IT Operation Management’s .

Foundation of Power:.
The Configuration.
Management Database.
The root of ITOM is the
CMDB, the foundation of the
ServiceNow platform.
 CONTENTS
IT Operation Management’s Foundation of Power:
The Configuration Management Database

INTRODUCTION C ORRECTNESS IN YOUR

04/05 CMDB
14/15

C M D B F O U N DAT I O N 1 : C M D B F O U N DAT I O N 1 :
COMPLETENESS C OMPLIANCE
06/07 16/17

GOVERNING COMPLETENESS GOVERNING COMPLIANCE

08/09 18/19

C OMPLETENESS IN YOUR
C OMPLETENESS IN YOUR CMDB CMDB
10/11 20

C M D B F O U N DAT I O N 2 : ENSURING CMDB

CORRECTNESS STRUCTURE
12/13 21

GOVERNING CORRECTNESS ABOUT ACORIO

14 22
 INTRODUCTION

IT Operation Management’s Foundation of Power:

The Configuration Management Database

The root of ITOM (IT Operations Management) is the CMDB (Configuration

Management Database), the foundation of the ServiceNow platform. As the
underlying database powering everything from Asset Discovery to Agent
Intelligence, you can think about the CMDB as the foundation of ServiceNow’s
power – or at least one of the foundational elements.

Despite the importance of a healthy CMDB, we see so many ServiceNow

customers have a CMDB that is plagued by issues that prevent it from providing
the desired organizational value. This is not a problem that just affects
ServiceNow - customers of many different competing platforms have these same
obstacles. In fact, Forbes magazine asserts that an astonishing 85% of CMDB
projects fail.

For something powering ServiceNow transformation at organizations globally,

those odds just weren’t good enough.

At Acorio, we decided we needed to even those odds. Our IT Operations

Management practice has spent decades focused on CMDB success, and creating
baseline success metrics to ensure that all customers can maximize their CMDB to
power change (or, at minimum, prevent a lot of needless headaches).

This eBook starts at the beginning, focusing on “Three C’s” central to powering
successful CMDB programs: Completeness, Correctness, and Compliance.

Breaking down the three C’s will expose the core of what makes a healthy CMDB,
and highlight what exactly it takes to create a successful foundation within the
ServiceNow platform.

COMPLETENESS. CORRECTNESS. COMPLIANCE.

ServiceNow is
Getting Proactive 5
about CMDB Project
Governance.
In light of the somewhat dismal
historic CMDB outcomes,
ServiceNow has taken a number
of steps to proactively address
CMDB project complications.
They are the first vendor in the
market to offer a CMDB Health
reporting, and even added a
remediation application in 2016’s
Helsinki launch to support the
governance process for clients
Configuration Management.

Starting with the Helsinki release

of ServiceNow, the platform has
also included a CMDB Health
application. These contain
Key Performance Indicators
(KPIs) for recommended fields,
required fields, audits, duplicates,
orphans, and staleness.
 COMPLETENESS

Completeness
lets you see
what your
gaps are so
that you can
take the next
appropriate
steps.
 7

CMDB Foundation 1:
Completeness
As you might have guessed, your CMDB “Completeness” measures the gaps in
your IT data. You can translate that into answering the question, “Do I have all of
the data I need to track or accomplish my business outcome?”

Completeness lets you see what your gaps are so that you can take the next
appropriate steps -- You can’t build a report to show your current debt from
technology spending if you don’t have the data on how much you owe. (We also
recommend that the data is correct - but more on that in a minute!)

Ensuring the completeness of your CMDB also empowers more robust reporting
and is a prerequisite to configure applications such as Service Mapping.

Speaking from personal experience, I can tell you that from a completeness
perspective, it’s ok to be wrong as long as you are consistent. For example, It’s
fine to have an abbreviation in your system – say NY rather than “New York” - as
long as it’s consistently entered. Your database won’t intuitively know that NY and
“New York” are the same thing when searching for PC’s in Manhattan.
 GOVERNING COMPLETENESS

8
When it comes to completeness of your CMDB, remember that incomplete data
can have a significant downstream impact to the other ServiceNow applications.
Every time you create an incident, problem, or change, your database will pull
from a specific Configuration Item (CI). You want to ensure your CMDB is both as
complete as possible and also constantly maintained – so that one missing or
mis-entered CI, doesn’t inadvertently alter others.

Governing Completeness

Here’s the good news - You get to define what completeness means to your
organization. And by that, we mean that you can decide what fields in your
incoming forms are absolutely required and which fields are recommended (and
will occasionally be ignored).

