An IS auditor is reviewing an organization's configuration management database (CMDB). The auditor observes that the CMDB contains detailed records of hardware and software assets, but lacks information about the interdependencies between these configuration items (CIs) and the business services they support. What is the MOST significant implication of this omission for IT operations and business resilience?
- ADifficulty in accurately assessing the impact of a CI failure on business services.
- BIncreased time required for inventory management and asset tracking.
- CHigher risk of unauthorized configuration changes to IT assets.
- DChallenges in ensuring compliance with software licensing agreements.
Show answer & explanationAnswer & explanation
Correct answer: A. Difficulty in accurately assessing the impact of a CI failure on business services.
A primary benefit of a well-maintained CMDB, especially in the context of IT operations and resilience, is its ability to map IT infrastructure to business services. Without understanding these interdependencies, IT staff cannot quickly determine which business services are affected by a failed CI, making incident response, problem management, and change impact analysis significantly more difficult and prolonged, directly impacting business resilience.
Why the other options are wrong
- B. While a CMDB aids inventory, the omission of interdependencies primarily impacts operational decision-making, not just tracking.
- C. Unauthorized changes are typically controlled by access management and change approval processes, not directly by CMDB interdependency mapping.
- D. Software licensing is a compliance issue, separate from the operational impact analysis facilitated by interdependency mapping.
CMDB Interdependency Mapping
CMDB interdependency mapping involves documenting the relationships between Configuration Items (CIs) and the business services they support, enabling impact analysis for changes, incidents, and problems.
- Crucial for incident and problem management.
- Facilitates change impact analysis.
- Enhances business service understanding and resilience.
Memory trick: CMDB: 'C'onnecting 'M'any 'D'ependencies for 'B'usiness