HIRISE Support Portal - SPP-SG Regulated Market Singapore customer specific access<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } How does SPP-SG (Singapore Regulated Market) differ from Commercial NowSupport? Singapore Protected Platform - Singapore Cloud Security Customer Resources Cloud Security White Papers, Articles, Guides, and Other Resources Most of your security inquiries will be addressed in the Regulated Market assessment report(Multi-Tier Cloud Security Standard (MTCS)), which should be available with your organisation's ServiceNow Contacts. If necessary, request these documents from the ServiceNow Account team representatives. Also, you can coordinate with your SAM and ServiceNow Account representatives to set up a session with the ServiceNow Security team. If you need any architecture or dataflow documents specific to SPP boundaries, you should seek these through ServiceNow Account representatives, as they may be legally bound. The instance email address will be assigned a regulated market domain, such as instancename@servicenowcloud.com.sgThe instance URL will also possess a regulated market domain, for example, instancename.servicenowcloud.com.sgThe instance IP will be changed if the instance is migrated from the Commercial Environment ( instancename.service-now.com) Support Portal Access/HIRISE Password Reset/Unlock HIRISE account. The NowSupport portal link is different for SPP-SG customers and is HIRISE. HIRISE access is restricted to ServiceNow employees and can only be accessed internally via Secure Virtual Machines. External customers can access HIRISE from the internet. https://hirise.servicenowcloud.com.sg/hi_login.do External users can start the HIRISE password reset process through the "Forgot your Password" link https://hirise.servicenowcloud.com.sg/reset_password.do?username= KB0547255: Resetting your Now Support user password Upon their first login, customers may be prompted to set up Multi-Factor Authentication (MFA) for HIRISE. User and Account contacts management from HIRISE Support portal? It is recommended that your organisation maintains more than one HIRISE customer_admin user. User/Account management direct link ==> https://hirise.servicenowcloud.com.sg/now?id=ns_manage_account_details Existing HIRISE users with a customer_admin role within their organisation can manage other users. New users can be created from "Add new users" .If the partner company is not an SPP-SG customer, it is necessary to create the partner users as HIRISE users. These users should be linked to your organization with the customer or customer_admin role.The role of "Primary Customer Admin" /"Account Contacts" can be updated directly by an existing customer_admin. Navigate to Account Contacts, then Update Contacts, and click on the existing primary customer admin's username. This will provide you with a search button to select a new user. Please ensure that the new primary customer admin possesses the customer_admin role."Inactive" and "Locked-out" users can contact their HIRISE customer_admin to reactivate their accounts, as HIRISE ServiceNow support does not have a way to verify their legitimacy unless backed by approval from customer_admin/ServiceNow Account representatives. How to create Support Case from HIRISE? https://hirise.servicenowcloud.com.sg/now?id=ns_guided_support. You can find the option "Create a case" in the bottom right corner of the page. Just follow the on-screen prompts. Notifications from HIRISE ( SPP-SG Support portal) Please be informed that email notifications from HIRISE will not contain specific case details. The notifications will merely indicate that a case has been updated. To access the comprehensive details of the update, you are required to log in to HIRISE. This security measure is implemented to ensure compliance with regulated market standards and has been thoroughly audited and certified by the relevant regulatory authority. As it is an environment configuration, it cannot be modified. **This ensures that any sensitive information on the case notes/short description ( personal information on signature/IPs/endpoints) is not communicated via email. These emails can be accessed from anywhere, and a case's watch list can contain any email address and PII. Instance OOB "System Administrator" Password reset ServiceNow does not handle Instance User Management. Customers can reset the instance ADMIN password using the admin password reset catalogue available at password reset catalogue from hirise.servicenowcloud.com.sg. The catalogue permits HIRISE customer_admin to input the new instance "admin" password, which will generate a change on HIRISE. Another HIRISE Support Portal customer_admin must approve this change. Your organisation should maintain more than one HIRISE customer_admin user, as these requests should be initiated by one customer_admin and approved by another on the HIRISE Support Portal. Please note that due to HIRISE's secure environment, automated approval emails triggered from the Change for the Password reset catalogue change will not accept responses via email; therefore, the email recipient (second customer_admin) must log on to HIRISE to approve the request from the HIRISE change record created by the first customer_admin. Instance Access for Customer Support Customer support can access the instance only from SNCAv2 (Secure Virtual Machine) SNC Access Plugin enabled customers should add Customer Support agent names to the SNC access list in the format firstname.lastname.snf.sg to allow SNC access IP Access control-enabled customers should add ServiceNow SNCAv2 VPN IPs for Customer Support to HOP on the instance. This KB provides more details. HIRISE-KB - SPP-SG(Regulated Market Singapore) IP Access Control restrictions during HOP(Customer Support access) External integrations to SPP-SG instances The Virtual IP (VIP) for the instance is provisioned at the ADCv3 container level and is allocated to the NGINX ADCv3 container specific to the organization. Each organization is assigned a pair of public instance IPs that remain consistent across all instances associated with that organization. When configuring the SPP instance endpoints for communication with external endpoints, it is crucial to consider both IPs. These IP pairs, sourced from each of the Primary and Secondary Datacenter pairs, guarantee high availability. Further insights into the "High