01 · 6 questions
1 Configuration Management Governance
Checks the policy and scope, the configuration management plan, the process owner's authority, roles, interfaces with other practices, and the use cases that decide what the CMDB must hold.
IT Service Management Assessment
Configuration Management Maturity Assessment
Evaluates configuration management maturity across governance, the configuration model and CMDB design, CI identification, configuration control, baselines and secure configuration, discovery and service mapping, status accounting, verification and data quality, process integration, and improvement.
Already have an account? Log in to start
Who it is for
- Process Owner/Full Model Assessor
- ITSM Process Owners
- Infrastructure and Cloud Operations
- Application and Service Owners
- IT Asset, Security and Audit
Configuration Manager / CMDB Owner / ITSM Process Owner / IT Operations Manager. Secondary: Change, Incident and Problem Managers, Infrastructure and Cloud Leads, Service and Application Owners, IT Asset Managers, Security and IT Audit.
What you will gain
Shows where configuration data is incomplete, uncontrolled, stale or unused, and which controls from COBIT, ISO/IEC 20000 and NIST are missing. Turns configuration management from a data upkeep burden into a trusted base for faster incident resolution, safer changes, stronger security and clean audits.
About this assessment
The CMDB is often the most talked-about and least trusted database in IT. Configuration data lives in spreadsheets that leave with their owners, discovery runs but is never reconciled, changes bypass the CMDB, and nobody can say which services a failing server supports. When configuration management works, incidents are routed and diagnosed faster, changes are assessed against real dependencies, security teams know what they are protecting, and audits are answered from records rather than scrambles.
This assessment follows the configuration lifecycle in ten domains. It starts with the policy, plan, ownership and use cases that give the practice direction, and the data model that defines CI types, attributes, relationships, identification rules and the right level of detail. It then covers how CIs are identified and registered, how configuration records are controlled through change, how baselines, secure settings and the definitive media library are managed, and how discovery, reconciliation and service mapping keep data current. It goes on to status accounting and reporting, verification, audit and data quality, and how incident, change, problem, security and continuity work actually use the data, and ends with training, measurement and improvement.
The model reflects every COBIT 2019 BAI10 activity, the configuration management requirements and guidance of ISO/IEC 20000-1 and 20000-2, the NIST SP 800-53 configuration management controls and related CIS and ISO/IEC 27001 controls. Each question is scored on Documented, Implemented and Effective, exposing rules that exist on paper only, data kept accurate by a few individuals, and controls that run but are never measured.
What we assess: 10 domains
Each domain is a group of related questions, scored on its own and rolled up into your overall result.
02 · 8 questions
2 Configuration Model and CMDB Design
Evaluates the CMDB strategy and architecture, CI definition and types, attributes, relationship types, identification and naming rules, level of detail by criticality, federation and data authority, and whether the tool supports the model.
03 · 8 questions
3 CI Identification and Registration
Assesses how CIs are populated and classified, CI ownership, recording services as CIs, handling CIs discovery cannot find, software and license CIs, and alignment with the IT asset register.
04 · 8 questions
4 Configuration Control
Looks at access control over configuration records, change-linked updates, review of proposed changes against baselines, data validation, relationship upkeep, lifecycle status, decommissioning and detection of unauthorized changes.
05 · 5 questions
5 Baselines and Secure Configuration
Evaluates approved configuration baselines, baseline change control, secure configuration settings and drift checks, the definitive media library and updating configuration information after deployment.
06 · 6 questions
6 Discovery, Reconciliation and Service Mapping
Checks automated discovery, coverage and frequency, identification and reconciliation rules, exception handling, service mapping and the handling of short-lived cloud and container resources.
07 · 5 questions
7 Status Accounting and Reporting
Assesses status accounting against baselines, change history and audit trail, stakeholder reporting, self-service access to configuration information and on-demand audit evidence.
08 · 7 questions
8 Verification, Audit and Data Quality
Looks at quality targets, verification against the live environment, physical existence checks, deviation remediation, duplicate control, feedback from daily use and independent configuration audit.
09 · 5 questions
9 Process Integration and Consumption
Evaluates how incident, change, problem, security, continuity and capacity work use configuration data to make faster and safer decisions.
10 · 7 questions
10 People, Measurement and Improvement
Checks training, cross-team awareness, the KPI framework, consumption and value measurement, the improvement register and yearly maturity review.
KPIs to track
Measures that show whether the improvements hold.
| KPI |
|---|
| CI Accuracy - Share of sampled CIs matching the live environment. Target: 95% or more. |
| Discovery Coverage - Share of in-scope infrastructure discovered automatically. Target: 90% or more. |
| Data Completeness - Share of mandatory CI attributes populated. Target: 95% or more. |
| Ghost and Unrecorded CI Rate - Share of CIs recorded but absent, or present but unrecorded. Target: under 3%. |
| CMDB Consumption - Share of major ITSM processes actively using CMDB data. Target: 100%. |
Framework alignment
Questions are written in plain language and mapped to:
- COBIT 2019
- ISO/IEC 20000-1:2018
- ISO/IEC 20000-2:2019
- NIST SP 800-53 Rev. 5
- NIST SP 800-128
- CIS Controls v8.1
- ISO/IEC 27001:2022
- ISO 10007:2017
- ITIL 4
- ISO/IEC 42001:2023
- NIST AI RMF 1.0
- NIST SP 800-218
- ISO/IEC 5962:2021
- NIST SP 800-53 Rev 5
Works best with
Practices this assessment relies on. Assessing them too gives a fuller picture.
Change Management: CI updates, baselines and impact analysis depend on authorized, recorded changes.
IT Asset Management (v6.9.6): asset, license entitlement and physical verification records come from the IT Asset Register and Software Entitlement Register.
Discovery Tooling and Network Access: automated discovery and service mapping need deployed tools and visibility across environments.
Information Security: secure configuration and security use of configuration data need security partnership.
Recommended: Complete the Change Management, Incident Management, IT Asset Management and Service Level Management assessments for ITSM context.
Written by ITSGovernance.com
What you get
Maturity scores
An overall score and a score for each of the 10 domains.
Gap analysis
A clear view of where current practice falls short, and why it matters.
Improvement recommendations
Prioritized next steps to move each area to the next level.
Detailed report
Results you can share with leadership and track over time.
See where you stand on Configuration Management Maturity Assessment
Register, take the assessment, and get your maturity score with a clear improvement roadmap.
Start Measuring Your Maturity Today
Assessment Platform
Contact us
-
Business Bay, Dubai, UAE
-
info@itsgovernance.com
-
+971 586 697 263
Get Started
© 2026 ITSGovernance, part of SMCE. All rights reserved. Cookie settings