Driving Efficiency: Implementing ITIL CMDB in Service Management

Proficiency in IT service management (ITSM) requires knowledge of the best practices and standards that inform the right approach toward delivering IT services in a way that delights customers. One such framework is ITIL, which is the most widely accepted approach to IT service management globally and has been in existence for over 40 years. Now in its fourth iteration, it has evolved with the digital age and remains an important reference for IT service delivery guidance.

The configuration management database (CMDB) was first referenced in ITIL 2 under the configuration management process, being defined as a database that contains all relevant details of each configuration item (CI) and information about the important relationships among CIs. Subsequent versions of ITIL have continued to mention the CMDB and its importance in the service management lifecycle since information about CI relationships is crucial in the planning, design, deployment, and support of IT services.

In this article, we delve into ITIL 4’s coverage of the CMDB and how it applies to select service management practices. The information covered is relevant to practitioners seeking to justify their investments in CMDBs and demonstrate their relevance and value in the IT environment.

Summary of key ITIL CMDB practices

The ITIL 4 framework introduced the concept of a practice, which is one of the core components of the ITIL service value system. Practices are a set of organizational resources designed for performing work or accomplishing an objective. The following table summarizes how CMDB has been referenced across different ITIL 4 practices.

CMDB practice in ITIL 4	Description
Service configuration management	Effective configuration management is made possible by the CMDB, which serves as the repository for configuration item records.
Change enablement	A thorough IT change impact assessment requires the CMDB to act as the single point of truth.
IT asset management	The lifecycle stages for IT assets in production are managed more effectively through the CMDB.
Problem management	The root causes of IT incidents can be better analyzed and treated when the CMDB provides information on all system dependencies.
Infrastructure and platform management	The valuable system information for planning and management of IT infrastructure and platforms across all environments is sourced from the CMDB.
CMDB in other ITIL 4 practices	Knowledge of IT configurations and dependencies maintained in a central CMDB is essential across all ITIL 4 practices.

Service configuration management

The ITIL 4 framework specifies that the primary objective of the service configuration management practice is to produce useful configuration information from a significant amount of data cost-effectively and reliably. The CMDB is designed to fulfill this need due to its ability to collect configuration information from various sources and integrate and process it before presenting it for consumption by relevant IT functions. 

Configuration items (CIs) are resources that can be managed individually and include hardware, software, networks, and buildings, among other IT assets. A CMDB captures attributes for each CI, including connections and relationships, which may be managed individually or as a group. The CMDB uses the attributes to generate service models that visualize the mapping of these connections and relationships from an architectural and logical perspective.

CMDB dependency map

The service configuration management practice ensures that trustworthy CI data is provided and maintained, including updates for changes to status, attributes, and relationships. For this to occur, the CI records within the CMDB should be subjected to regular audits and continual verification. 

An automated CMDB improves the reliability of the configuration data and decreases the need for verification (but does not remove it entirely). Automated verification checks will compare inventory (through discovery) and the CI records for completeness, correctness, and compliance, mainly by focusing on unregistered CIs and unauthorized changes to CIs.

According to ITIL 4, the key purposes of configuration information include:

• Impact analysis
• Cause and effect analysis
• Risk analysis
• Cost allocation
• Availability analysis and planning

This information is relevant to the other ITSM practices outlined in the rest of this article. 

The service configuration management practice is only as valuable as the information it provides, so it’s essential to ensure that it is accurate, up-to-date, reliable, easy to use, and relevant. The CMDB is the enabler of the effective and efficient management of CI records by providing the functionality for discovery, updates, modeling, verification, and integration with data sources.

The most effective CMDB solutions can discover and uniquely identify each CI, correlate all available information about that CI across multiple integrations, and then present a complete set of attributes for each configuration item in one easily accessible record.

Change enablement

The objective of the ITIL 4 change enablement practice is to ensure that changes to IT services and their components are controlled and that they meet the needs of the organization. Because changes are a source of disruption and risk, minimizing this is a key activity within the change enablement practice through the application of controls and the involvement of stakeholders in the review and authorization process activities.

The CMDB provides the relevant configuration information that facilitates change enablement activities as follows:

• Impact analysis: Analysis of the impacts of ongoing and planned changes on resources, products and services, service consumers, and users
• Cause and effect analysis: Review of unsuccessful changes and changes with unplanned effects as well as the identification of possible causes of failures
• Risk analysis: Analysis of risks during change planning
• Cost allocation: Allocation of the costs of changes to cost centers and/or customers
• Availability analysis and planning: Assessment of the impacts of planned changes on service availability and planning service availability during planned changes

Through its service modeling capabilities, the CMDB facilitates more effective change planning and impact assessment by enabling planners and authorities to identify the downstream or upstream effects that a change to a CI will have on related CIs. For example, a change in a database can impact multiple applications that query it for data. As the change is planned, the related CIs can be quickly and accurately identified by querying the CMDB, and an assessment of the risks involved can be better informed through the CI relationship information. 

