SMS-DOC-082-4 Configuration Management Process

Configuration Management Process

ISO/IEC 20000 Toolkit Version 8 ŠCertiKit

Configuration Management Process

Implementation Guidance (The header page and this section must be removed from final version of the document)

Purpose of this document This document describes how the service provider will manage configuration items related to the services.

Areas of the standard addressed The following areas of the ISO/IEC 20000:2018 standard are addressed by this document: 8.2.6 Configuration management

General Guidance This is a document that underpins the whole area of configuration management.

Careful thought needs to be given to what will be treated as a configuration item, what information will be recorded about it and how that information will be collected and kept up to date. Location information in particular can be tricky.

The other major issue is that of defining relationships between configuration items and with services. Unless you have a reasonably high-end ITSM software tool this can be difficult to achieve, and we would suggest you start with the most important IT services in your landscape.

Review Frequency We would recommend that this document is reviewed annually.

Toolkit Version Number ISO/IEC 20000 Toolkit Version 8 ©CertiKit.

Document Fields This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name”.

To update this field (and any others that may exist in this document):

Version 1

Page 1 of 23

[Insert date]

Configuration Management Process

1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name 2. Press Ctrl a on the keyboard to select all text in the document (or use Select, Select All on the ribbon) 3. Press F9 on the keyboard to update all fields 4. When prompted, choose the option to just update TOC page numbers If you wish to permanently convert the fields in this document to text i.e. so that they are no longer updateable, then you will need to click into each occurrence of the field and press Ctrl Shift F9.

If you would like to make all fields in the document visible then go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check that you have updated all fields correctly.

Further detail on the above procedure can be found in the Toolkit Completion Instructions.

Copyright notice Except for any third party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below.

CertiKit is a company registered in England and Wales with company number 6432088.

Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third-party copyright included in this document.

Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional

Version 1

Page 2 of 23

[Insert date]

Configuration Management Process

advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Version 1

Page 3 of 23

[Insert date]

Configuration Management Process

[Replace with your logo]

Configuration Management Process

Document Ref. Version: Dated: Document Author: Document Owner:

Version 1

Page 4 of 23

SMS-DOC-082-4 1 [Insert date]

[Insert date]

Configuration Management Process

Revision History Version Date

Revision Author

Summary of Changes

Distribution Name

Title

Approval Name

Version 1

Position

Signature

Page 5 of 23

Date

[Insert date]

Configuration Management Process

Contents 1

INTRODUCTION ....................................................................................................................................... 7 1.1 1.2 1.3

2

PURPOSE ................................................................................................................................................... 7 OBJECTIVES .............................................................................................................................................. 7 SCOPE ....................................................................................................................................................... 7

CONFIGURATION MANAGEMENT PROCESS.................................................................................. 9 2.1 PROCESS DIAGRAM ................................................................................................................................... 9 2.2 PROCESS TRIGGERS ................................................................................................................................. 10 2.3 PROCESS INPUTS ..................................................................................................................................... 10 2.4 PROCESS NARRATIVE .............................................................................................................................. 10 2.4.1 Planning........................................................................................................................................ 10 2.4.2 Identification of Configuration Items ............................................................................................ 10 2.4.3 Control .......................................................................................................................................... 13 2.4.4 Status Accounting and Reporting.................................................................................................. 13 2.4.5 Verification and Audit ................................................................................................................... 14 2.5 PROCESS OUTPUTS .................................................................................................................................. 14 2.6 ROLES AND RESPONSIBILITIES ................................................................................................................ 14 2.6.1 Configuration Manager ................................................................................................................ 14 2.6.2 Configuration Librarian ............................................................................................................... 15 2.6.3 Configuration Analyst ................................................................................................................... 15 2.7 RACI MATRIX ........................................................................................................................................ 15

3

CONFIGURATION MANAGEMENT TOOLS .................................................................................... 17 3.1 3.2

4

COMMUNICATION AND TRAINING ................................................................................................. 18 4.1 4.2 4.3 4.4 4.5

5

CONFIGURATION MANAGEMENT SYSTEM ............................................................................................... 17 AUTOMATED ASSET MANAGEMENT SYSTEM .......................................................................................... 17

COMMUNICATION WITH CHANGE MANAGEMENT ................................................................................... 18 COMMUNICATION WITH IT TEAMS .......................................................................................................... 18 COMMUNICATION WITH PROJECTS .......................................................................................................... 18 PROCESS PERFORMANCE ......................................................................................................................... 18 TRAINING FOR CONFIGURATION MANAGEMENT ..................................................................................... 19

