ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceHard
An IS auditor is evaluating an organization's configuration management database (CMDB). The auditor observes that while all hardware and software components are logged, the relationships and interdependencies between these configuration items (CIs) are not consistently documented. What is the PRIMARY impact of this deficiency?
- ADifficulty in enforcing security baselines for individual CIs.
- BIncreased complexity in performing routine equipment inventory checks.
- CHigher licensing costs due to unoptimized software deployments.
- DChallenges in accurately assessing the impact of a change or incident.
Show answer & explanationAnswer & explanation
Correct answer: D. Challenges in accurately assessing the impact of a change or incident.
A CMDB's value lies not just in listing CIs but in mapping their relationships. Without documented interdependencies, it becomes extremely difficult to understand the full impact of a proposed change or the cascading effects of an incident. This leads to poor decision-making, increased risk of outages, and slower incident resolution.
Why the other options are wrong
- A. Security baselines apply to individual CIs. While relationships can inform security, the primary impact of missing relationships is on change/incident impact analysis, not baseline enforcement.
- B. Inventory checks focus on individual CIs, not their relationships. This is a secondary impact.
- C. While related, licensing costs are more about asset management than the direct impact of missing interdependencies.
CMDB Relationship Gap
A weakness in a Configuration Management Database where individual Configuration Items (CIs) are recorded, but their critical relationships and interdependencies are not adequately documented or maintained.
- Hinders effective change management.
- Impairs incident and problem resolution.
- Reduces visibility into system architecture and risk.
Memory trick: Having a list of all the players but no team roster showing who plays with whom.