Configuration Management Maturity Assessment
A 65-question diagnostic across 10 domains that follows configuration management from policy and data model design through identification, control, baselines, discovery, status accounting, verification and audit, to use...
Overview
A 65-question diagnostic across 10 domains that follows configuration management from policy and data model design through identification, control, baselines, discovery, status accounting, verification and audit, to use by other practices and measured value. Written for the Configuration Manager who needs to answer: can we trust our configuration data, and is it actually used to make faster, safer decisions?
Detailed Description
The CMDB is often the most talked-about and least trusted database in IT. Configuration data lives in spreadsheets that leave with their owners, discovery runs but is never reconciled, changes bypass the CMDB, and nobody can say which services a failing server supports. When configuration management works, incidents are routed and diagnosed faster, changes are assessed against real dependencies, security teams know what they are protecting, and audits are answered from records rather than scrambles.
This assessment follows the configuration lifecycle in ten domains. It starts with the policy, plan, ownership and use cases that give the practice direction, and the data model that defines CI types, attributes, relationships, identification rules and the right level of detail. It then covers how CIs are identified and registered, how configuration records are controlled through change, how baselines, secure settings and the definitive media library are managed, and how discovery, reconciliation and service mapping keep data current. It goes on to status accounting and reporting, verification, audit and data quality, and how incident, change, problem, security and continuity work actually use the data, and ends with training, measurement and improvement.
The model reflects every COBIT 2019 BAI10 activity, the configuration management requirements and guidance of ISO/IEC 20000-1 and 20000-2, the NIST SP 800-53 configuration management controls and related CIS and ISO/IEC 27001 controls. Each question is scored on Documented, Implemented and Effective, exposing rules that exist on paper only, data kept accurate by a few individuals, and controls that run but are never measured.
Assessment Details
Audience
Configuration Manager / CMDB Owner / ITSM Process Owner / IT Operations Manager. Secondary: Change, Incident and Problem Managers, Infrastructure and Cloud Leads, Service and Application Owners, IT Asset Managers, Security and IT Audit.
Purpose
Shows where configuration data is incomplete, uncontrolled, stale or unused, and which controls from COBIT, ISO/IEC 20000 and NIST are missing. Turns configuration management from a data upkeep burden into a trusted base for faster incident resolution, safer changes, stronger security and clean audits.
Effort
Initial assessment: 5-6 hours in facilitated sessions with the configuration manager, ITSM process owners, infrastructure and cloud leads, service owners, and asset, security and audit representatives. Evidence gathering: 1-2 weeks (CMDB exports, discovery reports, baselines, audit samples). Reassessment: 2-3 hours.
Cadence
Every six months while the program is maturing, then annually. Reassess after major tool migrations, cloud moves or audit findings.
Framework Alignment
KPIs
- CI Accuracy - Share of sampled CIs matching the live environment. Target: 95% or more.
- Discovery Coverage - Share of in-scope infrastructure discovered automatically. Target: 90% or more.
- Data Completeness - Share of mandatory CI attributes populated. Target: 95% or more.
- Ghost and Unrecorded CI Rate - Share of CIs recorded but absent, or present but unrecorded. Target: under 3%.
- CMDB Consumption - Share of major ITSM processes actively using CMDB data. Target: 100%.
Dependencies
Assessment Outline
(10 domains · 65 questions)-
1
1 Configuration Management Governance
Checks the policy and scope, the configuration management plan, the process owner's authority, roles, interfaces with other practices, and the use cases that decide what the CMDB must hold.
- 1.1 Configuration management policy and scope 1 questions
- 1.2 Configuration management plan 1 questions
- 1.3 Process owner authority 1 questions
- 1.4 Roles and RACI 1 questions
- 1.5 Practice interfaces 1 questions
- 1.6 Use-case-driven scope 1 questions
-
2
2 Configuration Model and CMDB Design
Evaluates the CMDB strategy and architecture, CI definition and types, attributes, relationship types, identification and naming rules, level of detail by criticality, federation and data authority, and whether the tool supports the model.
