NIST control it satisfies (see each book’s Authorities table).
- The approval gate the control requires. A password reset is identity-verified; a Conditional-Access exception needs a security approver; a privileged group is time-bound and reviewed. The gate is a property of the control, not a workflow convenience.
- Graph via the in-boundary MID; never standing admin. The connector holds scoped, logged, individually-approved write — never blanket tenant administration over the estate it serves (AC-6).
- Audited and reconciled. Every action emits a change/approval record (CM-3 / AU-2) reconciled to the IPAM/DDI-keyed CMDB (CM-8), feeding Vol VII Book 04 attestation.
3 Books in This Volume
| Book | Title | Focus | Roadmap lane / issue |
|---|---|---|---|
| Vol IX Book 00 | Volume Overview (this book) | The day-2 coordination discipline | — |
| Vol IX Book 01 | Helpdesk & ITSM Catalog | JML, password/MFA reset, unlock, group/license, guest invite | Lane C · #1139 |
| Vol IX Book 02 | Landing Zone Front Door | Catalog request → change-controlled IaC → CMDB reconcile | Lane D |
| Vol IX Book 03 | App Registration Governance | Request → scoped consent → secret/cert lifecycle → attestation | Lane E · #1140 |
| Vol IX Book 04 | Teams Telephony Catalog | Number/calling-policy/E911 catalog + Teams SCuBA drift | §4 · #1141 |
| Vol IX Book 05 | SaaS Integration Governance | The Entra app gallery as a governed SA-9 event — SaaS provisioning gated on a recorded FedRAMP authorization (Lane F) | Lane F |
| Vol IX Book 06 | Identity & Access Governance | Event-driven JML from the HRIT SSOT, access-certification campaigns, and the IAM evidence feed (Kit Expansion Phase 2 — gated on requirements v1.0) | Phase 2 · #1221 |
4 Closure Necessity — Operations That Evidence Themselves
4.1 Closure Necessity — an ungoverned routine action is a standing finding
Volume IX does not re-close the identity and configuration mechanisms Volumes I, VI, and VII establish. Its necessity is operational: the highest-frequency changes to the estate are day-2 requests, and if they are not governed, approved, least-privilege, and evidenced, they are the largest continuous source of control erosion an assessor will find. AC-2 is not satisfied by a JML someone does by hand; IA-5 is not satisfied by a help-desk password reset with no identity proofing; AC-6 is not satisfied by a standing-admin group grant. This volume makes routine operations produce the evidence the authorization package needs.
5 How This Volume Fits the Program
Volume IX depends on Volume I’s naming plane (the CM-8 join key), Volume VII’s coordination pattern and scoped-app discipline, and Volume VI’s landing-zone and identity-as-code artifacts (the IaC the landing-zone front door drives). It produces the audited, control-mapped operational record that Vol VII Book 04 lifts into attestation and the FedRAMP 20x KSI feed. Truth is separated from enforcement throughout: IPAM/DDI and HRIT remain the truth planes; the day-2 catalog is a coordination/enforcement plane on top of them.
6 Cross-References
ticket-to-machine-not-ticket-to-humanwhitepaper §5.1 — cites this volume’sMacdrOrchestrator.jsas a working, tested reference implementation of the paper’s Closure Necessity loop, applied to identity lifecycle (AC-2/AC-3/AC-6) rather than configuration drift.- Vol VII (all books) — the compliance-coordination layer this volume extends to day-2 work.
- Vol I Book 04 (HRIT Identity SSOT) — the identity source of truth the JML catalog provisions from.
- Vol VI Book 01/02 (Landing Zone / Identity as Code) — the IaC the landing-zone front door drives.
- Vol I Book 06 (Federal Telecommunications Modernization) — the telephony architecture Book 04 puts a catalog on.
servicenow-day2/helpdesk-control-map.json— the machine-readable catalog → control binding.federal-compliance-compliance-spine.yml— the SSOT registering this volume (vol-9) and its closures.
7 Provenance
This overview establishes the day-2 operations layer of the series, extending Volume VII’s coordination doctrine. Functions and planes are named, not organizations; ServiceNow is the deployed coordination example; the substitution path is preserved where a workflow platform is interchangeable. Every book carries a Date Code. The volume map above is authored as committed house-style SVG, rendered to PNG at 3× for crisp .docx zoom; further per-book figures follow in the figure pass.
8 Where This Volume’s Evidence Lands — Volume X (Optional)
Where the closures and evidence this volume produces bind to the governance substrate — the conformance layer, the surface slots, and the evidence contract — is documented once, for the whole series, in Vol X Book 00 — Governance-Substrate Integration. The binding is optional and separable: this volume, and the series it belongs to, stands complete at FedRAMP Moderate with no substrate engagement at all; adopting the substrate adds machine-checked scoring and drift-gating on top of what is already closed, and can be adopted later — or never — without rework.