What does CMDB stand for?

CMDB stands for configuration management database. It is the data store in which an organization records its IT components as configuration items and maps the relationships between them. The term comes from ITIL and is used across IT service management, often referring to a federation of sources rather than one physical database.

What is a configuration item (CI)?

A configuration item is any element that has to be managed so that an IT service can be delivered: a server, an application, a database, a network component, a cloud resource, but also a contract or a runbook. Each CI has a unique identifier, attributes such as version and status, and relationships to other CIs. The organization itself decides which elements it tracks as CIs.

Is a CMDB required for ISO 27001?

No. ISO/IEC 27001 requires an inventory of information and associated assets with owners, but it prescribes no tool. A CMDB can supply the technical assets. It only holds the information and business processes themselves, the protection need and business ownership if it is extended for that purpose. Otherwise those details belong in a separate asset inventory that references the CMDB.

What is the difference between a CMDB and IT asset management?

IT asset management looks at IT assets as economic goods: procurement, cost, licenses, contracts, depreciation and disposal. The CMDB looks at the same objects technically: configuration, version and dependencies in operation. Both often share an identifier and overlap in scope. Neither carries, on its own, the link to protection needs, risks and controls that information security needs.

What is the difference between a CMDB and a CMS?

A CMDB is a database of configuration items and their relationships. In ITIL, the configuration management system (CMS) is the wider set of tools and data sources that brings configuration data together and can include one or more CMDBs. In practice, "the CMDB" often means exactly this federation: an ITSM tool at the core, fed from the directory service, virtualization and cloud accounts.

What does Rizzqo model alongside a CMDB?

Rizzqo models the compliance asset inventory: processes and services rated for confidentiality, integrity and availability, information assets rated for confidentiality, and beneath them the supporting assets that inherit the confidentiality rating and personal-data flag. The requirements that match an asset's category and subcategory appear on that asset.

What is a CMDB? Definition, CIs and ISO 27001

Key takeaways

CMDB stands for configuration management database.
The term comes from ITIL: in ITIL v3 the CMDB belonged to the Service Asset and Configuration Management (SACM) process, and ITIL 4 carries the task as the Service Configuration Management practice.
A CMDB holds configuration items and their relationships so that IT operations can analyze incidents and changes.
ISO/IEC 27001:2022 Annex A 5.9 requires an inventory of information and other associated assets with owners, but it does not prescribe a CMDB.
For financial entities, DORA Article 8(4) explicitly includes the configuration of ICT assets and the links between them.

What is a CMDB?

A CMDB is the data store in which an organization records its IT components as configuration items (CIs) and maps the relationships between them. It describes the IT landscape the way operations needs it. A CI is any element that has to be managed so that an IT service can be delivered. The relationships are where the value lies: "application A runs on server B", "server B sits in data center C", "service D uses database E". They are what let you ask which services an outage or a planned change will touch.

What a CMDB contains: configuration items in five classes

A CMDB holds CIs from several classes, each with its own attributes:

CI class	Examples	Typical attributes
Hardware	servers, clients, network components, storage systems	serial number, location, model, firmware level
Software and applications	operating systems, business applications, databases	version, license reference, installation location
Cloud resources	virtual machines, managed databases, storage	account, region, provider identifier
Services	email, ERP, customer portal	technical owner, service hours, dependencies
Documentation	runbooks, contracts, configuration records	version, validity, storage location

ITIL origins: SACM and service configuration management

The term comes from ITIL, the framework for IT service management. In ITIL v3 the CMDB belonged to the Service Asset and Configuration Management (SACM) process; ITIL 4 carries the same task as the Service Configuration Management practice. ITIL also separates the individual database from the configuration management system (CMS), which can bring several data sources together. In practice "the CMDB" is therefore often a federation: an ITSM tool at the core, fed from the directory service, virtualization, cloud accounts and network discovery.

The CMDB is the tool that makes configuration management usable in operations. Without the process behind it, meaning clear responsibility for creating, maintaining and retiring CIs, it becomes the next stale list.

How is a CMDB populated and kept current?

A CMDB is populated through three routes, which can be combined:

Automated discovery: tools scan networks, hypervisors and cloud accounts and create or update the objects they find.
Import from authoritative systems: the directory service, endpoint management, procurement and cloud APIs supply objects and attributes.
Manual maintenance: everything a machine cannot detect, such as business assignment, service context or responsible people.

