Incident severity is influenced by the business value of the affected asset. Which of the following are asset types that can be affected by an incident? (Choose two.)

In ServiceNow Security Incident Response (SIR), the severity of an incident is dynamically calculated based on factors like business impact and priority. The business impact is directly derived from the value of the affected assets. The primary records used to represent these assets are Configuration Items (CIs) from the CMDB and the Business Services they support. When a security incident is created, it is linked to these affected CIs and/or Business Services, and their predefined criticality is used by the severity calculator to determine the overall incident severity.

C. Calculator Group: This is a configuration record within the SIR application that groups severity calculation rules; it is not a business or IT asset that can be affected by an incident.
D. Severity Calculator: This is a configuration record that defines the logic and matrix for calculating severity based on inputs like business impact; it is not an operational asset.

1. ServiceNow Product Documentation, "Severity calculation in Security Incident Response": "The severity of a security incident is determined by its business impact and priority... Business impact is the effect that a security incident has on your business. It's determined by the criticality of the affected asset or business service." This document explicitly names both asset (CI) and business service as inputs.

2. ServiceNow Product Documentation, "Associate CIs and assets to a security incident": "You can associate configuration items (CIs) and assets to a security incident to identify the business impact of a security incident... The Affected CIs related list shows the configuration items that are associated with the security incident." This confirms CIs are the primary affected asset type.

3. ServiceNow Product Documentation, "Security Incident Response impact analysis": "When a security incident is created, you can use the CMDB to identify the affected CIs and business services. You can then use the dependency map to determine the upstream and downstream impact of the security incident." This highlights that both CIs and Business Services are the key entities analyzed for impact.