INTERFACES AND DEPENDENCIES ................................................................................................. 20 5.1

INTERFACE TO FINANCIAL ASSET ACCOUNTING PROCESSES .................................................................. 21

6

REPORTING ............................................................................................................................................ 22

7

CONCLUSION.......................................................................................................................................... 23

List of Figures FIGURE 1 - CONFIGURATION MANAGEMENT PROCESS ................................................................................................ 9

List of Tables TABLE 1 - HARDWARE CI ATTRIBUTES ..................................................................................................................... 12 TABLE 2 - SOFTWARE CI ATTRIBUTES ...................................................................................................................... 12 TABLE 3 - DOCUMENTATION CI ATTRIBUTES ............................................................................................................ 13 TABLE 4 - RACI MATRIX.......................................................................................................................................... 16 TABLE 5 - PROCESS INTERFACES AND DEPENDENCIES .............................................................................................. 20 TABLE 6 - PROCESS KPIS ........................................................................................................................................ 22

Version 1

Page 6 of 23

[Insert date]

Configuration Management Process

1 Introduction 1.1

Purpose

The purpose of this document is to set out in detail the [Service Provider] process in the area of configuration management.

As such, this document will represent an initial design for the enhancement of existing configuration management processes and will be updated on at least an annual basis thereafter as [Organization Name] and its IT service management needs develop.

The overall goal is to define and control the components of services and infrastructure and maintain accurate configuration information on the historical, planned and current state of the services and infrastructure.

The achievement of this goal will require the population of a repository of asset and configuration information (the Configuration Management Database or CMDB) which is verified and kept up to date using an appropriate mix of technical and procedural controls.

1.2

Objectives

The objectives of the service asset and configuration management process are to: • • • •

1.3

Identify, record and control information about configuration items that have value to the organization Create and maintain a configuration management system (CMS) that holds useful information about CIs and their relationships e.g. baselines and snapshots Ensure that the CMS stays up to date in the face of change by working closely with the change management process Provide useful information about the status, attributes and relationships of CIs to other processes such as release and deployment management, change management and capacity management Scope

The scope of this process is defined according to the following parameters: • • •

Organizational o [List organizations and parts of those organizations covered] Geographical o [List locations from which requests for change will be accepted and managed] Services

Version 1

Page 7 of 23

[Insert date]

Configuration Management Process

•

o [Define the services covered by the process] Technical o [If necessary, cover the technology that may give rise to changes managed via this process]

The following areas are specifically excluded from this process: [Describe any areas that need to be clearly stated as outside the scope]

Version 1

Page 8 of 23

[Insert date]

Configuration Management Process

2 Configuration Management Process 2.1

Process Diagram

In overview the process of implementing configuration management consists of the following steps:

Planning

Identification

Control

Status Accounting and Reporting

Verification and Audit

Figure 1 - Configuration management process

Each of these steps will be described in the following sections of this document.

Version 1

Page 9 of 23

[Insert date]

Configuration Management Process

2.2

Process Triggers

The service asset and configuration management process is initiated as a result of one or more of the following triggers: • • • • • 2.3

Initiation of a project that requires the introduction or changing of CIs Requests from change management and release and deployment management Significant events such as an ITSCM or security incident Changes to legal, regulatory or contractual requirements In response to audit requirements Process Inputs

The process of service asset and configuration management requires a number of inputs in order to be able to function effectively. These may not always be available but will ideally be: • • • • • 2.4

Definitions of service asset and configuration management requirements from projects New configuration item details e.g. hardware manufacturer, model, serial number Requests for Change (RFCs) Audit records Hardware and software disposal records Process Narrative

2.4.1

Planning

The planning of configuration management within [Organization Name] will establish the following factors: • • • • •

The objectives to be achieved Resources to be allocated both for initial setup and for on-going operation of the process Tools to be used to identify, record, manage and report on configuration items Timescales Roles and responsibilities in the configuration management process

The plans will be managed via the service improvement process.

2.4.2

Identification of Configuration Items

Configuration Items (CIs) will be identified based on the following general principles:

Version 1

Page 10 of 23

[Insert date]

Configuration Management Process

➢ There will be three types of CI, namely hardware, software and documentation ➢ The level of CI will be determined according to the value of the information to the delivery of IT services ➢ The attributes recorded for each CI type will be determined based on a balance of usefulness and ease of maintenance The following attributes will be recorded according to the CI type: 2.4.2.1

Hardware

The following types of configuration items will be recorded (this list will be updated as further types of hardware items are implemented): ➢ ➢ ➢ ➢ ➢ ➢ ➢ ➢ ➢

Desktop hardware Monitors Laptops Printers Servers Firewalls Routers Switches Other

The attributes listed below will be recorded.

