DS09 Configuration Management

DS09: Configuration Management

1. Description

Identify and record all IT assets, their physical location, interdependencies and reliability history, and a regular verification programme which confirms their existence.

2. Control Objectives

Configuration Recording - Establish procedures to ensure that only authorized and identifiable configuration items are recorded in inventory upon acquisition. Moreover, procedures should be in place to keep track of changes to the configuration (new item, status change from development to prototype). Logging and control should be an integrated part of the configuration recording system including reviews of changed records,
Configuration Baselining - ensure that a baseline of configuration items is kept as a checkpoint to return to after changes,
Status Accounting - ensure that the configuration records reflect the actual status of all configuration items including the history of changes.
Configuration Control - ensure that the existence and consistency of recording of the information services function configuration is periodically checked,
Unauthorized Software - periodically check the organisation's personal computers for unauthorized software,
Software Storage - A file storage area (library) should be defined for all valid software items in appropriate phases of the system development life cycle. These areas should be separated from each other and from development, testing and production file storage areas.
Configuration Management Procedures - Critical components identified, demand management
Software Accountability - Identification, licencing, library management, audit trails, version numbering

3. Key Goal Indicators

Percent of IT configuration identified and accounted for
Reduction in number of variances between accounts and physical situation
Quality index of information, including interrelationships, age, changes applied, status and related problems criteria
Usage index of information for proactive actions, including preventive maintenance and upgrade criteria

4. Key Performance Indicators

Percent of configuration components for which data is kept and updated automatically
Frequency of physical verifications
Frequency of exception analysis, addressing redundancy, obsolescence and correction of configuration
Time lag between modification to the configuration and the update of records
Number of releases
Percent of reactionary changes

5. Critical Success Factors

Owners are established for all configuration elements and are responsible for maintaining the inventory and controlling change
Configuration information is maintained and accessible, based on up-to-date inventories and a comprehensive naming convention
An appropriate software library structure is in place, addressing the needs of development, testing and production environments
There exists a release management policy and a system to enforce it
Record keeping and physical custody duties are kept segregated
There is integration with procurement and change management processes
Vendor catalogues and configuration are aligned
Configuration baselines exist, identifying the minimum standard components and integration requirements, consistency and integration criteria
An automatic configuration detection and checking mechanism is available
An automatic distribution and upgrade process is implemented
There is zero tolerance for illegal software

6. Service Maturity Variations

0 Non-existent	Management does not have an appreciation of the benefits of having a process in place that is capable of reporting on and managing the IT infrastructure, for either hardware or software configurations.
1 (Initial/Ad Hoc)	The need for configuration management is recognised. Basic configuration management tasks, such as maintaining inventories of hardware and software, are performed on an individual basis. No standard practices are applied.
2 (Repeatable but Intuitive)	Management is aware of the benefits of controlling the IT configuration but there is implicit reliance on technical personnel knowledge and expertise. Configuration management tools are being employed to a certain degree, but differ among platforms. Moreover, no standard working practices have been defined. Configuration data content is limited and not used by interrelated processes, such as change management and problem management.
3 (Defined Process)	The need for accurate and complete configuration information is understood and enforced. The procedures and working practices have been documented, standardised and communicated, but training and application of the standards is up to the individual. In addition, similar configuration management tools are being implemented across platforms. Deviations from procedures are unlikely to be detected and physical verifications are performed inconsistently. Some automation occurs to assist in tracking equipment and software changes. Configuration data is being used by interrelated processes.
4 (Managed and Measurable)	The need to manage the configuration is recognised at all levels of the organisation and best practices continue to evolve. Procedures and standards are communicated and incorporated into training and deviations are monitored, tracked and reported. Automated tools are utilised, such as ‘push’ technology, to enforce standards and improve stability. Configuration management systems do cover most of the IT infrastructure and allow for proper release management and distribution control. Exception analysis, as well as physical verifications, are consistently applied and their root causes are investigated.
5 Optimized	All infrastructure components are managed within the configuration management system, which contains all necessary information about components and their interrelationships. The configuration data is aligned with vendor catalogues. Interrelated processes are fully integrated and use as well as update configuration data. Baseline audit reports provide essential hardware and software data for repair, service, warranty, upgrade and technical assessments of each individual unit. Authorised software installation rules are enforced. Management forecasts repairs and upgrades from analysis reports providing scheduled upgrades and technology refreshment capabilities. Asset tracking and monitoring of individual workstations protects assets and prevents theft, misuse and abuse.