CMDB

What is a CMDB?

A CMDB (Configuration Management Database) is a central database in which an organisation records and maintains its configuration items (CIs), such as servers, network equipment, applications, PLCs and HMIs, together with their attributes and the relationships between them. Where a simple inventory list only tells you what exists, a CMDB also shows how everything fits together: which application runs on which server, through which firewall a SCADA server can be reached and which production line stops when a switch fails. That makes the CMDB a foundation for Asset Management, Change Management, Incident Management and Incident Response in both IT and OT.

A CMDB provides a single, reliable view of your technical infrastructure, from servers to switches and from PLCs to applications, including the dependencies between them.

🧠 Where does the CMDB come from?

The CMDB is a concept from ITIL, the IT service management framework developed by the UK government in the late 1980s. In ITIL v3 the CMDB is part of a wider configuration management system (CMS): the set of tools and data sources in which configuration data is managed. ITIL 4 (2019) calls the related practice service configuration management and stresses recording the information that is genuinely needed to deliver services, rather than everything that is technically possible.

The service management standard ISO/IEC 20000-1:2018 makes configuration management mandatory for certified organisations (clause 8.2.6). It defines a CI as an element that needs to be controlled in order to deliver a service. For each CI type you must define which information is recorded, such as type, description and status, and services themselves are CIs too. Within an ISMS based on ISO 27001, the CMDB is often used as the source for the required asset inventory.

🎯 What is the purpose of a CMDB?

• A complete view of all assets (CIs) and their interdependencies
• Managing changes to configurations, software and firmware versions
• Impact assessment for incidents and planned changes: what does an outage or intervention affect?
• Demonstrable compliance with standards and laws that require an inventory and configuration management, such as ISO 27001, NIS2 and the Dutch BIO
• Bringing IT and OT together in a single view of hybrid environments

🧱 What does a CMDB contain?

Common CI types include servers (on-premises or cloud), virtual machines and containers, network equipment such as switches, routers and firewalls, software applications and licences, certificates, backups and user accounts. In OT, PLCs, HMIs, DCS controllers, SCADA components and field devices are added. The zones and conduits from network segmentation under the zones and conduits model can also be recorded as CIs or attributes, so you can see which zone each device belongs to.

🔄 What is the difference between a CMDB, an asset inventory and a CMMS?

The terms are often used interchangeably, but they serve different purposes:

In practice, the CMDB is often the central register into which the other sources feed. A discovery tool supplies current network data, the CMMS supplies maintenance data and the CMDB records the relationships.

🏭 How do you use a CMDB in OT environments?

IT discovery tools often rely on active scanning, which can be risky in OT: older PLCs and field devices may hang on unexpected network traffic. OT assets are therefore usually discovered through passive monitoring, as with Claroty and Nozomi. These platforms are not CMDBs, but they identify devices, firmware and communication flows and synchronise them with the CMDB through integrations.

Points to watch in OT:

• Long service life - installations often run for twenty years or more, so lifecycle and support status are important attributes
• Physical context - the relationship between a CI and the process it controls determines its criticality, not the hardware value
• Non-IP equipment - fieldbuses and serial links are invisible to a network scanner and require physical inspection
• Purdue level - record the level of the Purdue Model a CI sits on, as a basis for segmentation and access control

The international guide Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators (August 2025), published by CISA together with partners including the Dutch NCSC and the German BSI, describes five steps: define scope and objectives, identify assets and collect attributes, create a taxonomy, manage and collect data, and implement lifecycle management. The guide lists fourteen high-priority attributes, including communication protocols, criticality, hostname, IP and MAC address, manufacturer, model, operating system, physical location, ports and services, and user accounts.

🔐 Which standards and laws call for a CMDB?

No standard literally requires a CMDB, but many require what a CMDB delivers:

• ISO 27001:2022 - control 5.9 (inventory of information and assets, with owner) and 8.9 (configuration management)
• IEC 62443 - IEC 62443-3-3 system requirement SR 7.8 calls for a control system component inventory
• NIST CSF 2.0 - the ID.AM category asks for inventories of hardware, software, data flows and lifecycle
• NIS2 and the Dutch Cybersecurity Act - the duty of care, in force in the Netherlands since 15 August 2026, includes asset management
• ISO/IEC 20000-1 - configuration management is a mandatory service management practice

📊 How does a CMDB support other processes?

A well-populated CMDB also makes a Business Impact Analysis easier, because the chain from service to underlying technology is already known. An SBOM can be attached to a CI as an attribute, so vulnerable software components become visible as well.

🛠️ How do you set up a CMDB that stays up to date?

Many CMDB projects fail because the data goes stale quickly. A practical approach:

1. Start with a purpose - first choose the processes the CMDB must support, such as change and incident management, and record only what they need.
2. Define CI types and attributes - set the mandatory fields per type; for OT, use the high-priority attributes from the CISA guide as a starting point.
3. Automate population - use discovery in IT and passive monitoring in OT, and import data from the CMMS.
4. Link to change management - no change without a ticket; a closed change updates the CMDB.
5. Measure data quality - track completeness, correctness and duplicate or orphaned records. ServiceNow flags a CI as stale by default when it has not been updated for 60 days.
6. Assign owners - every CI type has an owner who reviews the data periodically.

Well-known CMDB tools include ServiceNow, BMC Helix, Freshservice (with Device42, part of Freshworks since June 2024), the SolarWinds service desk and the open-source packages iTop and GLPI.

✅ What does a CMDB deliver?

• A single source of truth for the infrastructure
• Faster problem resolution through visibility of dependencies
• Better change decisions, because the impact is visible in advance
• Support for audits and certifications, with a demonstrable inventory and audit trail
• A basis for automating management, monitoring and updates

❓ Frequently asked questions

What is the difference between a CMDB and configuration management?

Configuration management is the process by which you manage settings and versions and control changes. The CMDB is the database that supports that process by recording CIs, attributes and relationships. Without the process, a CMDB quickly becomes outdated.

Is a CMDB mandatory?

A CMDB as such is not a legal requirement anywhere. However, ISO 27001, IEC 62443, NIS2 and the Dutch Cybersecurity Act require an up-to-date inventory and controlled configurations. A CMDB is a common way to demonstrate that you meet those requirements.

Can OT assets live in the same CMDB as IT assets?

Yes, provided the CMDB can record OT-specific attributes such as firmware version, protocols, zone and Purdue level. Many organisations connect an OT monitoring platform to their existing IT CMDB. Access to OT data must be tightly restricted, because a CMDB is a valuable map for an attacker.

How do you keep a CMDB up to date?

A CMDB stays current through automated discovery, a strict link with change management and fixed owners per CI type. Measure the completeness and correctness of the data regularly and clean up stale records.

What is a configuration item (CI)?

A configuration item is any component that must be controlled to deliver a service or process reliably, such as a server, application, PLC or certificate. Each CI in the CMDB has a unique identity, attributes, a status and relationships with other CIs.

Can an active scanner discover OT assets for the CMDB?

Active scanning can disrupt older PLCs and field devices, so in OT it is only used carefully and in consultation with operations. Passive monitoring of network traffic is the usual way to discover OT assets for a CMDB.

📌 In summary

A CMDB records configuration items, their attributes and their relationships. In doing so it supports incident, change and patch management and provides evidence for ISO 27001, IEC 62443 and the Dutch Cybersecurity Act. In OT, a CMDB requires passive discovery, attention to lifecycle and physical context, and a tight link with change management.

A CMDB provides a single overview of all systems, devices and dependencies in your IT and OT landscape, and is only valuable if the data stays up to date.