The deciding factor is reconciliation: when two sources deliver the same object, it must be settled which source leads for which attribute. Without that rule you get duplicates, and trust in the data is lost faster than it was built.

CMDB or asset inventory: what is the difference?

A CMDB answers how the IT fits together. An asset inventory for the ISMS answers what is worth protecting, who owns it and which obligations attach to it. The populations overlap; the purposes do not. How both differ from commercial IT asset management is shown in the guide to IT asset management.

Criterion	CMDB	ISMS asset inventory
Purpose	incident, problem and change analysis in IT operations	basis for protection needs, risks, controls and evidence
Starting point	technical components and services	information and business processes, with the assets that carry them underneath
Typical objects	servers, applications, network components, cloud resources	also information, processes, sites, service providers, staff with key knowledge
Responsibility	technical custodian for each CI	business owner for each asset
Core attributes	version, location, dependencies, status	protection need per objective, owner, criticality, link to risks and controls
Maintained by	IT operations, ITSM team	information security together with the business units
What the audit asks	rarely the subject of an ISMS audit	completeness, owners, currency, link to risks

What does ISO 27001 Annex A 5.9 require of the asset inventory?

ISO/IEC 27001:2022, Annex A 5.9, in substance requires you to identify the organization's information and other associated assets, keep an inventory of them and assign an owner to each entry. The standard does not prescribe a format. A CMDB can therefore be part of the answer, provided it delivers what the ISMS needs:

The primary assets are recorded: information and business processes, not just technology.
Every entry has a business owner, not merely a technical custodian.
The protection need is classified per objective and passed down to the systems that carry it.
Dependencies between processes, applications and infrastructure can be traced.
Every asset is linked to its risks and controls.
New, changed and retired assets reach the inventory promptly, with a date and a responsible person.

What a CMDB covers of this

A CMDB is built for points four and six; it is not built for points one to three and five on its own. For financial entities DORA goes further: Article 8(4) of Regulation (EU) 2022/2554 explicitly includes the configuration of ICT assets and the links between them when those assets are identified. Here the CMDB becomes an important source, but not a substitute for classification and ownership. Which columns an asset inventory needs beyond that is shown in the IT asset inventory template.

Using a CMDB as a source for the ISMS in 5 steps

In five steps, the CMDB becomes a reliable source for the asset inventory without replacing it:

Set the object boundary: decide which CI classes are relevant to the ISMS. Not every network socket belongs in the asset inventory.
Carry the unique identifier: keep the CI identifier in the asset inventory so the two populations stay reconcilable.
Assign a lead per attribute: the CMDB leads on technical attributes, the ISMS leads on protection need and owner. Maintaining the same field twice ends in contradictions.
Reconcile regularly: a CI with no counterpart in the inventory is a finding, not a backlog item. It points to an intake route that is not working.
Close decommissioning on both sides: a retired system is closed out in both populations, not deleted, so the evidence survives.

Four common mistakes in CMDB projects

The common mistakes in CMDB projects lie in process and accountability, not in technology:

Completeness before use: if you try to capture everything before any process uses the data, you maintain a database nobody queries.
Discovery instead of accountability: automated discovery finds objects, but not owners or business purpose.
No link to change management: if changes do not update the CMDB, it ages with every approval.
Passing the CMDB off as the ISMS inventory: an audit exposes this at the latest when it asks who owns a particular piece of information.

Why inventories without a fixed intake go stale is explained in the article Why asset inventories go stale; how the inventory fits into building an ISMS, in the guide Implementing an ISMS.

Where Rizzqo sits next to the CMDB

Rizzqo models the compliance view a CMDB is not built for: processes and services carry a rating for confidentiality, integrity and availability, information assets a confidentiality rating. Supporting assets sit beneath them and inherit their confidentiality rating and personal-data flag, across several levels if needed. Asset category and subcategory are the key by which framework requirements appear on the asset; an owner and an assignee can be assigned. Coverage is computed from finalized answers, and risk from likelihood in percent and impact in euros. Existing inventories can be brought in through Excel import.

Browse all entries Back to top

CMDB