Attribute Asset Number Description Status Relationships Location/User Type Manufacturer Serial number Model number Supply Date Supplier Cost Purchase Order Number PO Date Invoice # Invoice Date Date of Installation Change Numbers Problem Numbers

Version 1

Description The asset number assigned to the CI A text description of the CI e.g. “Internet Router” Whether the CI is live, disposed etc.

How this CI is related to other CIs and service components The current user or location of the CI The type of hardware e.g. desktop, router, laptop The manufacturer’s name The unique manufacturers serial number The manufacturers assigned full product code The date the CI was supplied Where the CI was sourced from The costs of the CI when sourced Reference for the PO on which this CI was ordered Date of approval of the PO If known If known The date the CI was installed into the live environment The numbers of all change records affecting this CI The numbers of all problem and known error records affecting this CI

Page 11 of 23

[Insert date]

Configuration Management Process

Attribute Incident Numbers Comment

Description The numbers of all incident records affecting this CI A free-format text field for any relevant information

Table 1 - Hardware CI attributes

2.4.2.2

Software

All application software in use will be recorded as CIs in the CMDB. This includes server-based systems as well as desktop software such as office suites.

Attribute CI Name Description Status Relationships Supplier Version number DML Reference/location Supply Date Supplier Cost Date of Installation Maintenance/ Warranty Provider Maintenance/ Warranty Contract Number Maintenance/ Warranty Expiry Date Change Numbers Problem Numbers Incident Numbers Comment

Description The unique name by which this CI is known A text description of the CI Whether the CI is live, disposed etc.

How this CI is related to other CIs and service components The supplier’s name The manufacturers assigned version number e.g. R33 The reference of this software item within the Definitive Media Library The date the CI was supplied Where the CI was sourced from The costs of the CI when sourced The date the CI was installed into the live environment Which organisation provides maintenance/warranty services for this CI The contract number under which maintenance/warranty is provided The date the relevant maintenance/warranty ends

The numbers of all change records affecting this CI The numbers of all problem and known error records affecting this CI The numbers of all incident records affecting this CI A free-format text field for any relevant information

Table 2 - Software CI attributes

2.4.2.3

Documentation

It is essential that correct versions of documentation are used and updated when their subject material changes. Requests for change must include the consideration of documentation so that it remains relevant to the area it covers.

Attribute CI Name

Version 1

Description The unique name by which this CI is known

Page 12 of 23

[Insert date]

Configuration Management Process

Attribute Description Status Relationships Supplier Version number Reference/location Date of Installation Change Numbers Problem Numbers Incident Numbers Comment

Description A text description of the CI e.g. “Network Diagram” Whether the CI is live, disposed etc.

How this CI is related to other CIs and service components The supplier’s name (if supplied or internal if not) The version number of the documentation The location of this item of documentation within the filing structure The date the CI was accepted into the live environment The numbers of all change records affecting this CI The numbers of all problem and known error records affecting this CI The numbers of all incident records affecting this CI A free-format text field for any relevant information

Table 3 - Documentation CI attributes

2.4.3

Control

On-going control of the configuration items recorded in the CMDB will be exercised via the change management process. No CIs will be added, changed or removed unless the appropriate change management documentation has been completed and approved. Part of the change management process will be the updating of the CMDB to ensure that it remains current and always reflects a true record of installed items.

Installation of common items such as desktop PCs and laptops will be treated as service requests and there will be an interface between the procurement process and configuration management that ensures that items purchased are created as CIs when installed.

2.4.4

Status Accounting and Reporting

A set of reports will be regularly generated from the CMDB in order to provide management information on the status of Configuration Items. These reports will include: ➢ ➢ ➢ ➢ ➢ ➢

List of all configuration items by site Rack listings by server room CIs having incidents associated with them CIs having problems associated with them CIs having changes associated with them Discrepancies between the recorded status of CIs and that most recently discovered by the asset management tool

Ad-hoc reports will also be required to satisfy information requirements for support contracts. These may require the creation of new reports.

Version 1

Page 13 of 23

[Insert date]

Configuration Management Process

Other reports may be required for: • • 2.4.5

Equipment refresh programmes Financial or insurance purposes e.g. value of kit at a location Verification and Audit

An automated asset management software tool will be used to verify the hardware and software configurations of all CIs to which it has access. This exercise will be carried out on a monthly basis initially, with the frequency being adjusted according to the number of discrepancies found.