Change authorities are more assured of making the right decisions in approving or declining changes by leveraging the CMDB as the single source of truth for the planned change impact and risk involved. Should a change be unsuccessful or cause unplanned downtime or service degradation, the CMDB becomes a useful aid in troubleshooting and incident root cause analysis.

Change realization activities rely heavily on accurate configuration information. The CMDB plays a key role in ensuring that changes are realized in a timely and effective manner while minimizing any associated negative impacts. 

Within the change enablement practice activities, other related ITIL 4 practices that touch on the CMDB include:

• Risk management: Analysis of risks related to planned changes during the assessment phase is more effective when the CMDB is used to generate information about impacted CIs.
• Deployment management: Deployment of changes is supported in ensuring that the naming, versioning, and controlling of service components are centrally managed through the CMDB.
• Release management: A release is a version of one CI or a collection of CIs that is made available for use. The CMDB facilitates the naming, versioning, and controlling of these CIs to ensure better acceptance and adoption following the changes that deployed them, ultimately resulting in satisfaction by users and stakeholders.

IT asset management

In the ITIL v3 framework, the CMDB was introduced in the service asset and configuration process. However, in ITIL 4, the two domains were split into individual practices to give them the weight that they both deserve. 

The IT asset management (ITAM) practice ensures good handling of the IT asset lifecycle from planning to disposal and that information about IT assets is trustworthy, accurate, complete, and available when required. This helps the organization maximize value, control costs, manage risks, make the right decisions, and meet regulatory and contractual requirements related to IT assets. IT asset information is maintained in an IT asset register, which includes information about the asset’s characteristics, ownership, cost, and lifecycle stage.

The CMDB extends the information that is stored in the IT asset register by capturing the IT status within the production environment as well as its relationships and dependencies. Organizations may choose to have one solution that does the work of both or to deploy the IT asset register to support financial asset management activities while assigning the CMDB to support ITSM-related activities during the assignment, utilization, and optimization of IT assets. 

Due to its automated discovery capabilities, the CMDB is deemed to be a vital source of truth concerning deployed IT assets to validate that the organization is extracting full value from their usage. For instance, CMDB dependency information enables the identification of risks to services that changes in IT assets might bring, such as vendor contract terms, license utilization, or obsolescence.

CMDB IT asset information

One key area where the CMDB plays a role in IT asset management is in the lifecycle stage of IT asset decommissioning and disposal. Before decommissioning, the asset change impact must be assessed, the decommissioning condition verified with potential corrective actions, and a decision made on reusing or disposing of the asset.

The CMDB provides accurate information on the CI’s status and associated dependencies that de-risks the decommissioning impact and supports the right decisions on reuse and disposal, which are key to an organization’s sustainability efforts. License reuse is better informed when the CMDB provides up-to-date information on where the licenses are deployed in the IT environment, and updates to the IT asset register following disposal can be automated through the CMDB.

The service financial management practice is a key beneficiary of the CMDB when applied to the IT asset management practice because the tracking of valuable IT assets and their dependencies is simplified and made more accurate. The budgeting and accounting of IT services and their components is a critical activity in IT planning and operations, and the provision of trustworthy information goes a long way toward ensuring that the organization gets a beneficial return on its investment by making the right financial decisions.

To ensure that all key production assets are effectively managed, organizations should invest in the right CMDB solution that can discover all different IT asset types across a variety of platforms as well as cloud resources on all the major providers, without requiring the needless hassle of installing agents.

Problem management

The ITIL 4 problem management practice identifies and analyzes errors in products and services to reduce the likelihood and impact of incidents caused by them. The objective is to prevent incidents from happening, minimize their impact, or eliminate their recurrence. Without an effective problem management practice, organizations are likely to always remain in firefighting mode, wasting effort on patchwork activities that don’t eliminate repeat outages and service degradation.

The CMDB is a critical aid to problem management since this is an investigative and analytical process that requires the right data to make informed decisions on eliminating the causes of incidents. The role of the CMDB in the three phases of the problem management practice includes the following:

1. Problem identification: Two main approaches for problem identification exist: reactive problem management by identifying the symptoms and causes of incidents and proactive problem management by identifying problems before they cause incidents. In both cases, the CMDB is a rich source of information for identifying CIs that have been affected by incidents.
2. Problem control: Here the focus is on the analysis of problems to determine their root causes, where an analyzed problem is termed a known error. Problem analysis uses CMDB information about the product/service architecture and configuration item to identify CIs that are likely to cause the relevant incidents. For example, a problematic server could have a certain OS patch that generates errors that disrupt the working of hosted applications. Problem control results in recommendations for workarounds and permanent fixes.
3. Error control: The key outputs of this phase are improvement initiatives and change requests used to initiate the resolution of problems through the deployment of workarounds and permanently fixing errors in CIs. This may involve the replacement of faulty modules or the deployment of software patches to fix errors. The CMDB serves as a reference point that planners for the improvement or change can use to pinpoint dependent CIs that would be impacted by the error control activities.