- 2.1 CMDB strategy and architecture 1 questions
- 2.2 CI definition and types 1 questions
- 2.3 CI attributes 1 questions
- 2.4 Relationship types 1 questions
- 2.5 Identification and naming 1 questions
- 2.6 Level of detail by criticality 1 questions
- 2.7 Federation and data authority 1 questions
- 2.8 CMDB tool capability 1 questions
-
3
3 CI Identification and Registration
Assesses how CIs are populated and classified, CI ownership, recording services as CIs, handling CIs discovery cannot find, software and license CIs, and alignment with the IT asset register.
- 3.1 CI population and classification 1 questions
- 3.2 CI ownership 1 questions
- 3.3 Services as configuration items 1 questions
- 3.4 Non-discoverable CIs 1 questions
- 3.5 Software and license CIs 1 questions
- 3.6 Asset and CI alignment 1 questions
- 3.7 AI Models, Agents and Prompts as CIs 1 questions
- 3.8 Software Bill of Materials Linkage 1 questions
-
4
4 Configuration Control
Looks at access control over configuration records, change-linked updates, review of proposed changes against baselines, data validation, relationship upkeep, lifecycle status, decommissioning and detection of unauthorized changes.
- 4.1 Access control over configuration records 1 questions
- 4.2 Change-linked updates 1 questions
- 4.3 Review of proposed CI changes 1 questions
- 4.4 Mandatory data validation 1 questions
- 4.5 Relationship maintenance 1 questions
- 4.6 Lifecycle status 1 questions
- 4.7 Decommissioning 1 questions
- 4.8 Unauthorized change detection 1 questions
-
5
5 Baselines and Secure Configuration
Evaluates approved configuration baselines, baseline change control, secure configuration settings and drift checks, the definitive media library and updating configuration information after deployment.
- 5.1 Configuration baselines 1 questions
- 5.2 Baseline change control 1 questions
- 5.3 Secure configuration settings 1 questions
- 5.4 Definitive media library 1 questions
- 5.5 Post-deployment update 1 questions
-
6
6 Discovery, Reconciliation and Service Mapping
Checks automated discovery, coverage and frequency, identification and reconciliation rules, exception handling, service mapping and the handling of short-lived cloud and container resources.
- 6.1 Automated discovery 1 questions
- 6.2 Discovery coverage and frequency 1 questions
- 6.3 Identification and reconciliation rules 1 questions
- 6.4 Discovery exception handling 1 questions
- 6.5 Service mapping 1 questions
- 6.6 Dynamic and cloud resources 1 questions
-
7
7 Status Accounting and Reporting
Assesses status accounting against baselines, change history and audit trail, stakeholder reporting, self-service access to configuration information and on-demand audit evidence.
- 7.1 Configuration status accounting 1 questions
- 7.2 Change history and audit trail 1 questions
- 7.3 Stakeholder reporting 1 questions
- 7.4 Availability of configuration information 1 questions
- 7.5 Audit and compliance evidence 1 questions
-
8
8 Verification, Audit and Data Quality
Looks at quality targets, verification against the live environment, physical existence checks, deviation remediation, duplicate control, feedback from daily use and independent configuration audit.
- 8.1 Data quality targets 1 questions
- 8.2 Verification against the live environment 1 questions
- 8.3 Physical existence checks 1 questions
- 8.4 Deviation remediation 1 questions
- 8.5 Duplicate control 1 questions
- 8.6 Process-driven feedback 1 questions
- 8.7 Independent configuration audit 1 questions
-
9
9 Process Integration and Consumption
Evaluates how incident, change, problem, security, continuity and capacity work use configuration data to make faster and safer decisions.
- 9.1 Incident management use 1 questions
- 9.2 Change impact analysis 1 questions
- 9.3 Problem management use 1 questions
- 9.4 Security use of configuration data 1 questions
- 9.5 Continuity and capacity use 1 questions
-
10
10 People, Measurement and Improvement
Checks training, cross-team awareness, the KPI framework, consumption and value measurement, the improvement register and yearly maturity review.
- 10.1 Training 1 questions
- 10.2 Cross-team awareness 1 questions
- 10.3 KPI framework 1 questions
- 10.4 Consumption measurement 1 questions
- 10.5 Value measurement 1 questions
- 10.6 Improvement register 1 questions
- 10.7 Practice maturity review 1 questions
At a Glance
Still have questions? Get in touch
Business Bay, Dubai, UAE
ITSGovernance