A programme of physical audits will be instituted to verify the data collected via the tool with the intention of visiting all locations within a specified period of time. This approach will be validated in the light of the results obtained – if the tool is found to maintain a very high degree of accuracy and completeness then the number of physical audits may be minimised. The IT service desk will also be used to verify data on an on-going basis when users report incidents.

Verification of CIs not covered by the software tool will be performed manually at least every six months.

2.5

Process Outputs

The outputs of the configuration management process will be the following: • • • • •

2.6

New and updated configuration records Configuration baselines Status and accounting reports Relationship information for use in assessing changes An accurate CMS that provides input to the wider service knowledge management system (SKMS) Roles and Responsibilities

The following roles will play a part in the configuration management process.

2.6.1

Configuration Manager

The overall responsibilities of this role are: • •

Implement the organisation’s Configuration Management (CM) process and standards Propose and agree scope of the CM processes, function, the items that are to be controlled, and the information that is to be recorded. Develop CM standards, CM plans and procedures

Version 1

Page 14 of 23

[Insert date]

Configuration Management Process

• •

•

• •

2.6.2

Arrange recruitment and training of staff. Train CM specialists and other staff in CM principles, processes and procedures Create and manage the CM plan, principles and processes and their implementation. This includes CI registration procedures, access controls and privileges. Ensure that the correct roles and responsibilities are defined in the CM plans and procedures Propose and agree CIs to be uniquely identified with naming conventions.

Ensure that staff comply with identification standards for object types, environments, processes, life-cycles, documentation, versions, formats, baselines, releases and templates Propose and/or agree interfaces with change management, problem management, network management, release management, computer operations, logistics, finance and administration functions Assist auditors to audit the activities of the CM team for compliance with laiddown procedures. Ensure corrective action is carried out Configuration Librarian

The overall responsibilities of this role are: • • • • • • •

2.6.3

Plan and execute population of the CMDB Manage and maintain the CMDB, central libraries, tools, common codes and data Ensure regular housekeeping of the CMDB Provide reports, including management reports (indicating suggested action to deal with current or foreseen shortcomings), impact analysis reports and configuration status reports Use or provide the CMDB to facilitate impact assessment for change requests and to ensure that implemented changes are as authorised.

Provide the CMDB to help identify other CIs affected by a fault that is affecting a CI Perform configuration audits to check that the physical IT inventory is consistent with the CMDB and initiate any corrective action Configuration Analyst

The overall responsibilities of this role are: • •

2.7

Perform configuration audits to check that the physical IT inventory is consistent with the CMDB and initiate any corrective action Follow documented procedures to ensure that CIs are created, updated and disposed of according to the configuration management process RACI Matrix

The table below clarifies the responsibilities at each step using the RACI method, i.e.:

Version 1

Page 15 of 23

[Insert date]

Configuration Management Process

R= Responsible

A= Accountable

C= Consulted

Role: Configuration Manager Step Planning A/R Identification A/R Control A Status Accounting and A Reporting Verification A

I= Informed

Configuration Librarian C C I R I

Configuration Analyst I I R I R

Table 4 - RACI matrix

Version 1

Page 16 of 23

[Insert date]

Configuration Management Process

3 Configuration Management Tools There are a number of key software tools that underpin an effective configuration management process. These are subject to change as requirements and technology are updated and so specific systems are not described here. However the main types of tools that play a significant part in the process within [Organization Name] are as follows.

3.1

Configuration Management System

The configuration management system (CMS) provides a way to store configuration records together with the attributes that are defined against them. It also allows relationships between CIs to be reflected so that a more effective impact assessment of changes can be made.

The CMS is interfaced with the incident, problem and change management tools so that records in each system can be linked together e.g. changes to a specific CI can be recorded and reported upon.

3.2

Automated Asset Management System

This system is capable of discovering assets located within the IT estate and automatically capturing key attributes of them such as their type, configuration and software versions. The automated asset management system works with the CMS to provide regular updates without the need to physically visit remote locations.

Version 1

Page 17 of 23

[Insert date]

Configuration Management Process

4 Communication and Training There are various forms of communication that must take place for the configuration management process to be effective.

These are described below.

4.1

Communication with Change Management

Configuration management effectively provides a service to change management so that the potential impacts of changes can be better understood. Configuration management will obtain feedback from change management about the accuracy and usefulness of the information provided so that any required improvements can be identified.

Change management also provides updates to the CMS on a regular basis and the smoothness of the interface should be a subject of frequent communication.