To govern how complete your CMDB ultimately needs to be, you need to identify
key stakeholders who will have a vote (your IT and Asset Management teams, as
well as your CIO, and maybe Finance are good places to start). From there,
connect on what information your company really needs to track, and get buy-in
on what completeness will look like.

Expect this process to take a bit of time, and be aware that these Completeness
Governance conversations might also open the door to integrations with systems
such as SCCM or Cisco Call Manager to help maintain your PC and phone data,
respectively.

As you determine what ‘complete’ means to you and your organization, you
should also assign who will be responsible to inspect and maintain your critical
data points during this process and on an ongoing basis. (Trust us, if you decide
on data governance, and then never look at your data again, it will inevitably
degrade!)

We know that completeness can be daunting when you start, since there are likely
many gaps in your existing records and processes. So, make it easier on yourself!
Break it into manageable chunks, so that it doesn’t feel like you are trying to
swallow the ocean in one gulp.
 9

We recommend the first step of your project, usually called the “Define Phase,” as
the time to create your initial completeness governance policy. You might decide
that in your first CMBD phase you will:

1.
Identify what
2.
Prioritize
3.
Create policies
“complete” what data you and procedures
means. need to ensure to govern your
completeness at completeness on
your company. an ongoing basis.

Remember: For CMDB projects, the devil is in the details! You will likely want to
assign certain data as a "primary key" to ensure you aren't creating duplicate
records. Pick a unique identifier which will only exist in a single record, such as
a serial number. Later on, you will be glad you thought ahead, and you can use
these primary keys in more advanced ways. In this case, the serial number could
also be used for manually looking up and populating information such as make/
model or warranty information (in the IT Asset Management space).

THE DEFINE PHASE

 C OMPLETENESS IN YOUR CMDB

10

Completeness in your CMDB

Here’s where our completeness work gets tactical. Let’s say you’ve completed the
Define Phase of your Project (and identified what completeness means to you),
now you’re ready to get into the meat of your CMDB and review your data.

Here are some quick wins to help navigate your data completeness in
ServiceNow:

Data Reporting and

CMDB Health Dashboards
Create reports to identify which records are missing what
information. You can leverage the CMDB Health Dashboards or
create your own custom dashboard using any reports or filters you
have created. While there is some configuration required to use the
CMDB Health Dashboards, all of the tools are available to you Out of
the Box (OOB) as are all the reporting capabilities.

Long term, accurate data reporting or Health Dashboards can even

find and address gaps in your current ITSM/business processes,
CMDB integrations, and ServiceNow Discovery configurations.

Data Certification
Data Certification can be a powerful tool in that it will automate
task assignments to identified groups or users to remediate records
and also provides a level of information for tracking and auditing.
Even better, Data Certification can be scheduled to run at any
time allowing you the flexibility to run these jobs weekly, monthly,
quarterly and so on.

Full disclosure: setting up your Data Certification processes may

take some additional up-front work required but can be invaluable in
enforcing your completeness policies. We specifically like its power
to identify incomplete records and assign tasks to individuals (say,
the people you assigned as responsible for data completeness in your
Define project Phase).
 11

Deploying OOB ServiceNow

functionality
Leveraging some out-of-the-box ServiceNow functionality as you roll out your
ServiceNow platform or upgrades can also help maintain the completeness of
your CMDB.

• Once you know your critical data needs, make those fields mandatory
when your team creates a new record or updates an existing record.

• Similarly, if you don’t want people to mess up your data, define “read
only” for users that you want to have only updated by ServiceNow
Discovery or data imports.

• Business rules, UI policies, or client scripts are also useful for allowing
staff to update fields based on a set of conditions. (For example, creating
an onChange client script so that when the state of a CI is updated from
“Installed” to “In Stock”, the “Assigned to” field is cleared out – since we
assume someone has actually now installed the item.)

The CMDB can be daunting but with governance and leveraging ServiceNow’s
OOB tools, it can be easily maintained.

D ATA C O M P L E T E N E S S C O N T I N U E D
 CORRECTNESS

12

Once you have determined how much information you need to populate your
CMDB, you arrive at our second critical “C” for CMDB success: Correctness. This
second step of CMDB analysts begs the question, “How accurate is the data in
your CMDB?”

Correctness is important for one obvious reason: Good data just makes
everything better - it establishes trust with your stakeholders, creates more
efficient processes and allows you to conduct better analysis. As you can imagine,
the converse is also true, mistakes in your data, the wrong CI assigned to a Change
Request, and a random decimal point here or there can make a huge impact.

