CM Audit

This is an internal CM Audit questions and answers.

Configuration Management Objective Definition

CM is the process that identifies and maintains the record of all registered configuration items and their related attributes.

The overall goal of CM is to build and maintain the Configuration Management Database.

The CMDB will be used as the organization's "Single Source of Truth" for applications and servers.

It will be used for controlling, identification and management of company computers, network, software and related documentation.

The purpose of CM is to provide accurate accounting of IT assets. CM strives to provide historical CM and CIs for environment restoration and legal requirements.

Configuration Management Security Approach or Design

The CMDB security model should be flexible enough to define permissions on the CI level.

For instance, owners of the servers should be able to edit CI for servers.

The CM process has four distinct activities.

CM Process Activity	Description
Identification	Is the process of defining the attributes of a configuration item? These attributes are recorded in the configuration management database and baselined. Baselining allows for formal change control processes to govern the changing of software and systems.
Control	Is a set of processes and approval stages required to change an attribute of a configuration item and to rebaseline them?
Reporting	Is the reporting function that allows the owners and users of the CMDB information to manage and control their applications and systems?
Audit	Is the processes that govern the verification of the configuration management items that reside in the CMDB?

Configuration Management Resources Definition

• Personnel
• Equipment
• Budget

Configuration Management Monitoring Process

specifically how do we monitor the Configuration Management to ensure fulfillment of objectives

CM Roles and Responsibilities

specifically any relevant document: meeting agenda, meeting minutes, other

CM Role	Responsibilities
CM Sponsor	Responsible for the overall execution of the process. Responsible for review and approval of any changes to the process.
CM Manager	Responsible for the day-to-day execution of the process.
CM Participants	Perform the required activities for the CM process.
Verification	CM Audit

Configuration Management Program

• Implementing the CMDB as the single source of truth
• Implementing the CMDB as the single source of truth
• Configuration Management Audit Reports and follow-on Actions (the Configuration Management in house audits)
• Perform scheduled internal CM audits.