For both these reasons the configuration management process manager should be a regular attendee at Change Advisory Board (CAB) meetings.

4.2

Communication with IT Teams

Configuration management needs to communicate the importance of keeping the CMS up to date to IT support teams so that there is no temptation to bypass change management and avoid updating the CMS. This will be done via awareness sessions delivered during team meetings and via other appropriate methods depending on the need.

4.3

Communication with Projects

Project teams may need a significant degree of assistance with assessing and planning their configuration management requirements at the start of a project. This will depend upon the type and scope of the project but the configuration management process manager’s attendance at progress meetings may be useful to all parties involved.

4.4

Process Performance

It is important that the performance of the configuration management process is monitored and reported upon on a regular basis in order to assess whether the process is operating as expected. The content of performance reports is set out in section 6 of this document but it is vital that the reports are not only produced but are also communicated to the appropriate audience.

Version 1

Page 18 of 23

[Insert date]

Configuration Management Process

This will include the management of IT concerning resource utilisation and allocation.

Depending on the health of the process it may be appropriate to hold regular meetings with IT management to discuss the performance and agree any actions to improve it.

4.5

Training for Configuration Management

In addition to a well-defined process and appropriate software tools it is essential that the people aspects of configuration management are adequately addressed.

The process requires that training be provided to all participants in order that it runs as smoothly as possible.

The main areas in which training will be required for configuration management are as follows.

• • • •

The configuration management process itself, including the activities, roles and responsibilities involved Configuration management software tools such as the configuration management system The basics of the technology and how it is implemented within [Organization Name] The business, its structure, locations, priorities and people

Version 1

Page 19 of 23

[Insert date]

Configuration Management Process

5 Interfaces and Dependencies The configuration management process has a number of interfaces and dependencies with other processes within service management and the business. These are outlined here and are described in further detail in the relevant procedural documentation.

Process Budgeting and Accounting for IT Services Information Security Management Availability Management Capacity Management IT Service Continuity Management Release and Deployment Management Change Management Incident Management Problem Management

Service Request Management

Inputs to CM from the named process Requests for inventory and asset information Procurement information for new CIs Security requirements for access to the CMS Security policies Changes to CIs to improve availability (via change management) Advance notice of required changes to configurations for capacity reasons Requirements for control of key spares and software in an ITSCM situation Requirements for baselines and release packages Information about changes to CIs Incidents linked to CIs Problems linked to CIs

Service requests linked to CIs

Outputs from CM to the named process Reports for financial and insurance purposes Correct (unaltered) configuration information Reports on detected configuration changes Reports on single points of failure from CI relationship information Details of installed configurations and capacities Provision of key spares and other CIs needed during an ITSCM incident Tracking of CIs within releases and provision of the right versions of CIs when required Impact assessment of proposed changes Information about CIs for use in incident diagnosis Reports on CIs with many incidents against them Information about CIs for use in problem investigation Reports of service requests by CI

Table 5 - Process interfaces and dependencies

Version 1

Page 20 of 23

[Insert date]

Configuration Management Process

5.1

Interface to Financial Asset Accounting Processes

In line with recommendations by [Organization Name] internal and external auditors, there is a requirement to be able to provide to the Finance Department a listing of all hardware, software licenses and other assets installed within the organisation, together with its location. This information is provided in spreadsheet form on an annual basis.

Purchase order and value information must also be provided for all hardware installed after dd/mm/yyyy. This information is held within the CMDB and provided upon request.

Version 1

Page 21 of 23

[Insert date]

Configuration Management Process

6 Reporting The following KPIs will be used on a regular basis to evidence the successful operation of the configuration management process: KPI Ref. KPI1 KPI2 KPI3 KPI4 KPI5 KPI6 KPI7 KPI8

Key Performance Indicator Percentage discrepancies found during CMS audits Number of complaints about inaccurate CMS records User satisfaction with the CMS Percentage of incidents for which configuration information was available Number of successful impact analyses carried for change management Number of access of the CMS by problem management Number of configuration errors caused by inadequate protection of CIs Completeness of the definitive media library (DML)

Table 6 - Process KPIs

Version 1

Page 22 of 23

[Insert date]

Configuration Management Process

7 Conclusion Configuration management is a vital underpinning service that provides key information to other processes within IT service management. The mix of infrastructure and other components used to deliver our IT services is complex and it will require strict adherence to this process to ensure that a clear and accurate picture of configurations is maintained at all times.

Only by really understanding and documenting our environment can we continue to deliver existing services effectively whilst at the same time planning for the transition of new ones.

Version 1

Page 23 of 23

[Insert date]