If you agree that accurate data is a critical element to success in your CMBD, you
might then wonder how to get there? Creating a correct CMDB mostly requires
care and feeding – and the ongoing maintenance of the CMDB.

CMDB Foundation 2: Correctness

 13

Pro CMDB Tip:

Don’t underestimate the importance of trust. Maintaining a high level of
Correctness and believing your data means your company can leverage more
“advanced” ServiceNow solutions, such as automation and Event Management.
This will allow creation of workflows to automate otherwise manual tasks or
notifications (some of which can tie back into Incident and Problem, all using
your CMDB data)! Selecting the correct CI(s) for these tasks enables a review of
the who, what, when, why, where and potentially how of an issue, so that you
can identify the impact of a Change, Incident or Problem. …But that can only
happen if you have confidence in the original data. Hence, you can start to see
how having a correct CMDB can really empower your organization.
 GOVERNING CORRECTNESS

14

Governing Correctness
Just like your Completeness parameters, you will need to define what “Correct”
means to your company.

You have already made some good progress by outlining the governance process
we reviewed in our first “C” – Completeness. Ensuring your database doesn’t
include duplicate CIs, that your Discovery is implemented properly, that new CIs
are added correctly and existing CIs are accurately updated are all essential
elements of maintaining CMDB Correctness.

While the data people are entering into your CMDB is extremely important, in
many cases, your day-to-day business processes are equally important for
ensuring data correctness. To guarantee your process in delivering clean data,
establish functionality to audit so that clean data entry processes are being
followed, and allow users to identify incorrect data and request changes.

Correctness in your CMDB

While the CMDB requires constant management, ServiceNow makes it easier

than ever to look into your CMDB. By maintaining a high level of Correctness in
your CMDB, you are able to take advantage of your data and make it your data
work for you – not the other way around.
 C ORRECTNESS IN YOUR CMDB

15
Here are some ways to ensure
that maintenance happens in
ServiceNow:

Leverage the CMDB Health

Dashboard
This is a huge bonus over competing solutions because it allows you
to customize your Dashboard configuration, and provides actionable
visibility into issues that will disrupt the completeness and health of
your CMDB.

Report, and then Report Some More

Reporting can supplement your CMDB Health Dashboard, as well
as identify other data quality issues, such as data normalization
opportunities.

For example, you might create a report to explore your Hardware

inventory, only to discover you have duplicative models listed: HP
6300 Pro and HP Pro 6300, or Adobe Photoshop CS and Adobe
Photoshop Creative Suite. Using reporting, you can identify these
anomalies and with data normalization, you can standardize your
naming schema and continue on your upward trend of Correctness.
 COMPLIANCE

16

CMDB Foundation 3: Compliance

Our final “C” of CMDB success is compliance. This is a measure of how well your
data aligns of your organization’s data standards, as well as the standards of
external auditors for regulated industries. To assess your CMDB complains, you
want to ask yourself: “Does my CMDB meet our configuration standards, and
does it match our what our IT environment actually looks like today?”

To evaluate how compliant your data is, you will essentially compare your CMDB
data using audit rules, and then come up with a list (or % disparity) for how much
of your information is in compliance vs. how much of it breaks your audit rules.
This will also help you determine how you measure up against your company’s
internal compliance standards, or assess how well you are aligned with external
regulatory standards like PCI and SOX.

Truth be told… configuration compliance has always been the “Nirvana” state of
CMDBs, and one that is usually only obtained with high levels of data maturity.
Historically, many organizations have struggled to achieve full CMDB compliance
because, well, maintaining perfect CMDB is hard, and some of the pitfalls we
discussed earlier have (to date) prevent them from reaching this state regardless
of platform. For example, your data has to be both “complete” and “correct,” to
ensure it won’t give false readings on data audits.
 17

This Compliance Nirvana seemed out of reach of many organizations, that is,
until ServiceNow’s release into CMDB Health in with the Helsinki release in Fall
2016. This new CMDB Health launch has rolled out significant advances such
as Scripted Audits, meaning you can tailor the audits to be more flexible to your
organization. All of that now means that organizations of all size – yes, even you –
can increase compliance, conduct actual state alignment validations, and realize
a CMDB “gold standards” to reduce fraud, waste, and abuse, and save money!
 GOVERNING COMPLIANCE

18
Governing Compliance
Defining compliance processes and tools that let you know you’re in compliance
are critical. Having internal compliance standards also drives maturity as well as
efficiencies with organizations for governance and processes. Most organizations
face one or two regular external compliance audits, which affect everything from
the organization’s services and infrastructure. Failing an external audit can be
both expensive, and potentially catastrophic!

