Governance

CMDB Health is measured by three core metrics that assess data quality across all Configuration Items. These metrics — Completeness, Correctness, and Compliance — form the foundation of CMDB governance and are central to the Health Dashboard.

Completeness

Measures whether required attributes are populated. The key question: "Do we have all the necessary data?" For example, a server CI must have Name, IP Address, Operating System, and Managed By Group populated to be considered complete.

Correctness

Measures whether data is accurate and conforms to expected values. The key question: "Is the data right?" Correctness has several important sub-metrics:

• Staleness — CI not updated within the defined threshold (default 60 days). Indicates a data source is no longer refreshing the record.
• Orphans — CIs with no relationships. Indicate missing connections to other CIs or services.
• Duplicates — Multiple CIs representing the same physical or logical asset. Indicate identification rule gaps or conflicting data sources.

Example of a correctness issue: a CI with an invalid operational status value, or a server CI showing an IP address that no longer exists.

Compliance

Measures adherence to defined data models (CSDM). The key question: "Does data follow the agreed structure?" For example, an Application CI must have a "Runs on" relationship to a Server CI to be considered compliant.

Health Rules and Configuration

• Health Rules: Administrators configure what "complete," "correct," and "compliant" means per CI class.
• Health Dashboard: Visual reports of scores with drill-down capability into failing CIs.
• Audit Jobs: Scheduled jobs that evaluate CIs against health rules on a recurring basis.
• Health score thresholds are customizable per CMDB group per KPI/metric, stored in the cmdb_health_scorecard_group_threshold table.
• KPI weights in overall health aggregation are configurable to prioritize the metrics most important to the organization.

CMDB Data Manager is a modern, policy-driven framework for automating CI lifecycle management, introduced in the Rome release. It replaces legacy approaches for retiring, archiving, and deleting CIs with a structured, auditable process.

Policy Types

Policy Configuration Steps

1. Select Policy Type — choose from the five available types
2. Define Filter Conditions — use AND/OR with multiple criteria to target specific CIs
3. Configure Needs Review — optional, generates an approval task before execution
4. Associate Subflow — optional, out-of-box subflow is "Retire Configuration Items"
5. Preview Impact — see estimated number of affected CIs, exclude individual CIs if needed
6. Publish — policy is processed by daily scheduled jobs

Data Manager Processing

• Daily scheduled job runs by default at approximately 3:00 AM (configurable)
• When Needs Review is enabled, tasks are assigned to the Managed By Group with email notifications
• Approval is required before the associated subflow executes
• Batch limit: 10,000 CIs per task (e.g., 30,000 matching CIs = 3 separate tasks)
• Stale tasks are auto-closed after 90 days (configurable via cmdb.data.manager.stale.task.life.in.days property)
• Error logging with admin notifications for failed operations

Dependent CI Management

When a parent CI is retired, archived, or deleted, cascade operations automatically generate policies for child/dependent CIs. Two scheduled jobs support this process:

• "CMDB Cascade Retire Dependent CIs" — populates the cmdb_dependent_ci_ledger table with dependent CIs
• Regular Data Manager processor jobs — process the generated cascade policies

Exclusion Lists

CSDM 4.0 introduced standardized lifecycle fields to replace the legacy install_status and operational_status fields, providing a more consistent and automatable approach to tracking CI lifecycle.

Legacy vs. CSDM Standard

Lifecycle Stage Values

Data Certification is a governance process where CI owners periodically verify the accuracy of their CI data. It is a separate mechanism from the Data Manager Attestation policy type, though both serve verification purposes.

How Data Certification Works

• Tasks are generated on a defined schedule
• Tasks are assigned to CI owners who review their CIs
• Owners either certify the data as accurate or flag CIs for correction
• Certification results can drive further remediation workflows

Data Certification vs. Data Manager Attestation

Duplicate CIs are a common data quality issue that impacts CMDB accuracy. ServiceNow provides four structured methods for handling duplicates, all designed to preserve data integrity during the merge process.

Four Methods for Handling Duplicates

1. De-duplication Wizard — Guided step-by-step process from CMDB Workspace. Select a master CI, choose which attributes to preserve from each record, merge relationships, and optionally delete or retire the duplicate.
2. Bulk De-duplication — Process multiple duplicate sets at once using De-duplication Templates that define the merge strategy per CI class.
3. De-duplication Tasks — Automatically created by the IRE when identification finds multiple matches. Also created by the CMDB Health correctness job. Tasks are assigned to CMDB admins and appear in the Workspace.
4. Remediation Playbook — Guided workflow for comprehensive data quality issues, including but not limited to duplicates.

The Consumer-Owner-Provider (COP) model defines the three key roles in CMDB data governance, establishing clear accountability for data quality across the organization.

Ownership Hierarchy

• CMDB Owner — Single person with overall authority over the CMDB. Often chairs the board of domain owners.
• Domain Owners — Assigned per CSDM domain. Manage Technical Services is often further split into sub-domains (Server, Network, Database).
• CI-Level Ownership — Defined by the Managed By and Owned By fields on each CI record.

Effective governance requires both preventing bad data from entering the CMDB and correcting issues that are discovered after the fact. ServiceNow provides multiple enforcement methods and remedial action types.

Enforcement Methods

Remedial Actions

• Automated Tasks (primary method) — Health violations automatically generate tasks assigned to Providers or Owners for resolution.
• Bulk Remediation — For widespread, well-understood issues. Use with extreme caution to avoid unintended data changes.
• Process Adjustment — If issues are systemic, revise the underlying policy or ingestion process rather than fixing individual CIs.

Compliance measures whether CI field VALUES meet predefined standards, going beyond simple completeness checks. Desired State audits allow administrators to define expected configurations and automatically identify CIs that deviate.

Configuring Desired State Audits

1. Define a filter to target specific CIs (e.g., Class is Windows Server AND Environment is Production)
2. Set template conditions that define the desired state (e.g., RAM >= 16GB, Antivirus = Installed)
3. Schedule the audit to run on a recurring basis

Audit results identify CIs that do not meet the desired state conditions. These results feed directly into the Compliance KPI of the CMDB Health Dashboard, contributing to the overall health score.

CMDB Workspace is the centralized hub for CMDB administration and governance. It provides multiple pages, each focused on different aspects of CMDB management. The Governance page is heavily tested on the exam.

Workspace Pages

Key Roles

The following scenarios represent the types of questions commonly seen on the CIS-DF exam for the Governance domain. Practice reasoning through each scenario before reading the answer.