For auditors
The CMDB keeps what an auditor asks about the systems behind the services a report covers: what they were, who owned them, and what depended on what, on any date.
What is kept
| Evidence | What |
|---|---|
| History | Every change of a CI is a revision with the whole record, who made it and when. Nothing in it is edited. The record on a date on a CI's History tab shows it as it was (working with CIs). |
| Relationships | Every relationship added or removed is kept with who and when, so the graph as it was on any date can be rebuilt: As of on the Dependency map draws it. |
| Health history | Every change of a CI's health, with what set it: its incidents and changes, a person by hand, or the time running out (health). |
| Imports | Each import, with the file's checksum, who ran it and what it did (importing). |
| Exports | Each export below, with its checksum. |
| Reviews | Each owner's review of a CI's record, below. |
Adding, changing, deleting, importing and exporting CIs are in the audit log.
Reviews
Each live or retiring CI with an owner is reviewed by its owner, on Reviews under Service Configuration, the same way as service records:
| CIs | How often |
|---|---|
| Every CI | Once a year |
| CIs a tier 1 service or a service in an audit scope runs on, all the way down | Every six months |
These are the default intervals; they are set under Service Configuration → Settings →
Audit. The owner gets an email, sees the record as it is (class, lifecycle, environment, owner, support team, units,
identifiers and relationships), and answers It is right or I corrected it with what was wrong. After 30 days it
is overdue, and the owner is reminded once. Someone with ci.settings may decide it too, and may ask the owner to
review it now (the CI's menu: Ask the owner to review it).
Every review is kept with what was reviewed, the answer, who gave it and when; Export on the Reviews page has them with the service reviews.
Exporting the CMDB
Export on the Configuration items page gives the CIs you can see as they are now, or as they were on any date (taken from each CI's history): name, class, lifecycle, environment, owner, support team, units, identifiers, the relationships from it, the version of its record and its description. As it was on picks the date. Download CSV gives a file, and Page to print or save as PDF a page.
Under Configuration items, pick an audit scope to export only what its services were joined to on that date: the CIs they ran on, and everything those were joined to in turn, all the way down, along every kind of relationship. A service counts when its record named the scope on that date, and a relationship counts when it was there on that date. So the list matches the system description for the period, even if servers have been replaced since.
Every export is kept with who made it, when, as of when, the scope, and a SHA-256 checksum of the file, so the copy the auditor has can be checked against it. The Export dialog lists them under Earlier exports.
[!NOTE] A CI that was deleted isn't in an export of an earlier date: deleting is only allowed for CIs nothing refers to. Retire CIs instead, and they stay in every export, with their lifecycle as it was.