Certifications

Users, groups, and roles form one of the most important access and work-assignment structures in ServiceNow. They are related but they solve different problems: a user represents an individual identity, a group organizes people for work or administration, and a role grants platform capabilities. Confusing those concepts can create excessive access, broken assignment queues, or troubleshooting paths that never reach the real cause. The current January 2026 CSA blueprint places 30 percent on Database Management and Platform Security, including application/access control, while collaboration and task-management concepts also appear elsewhere. ServiceNow’s…

Risk management on the July 2026 PMP exam is not a vocabulary exercise about filling a register. It is a judgment problem: how a project leader recognizes uncertainty early, decides which risks deserve attention, chooses a proportionate response, and keeps the response connected to value, finance, stakeholders, and delivery decisions. The current exam makes that explicit by placing plan-and-manage-risk work inside the Business Environment domain while also testing risk in finance, change, issues, and stakeholder communication. The current PMP reflects the refreshed 2026 blueprint, with People at 33%, Process at…

Hybrid delivery on the current PMP exam is not a compromise label applied when a project team cannot decide between predictive and agile methods. It is a deliberate operating design. The project manager chooses which parts of the work benefit from stable planning and control, which parts benefit from rapid learning and adaptation, and how those parts will exchange information, decisions, and deliverables without creating two disconnected projects. The July 2026 PMP blueprint makes this perspective central. Predictive, adaptive/agile, and hybrid approaches appear throughout all three exam domains, and roughly…

Stakeholder engagement on the July 2026 PMP exam is an active leadership process, not a one-time exercise in building a stakeholder register. The refreshed People domain asks candidates to identify and analyze stakeholders, tailor communication, execute an engagement plan, align expectations, build trust, influence outcomes, and keep customer or stakeholder satisfaction visible as the project changes. That emphasis matches the current definition of project success. Schedule, budget, and scope still matter, but PMI’s refreshed exam places more weight on stakeholder value and desired outcomes. The PMP therefore tests whether the…

CISA approaches governance from an auditor’s viewpoint. The question is not whether an organization can describe an IT strategy or point to a governance committee. The auditor needs to determine whether decision rights, policies, resources, architecture, risk management, vendor oversight, and performance reporting actually support enterprise objectives and produce evidence that can withstand challenge. The current CISA assigns 18 percent to Governance and Management of IT. That domain covers laws and standards, organizational structure, IT strategy, policies and practices, enterprise architecture, enterprise risk management, privacy and data governance, resource management,…

CISA Domain 4 asks whether technology operations can deliver reliable service and recover when ordinary controls are not enough. It joins daily operational disciplines—assets, capacity, incidents, change, patching, logging, service levels, and databases—with business-impact analysis, backup, continuity, and disaster recovery. That combination reflects an auditor’s real job: operational weakness and resilience weakness are often different stages of the same failure chain. The current CISA assigns 26 percent to Information Systems Operations and Business Resilience. This domain asks auditors to evaluate whether operations and recovery practices support organizational objectives, using evidence…

AML risk assessment identifies where financial-crime exposure exists, but governance determines what an organization does with that information. Senior management and boards need a way to express risk appetite, translate it into policies and controls, challenge performance, and decide when changes in customers, products, geography, regulation, or typology require a different response. That layer is broader than scoring and is the focus of this article. The current CAMS explicitly includes risk appetite, governance committees, policies and procedures, KPIs and KRIs, enterprise risk assessment, management reporting, and oversight. The ACAMS consistently…

Know Your Customer and customer due diligence are often treated as onboarding tasks, but effective due diligence follows the relationship throughout its lifecycle. The purpose is not simply to collect identification documents. It is to establish who the customer is, who ultimately owns or controls the relationship, why the relationship exists, what activity is expected, what risk factors are present, and what additional evidence is needed when risk is higher. The current CAMS includes KYC, CDD, enhanced due diligence, customer risk assessment, beneficial ownership, source-of-funds/source-of-wealth concepts, PEP and sanctions considerations,…

Transaction monitoring is one of the places where an anti-financial-crime program becomes operational. Policy may define risk appetite and customer due diligence may establish an expected profile, but monitoring has to detect when actual activity no longer fits that expectation. For CAMS candidates, the useful mental model is not “a system raises an alert.” It is a controlled process that turns risk hypotheses into scenarios, scenarios into alerts, and alerts into defensible decisions. The current CAMS treats transaction monitoring as part of the wider control environment rather than an isolated…

Sanctions compliance sits beside AML controls but asks a different first question. AML programs often investigate whether activity may represent proceeds of crime or suspicious behavior; sanctions controls ask whether the organization is prohibited or restricted from dealing with a person, entity, jurisdiction, activity, vessel, asset, or transaction under applicable regimes. The operational challenge is translating changing legal restrictions into reliable screening, due diligence, escalation, and blocking or reporting decisions. For the CAMS, sanctions should be understood as part of the broader anti-financial-crime control environment. Current ACAMS sanctions training emphasizes…

Information security governance is the mechanism that makes security accountable to the enterprise rather than leaving it as a collection of technical activities. It connects business objectives, risk appetite, legal and contractual obligations, security strategy, investment, decision rights, policies, and measurable results. That management perspective is central to CISM. As of October 5, 2026, the current CISM assigns 17% to Information Security Governance. ISACA has announced a new outline effective November 3, 2026, where Governance becomes 18% and the updated material adds more emphasis on enterprise architecture and information security…

Information security risk management in CISM is not a vulnerability-remediation exercise. It is a management process for identifying uncertainty that matters to the enterprise, understanding its business effect, assigning ownership, choosing a response, and monitoring whether the resulting risk remains acceptable. Technical findings are inputs to that process, not the process itself. As of October 5, 2026, the current CISM assigns 20% to Information Security Risk Management. ISACA has announced a revised outline effective November 3, 2026; the risk-management domain remains 20%, and candidates testing on or after that date…

ITIL guiding principles are useful because service-management decisions rarely arrive as clean textbook exercises. Teams face incomplete information, competing priorities, legacy constraints, regulatory expectations, user frustration, and pressure to move quickly. A principle gives direction without pretending that one procedure fits every situation. In ITIL Foundation V5, the guiding principles remain part of the framework’s decision-making core. They are meant to shape how people interpret the wider ITIL Value System, product and service lifecycle, management practices, and continual improvement. They work together; selecting one principle as an excuse to ignore…

Incident management is a pressure discipline. Users are affected, managers want updates, technical teams want time to diagnose, and every minute can increase business impact. The practice becomes effective when it preserves one clear objective: restore normal service as quickly and safely as practical while maintaining enough evidence and communication to support sound decisions. That emphasis is important in current ITIL Foundation V5 thinking. Incident resolution belongs to the support side of digital product and service management, but it is not the same as Problem Management. An incident team may…

Problem Management begins where repeated or significant incidents create a deeper question: what conditions are producing this failure, and what can the organization change so the impact is less likely to return? That work is different from the urgent restoration focus of Incident Management. It is analytical, evidence-driven, and often cross-functional. Current ITIL Foundation V5 recognizes problem analysis as a core service-management skill. A problem does not need one dramatic root cause. Modern systems fail through interactions among design choices, capacity, data, dependencies, process gaps, human assumptions, and control weaknesses….