Two incidents caught my attention recently. The first was in New York City, where 14,000 parking meters rejected credit card payments due to an anti-fraud security setting that disabled the feature on January 1, 2020. Then Microsoft disclosed that over 250 million user analytics records were exposed on five ElasticSearch servers following a change to its security rules early in December 2019. They resolved the issue on the last day of the year.
Both scenarios were attributed to configuration errors, with Microsoft stating that “Misconfigurations are unfortunately a common error across the industry.” Indeed, managing configurations is one of the more challenging activities in IT service management. So, what better way to look at configuration items than by defining what is it that we configure? In this article, we’ll define CIs and look at real-world examples.
Defining configuration items
Let’s look at how configuration items (CIs) are defined by some leading ITSM sources:
- ITIL® 4 defines a CI as any component that needs to be managed in order to deliver an IT service.
- ISO/IEC 20000:2018 says a CI is any element that needs to be controlled in order to deliver a service.
- CMMI SVC calls a CI an aggregation of work products that is designated for configuration management and treated as a single entity in the configuration management process.
- Perhaps most broadly, SIAM says a configuration item includes anything used to deliver or support the services.
Based on these definitions, you might realize that there is no discernible difference between CIs and assets. However, it is important to note that while all CIs are assets, not all assets are CIs. Configuration items have an element of control required to deliver services, and this is not usually a preserve for all assets.
So, for example, knowledge or furniture can be classified as assets for your company. But they are not CIs, as they are not controlled for purposes of delivering services.
Examples of configuration items
CIs vary widely in complexity, size, and type, ranging from an entire service or system including all hardware, software, documentation, and support staff to a single software module or a minor hardware component. Here are common examples of CIs:
CIs may be grouped and managed together. For example, a set of components may be grouped into a single release.