The incident management practice is closely related to problem management, and its interaction with configuration information includes the following:

• Impact analysis: Analysis of the impacts of incidents on resources, products, services, and users
• Cause and effect analysis: Localization of failed Cls based on information about their impacts
• Risk analysis: Analysis of the expected impacts of developing incidents
• Cost allocation: Allocation of costs of supporting cost centers and/or customers
• Availability analysis and planning: Assessment of service availability during incidents and workaround planning

Another related practice in this domain is the monitoring and event management practice that is vital for identifying events and alerts from CIs that point to sources of errors or validating error control efforts.

Infrastructure and platform management

The ITIL 4 infrastructure and platform management practice ensures that an organization has high-quality IT infrastructure that efficiently meets its current and future needs. This is vital for the success of the organization’s digital services and digitized business processes. The focus here is on the organization’s own physical and digital infrastructure as well as infrastructure that may be provided as managed services from a third party such as a public cloud provider or an internet service provider.

Visibility of infrastructure and platform CIs deployed in an enterprise’s chosen environment is key, especially given that 87% of organizations adopt a multi-cloud strategy, according to Flexera’s 2023 State of the Cloud report. The right CMDB solution provides this visibility, discovering physical and virtual infrastructure in both on-premises and cloud environments. 

The attributes and relationships captured within the CI records are essential information that cuts across all activities of the infrastructure solutions lifecycle, including planning, design, development, delivery, maintenance, and support. Tracking infrastructure and platform configurations that have dependencies with other CIs ensures that those involved in managing these elements have the right information to maximize their value in the IT environment.

CMDB cloud resources (Source: Device42)

The availability management practice relies heavily on the CMDB’s information to support the infrastructure and platform management practice. Here, the key purposes of the configuration information include:

• Impact analysis: Analysis of the impacts of events and changes on the availability of resources, products, and services as well as the impacts of unavailable resources on products and services

• Cause and effect analysis: Identification of the causes of product and service unavailability
• Risk analysis: Analysis of availability and unavailability risks
• Cost allocation: Allocation of the costs of enhanced availability measures to cost centers and/or customers
• Availability analysis and planning: Analysis and planning of product and service availability

Other related ITIL 4 practices that rely on infrastructure and platform management configuration information include capacity and performance management and architecture management. Infrastructure and platforms must have the right capacity to meet evolving business demands and expected service levels, so the CMDB has to have the right information on CI dependencies to support effective planning for capacity. For organizations that require aligning their infrastructure and platform roadmaps to the business strategy, the CMDB provides the relevant information that the enterprise architecture relies on for identifying the current architectural state.

CMDB in other ITIL 4 practices

In truth, as long as a resource can be individually managed, it will always be referenced as a CI within the CMDB. This means that the application of the CMDB as a record source for all ITSM resources can find some relevance within any of the 34 ITIL 4 practices. 

Examples of some of the other practices that would utilize the CMDB include:

• Service desks: Configuration information within the CMDB can be referenced when a service desk agent is handling a user query. For instance, a chatbot can query the CMDB to respond to a user, asking whether a certain app is compatible with that user’s device.
• Knowledge management: The CMDB would be acknowledged as one of the organizational information management systems and would be referenced as a repository for explicit and structured records related to configuration items.
• Continual improvement: Whenever an improvement initiative related to IT products or services is recorded, the CMDB is referenced to determine the related CIs that will be impacted by that improvement.

Recommendations

The ITIL maturity model is an excellent approach to improving ITSM capabilities through the adoption of ITIL 4 best practices. One of the key elements of high maturity is the deployment of integrated information systems that allow the flow of information to support relevant ITIL 4 practices collaboratively. The right CMDB provides this capability through CI records that can be referenced by modules of other ITIL practices. Automated discovery and modeling CIs alongside their attributes and dependencies play a big role in supporting ITIL practices with the up-to-date information required for effective decision-making in IT service delivery.

Ensuring that the CMDB scope is well-defined is an important activity as organizations walk the ITSM improvement journey. For the ITIL 4 practices to reach the highest level of maturity, the scope of the components within the service management system should be defined according to their usefulness and efficiency. By investing in a CMDB solution that allows one to define the scope of discovery, priority systems and infrastructure can be focused upon so that the relevant records are provided to the ITSM processes when required.

Last thoughts on ITIL CMDB implementations

Extracting full value from an organization’s adoption of ITIL 4 best practices requires a comprehensive knowledge base of the service components and associated dependencies. The CMDB is irreplaceable within the confines of any IT function that seeks to reach the highest maturity of ITIl 4 practices. It is an essential repository of IT systems information that enables the practitioners of ITIL 4 to better understand their service environments and apply the guidance to ensure service delivery excellence. Investing in the right CMDB solution can make all the difference in IT service management best practices.