Availability" architecture can be found in the document provided below. White paper: Delivering Performance, Scalability, and Availability on The ServiceNow Cloud KB0538621: Finding the IP information for your instance Instance/Module(Plugin/Store Application) Go-Live on SPP-SG PROD instance KB0965738 - On-Boarding/Go Live Best Practice ( Tech Support Perspective) Most Plugins and Applications hosted on the Store are, by default, accessible on the customer's sub-production instances. The customer_admin must "GET" these applications from the Store( including all dependent applications listed within the store), irrespective of their entitlement status, to render them "installable" on the instance. A license or entitlement check governs the app's visibility within the Production environment. Consequently, installing the application on the sub-production instance does not automatically ensure its availability for installation in the Production environment. In preparation for a go-live in the Production environment, it is imperative to ensure that both the application and its dependencies, including any plugins, are visible in the Production environment well in advance. Even if you have entitlement to the application, the absence of the application in the Production environment can result in significant delays. The resolution of such issues involves coordination with various backend teams for contract verification and relies on daily data loads. Given the involvement of multiple backend systems in the data flow, timely remediation may not always be feasible. Customer Support is unable to perform these validations on your behalf, as they must be completed by the HIRISE customer administrator on the SPP-SG store side. This step is necessary to procure the application, which then enables its visibility within the PROD instance application manager. Once the application is visible, the instance administrator can select Install. This will open a window indicating whether any additional products need to be procured from the store. That same window will include another Install button, which will trigger the installation of the application. Please note that PROD instances retrieve information from multiple endpoints. Therefore, we are unable to verify these details from our backend, as the process depends on licences downloaded on the instance, the SPP-SG store, and the licensing server on SPP-SG. Plugin installation on SPP-SG instances KB0716626: Plugin FAQs This KB will assist in requesting Plugins for an instance from HIRISE using the Request plugin catalogue. KB0695388: Plugin Activation Overview If the Plugin and its dependency Plugin is "Installable" on PROD, the customer(instance admin) can install it as the license/entitlement check has already been completed. Plugins can be also be requested from the "Activate Plugin" catalogue hosted on the Support Portal Environment by customer_admin on the HIRISE portal. You can access the portal at this link: https://hirise.servicenowcloud.com.sg/now/en/pages/automation-store?id=ns_automation_store. All Automations==> Service Catalog==> Activate Plugin If the desired plugin is not listed, you can select "Plugin I'm looking for is not listed" and specify the plugin name as free text in the catalogue. This catalogue doesn't work for Store App installation It's important to note that Plugins and Store applications are different. This distinction can be identified in the product documentation, which also outlines the activation method. The plugin list for individual family releases can be found in the product documentation. List of Plugins Store Application installation on SPP-SG instances The SPP-SG Store differs from the NowSupport Commercial Customer ServiceNow Store. For further details, please visit the following link:https://hirise.servicenowcloud.com.sg/now Scroll to the bottom of the page to find this option How to access the HIRISE (SPP-SG) ServiceNow Store This KB will assist in procuring the application and dependencies from Store. Application Store Procurement - Store Application Installation If the Application and its dependency applications is "Installable" on PROD, the customer(instance admin) can install it as the license/entitlement check has already been completed. The customer_admin on the HIRISE portal must opt-in to these store applications and their associated dependencies (using the Opt-In button on View Products) or acquire them (using the GET button). This process will make the application available for installation by the Instance admin on the respective instances. It is crucial to complete this step for all Store applications that the customer intends to install, regardless of whether they are purchased or entitled to the customer. This ensures that the customer is appropriately licensed for the necessary dependent applications and that the applications are compatible with the version of the war instance currently in use. Inquiries regarding existing or new licenses/subscriptions/financial matters on SPP-SG Also, for all monetary questions regarding licensing/subscriptions/entitlements, please check with the ServiceNow Account reps, as that doesn't fall under Customer Support's Scope and we do not have access to check these. the Questions regarding pricing, subscription fees, or license costs for customer instances SPP-SG ServiceNow AppRepo( Custom applications) SPP(Regulated Market) ServiceNow application repository (Custom Applications) Entitlement check MID server download/installation and Auto upgrade on SPP-SG instances. The MID server host (customer network) can obtain(manual download) the MID server WAR version from install.service-now.com for the installation. To ensure smooth execution of MID Server auto-upgrades, please configure firewall rules based on the following domains rather than IP addresses: *.servicenowcloud.com.au*.service-now.com For examples of the required firewall rules, please refer to MID Server Prerequisites - Connections to allow list for the MID Server Important: The domain name should be servicenowcloud.com.sg Additional Documents Commercial to Regulated Market(SPP) Instance migration FAQ (Technical Support perspective) KB0538621: Finding the IP information for your instance FAQ on penetration test (PEN) ServiceNow Maintenance Impact (Customer Support Perspective) KB1048209 : How to Report Security Incidents and Security Findings to ServiceNow