To govern your CMDB compliance, follow a few essential steps:

STEP ONE

1
Start by defining what you need to comply with,
which, in most cases will be the industry compliances
your company has to adhere to (ex: Financial, Medical,
Educational, etc.).

STEP T WO

2
Prioritizing those steps to ensure you focus on the
most business-critical items.

STEP THREE

3
Work with the relevant teams in your business
to validate your priorities and data processes
against the compliance controls you have to focus
on. Understanding organizational readiness and
dependencies are critical to successful audits and
remediation.
 STEP FOUR 19

4
Define internal compliances that will help drive cost
saving, mature processes, and realize operational
efficiencies. (Examples here might include “Gold
State” infrastructure requirements, data accuracy
(correctness) validation audits, or process audits.) 

STEP FIVE
Create a business plan and maturity
roadmap on how to get from where
you are today to where you need to be.
This roadmap should take into account
the people, process, and technology
5
required, and include an assessment
of your company’s readiness at each of
those levels. 

STEP SIX
Make sure you plan for both external and internal

6
audits. (With a few modifications, you should be able
to use the same plan to achieve both internal and
external compliance, as success with external audit
compliance should mean you’ve met most of the
common practices you need to successfully navigate
an internal one.)

Remember: Your maturity roadmap plan should include what platforms you need
to achieve your goals. If your company already has ServiceNow as a platform to
your transform business, it’s a good bet that applications like IT Governance, Risk,
Compliance and the CMDB will be a part of the solution!
 C OMPLIANCE IN YOUR CMDB

20

By now, you have defined your CMDB compliance process, as well as the audits,
controls, reports, and governance you need to bring it to life. It’s time to marry
your new strategy with your current ServiceNow instance. Here are a few
recommendations to bring it all together:

Use your CMDB Benchmark Leverage

for Remediation
Remediation tasks can
leverage automation help
bring efficiency, costs
savings, and compliance
to your CMDB and your
company, so it makes sense
to leverage these tools as a
base for your compliance
applications
Important: Before you
start automating your
remediation rules, make
sure you have the right
governance and people
controls in place to validate
remediation actions, and
mitigate any risk this
automation might create. If
you are worried about your
organizations’ readiness for
this kind of automation,
ease into it, and let your
confidence grow with each
successful test.
against your ServiceNow’s IT
ServiceNow Governance, Risk,
and Compliance
Peers application for
Compare your IT Business
commonplace compliance’s
performance against your
Management
peers with the ServiceNow (if you have it) One
Benchmarks application of the best tools to
to know where your empowering a broader
company stands. Using corporate compliance
the comparative data umbrella in organizations
available in ServiceNow’s is the ServiceNow IT
Benchmarks will also keep Governance, Risk, and
you CMDB in compliance Compliance application for
with ServiceNow CMDB IT Business Management.
Health Compliance Of these, the ServiceNow
requirements. Compliance application
specifically enables you to
conduct compliance audits
against data in ServiceNow
and the CMDB. Further,
the CMDB Health
Application leverages
the audit results of the
Compliance application
to validate if a CI is
“Certified” in compliance
or “Failed” and in breach of
a compliance audit.

Our Recommendations
 ENSURING YOUR CMDB STRUCTURE

21

Ensuring an Enduring CMDB Structure   

We hope this has established a strong argument convincing you how

critical a foundation the CMDB is for your ServiceNow ITOM – and really,
overall platform success.

With the amount of weight your CMDB will carry, you need to ensure it’s
built to sustain everything that relies on it. Keep your CMBD up to code by
following Acorio’s three C’s of CMDB Health: Completeness, Correctness,
and Compliance.

Just like a foundation can settle over time if not properly maintained, so
too can your CMDB without proper care. Leverage the suggestions explored
above, as well as tools like a CMDB health check to proactively maintain
your CMDB and prevent your company’s CMDB foundation from settling.

Please reach out and engage Acorio if you have any questions. We would
love to partner with you to ensure your CMDB foundation is as its highest
potential and stays that way.
 ABOUT ACORIO

22

Who We Are
Acorio is a cloud consultancy, transforming operations and customer
processes with ServiceNow. We combine inspiration and guidance with
deep practice leadership, agility and a relentless focus on customer
excellence.
• A Global Top 5 Partner in ServiceNow Certifications
• History of Industry-Leading CSATs
• Employer of Choice with the Best Talent in the Business
• Innovative ServiceNow Solutions, including ServiceNow Certified
Catalyst Program
• ServiceNow Gold Services, Gold Sales, Bronze Technology and
Authorized Training Partner

Call us today at 1-866-333-8768 or contact us at acorio.com.

THANK YOU