Hi All,
We have a situation that we are wondering how to best model in the CMDB, especially in relation to CSDM recommendations. We have portions of some apps that rely on 3rd party services such as payment processors for an online store, etc. We are trying to determine the most correct way to represent the dependencies on those external services. We need these represented for both operational and compliance purposes - we need to understand the architecture and dependencies of our applications, and we also need to be able to understand what data is being sent and stored to/in these services for data privacy and governmental compliance purposes. We don't track the data sent and stored in ServiceNow, but understanding the dependency on the services so we can ask the right questions is essential.
For SaaS applications and platforms where we have users directly interacting with the application/platform, we already represent those as Business Applications with associated Application Services. For example, ServiceNow is a Business Application, and our instances are all Application Services. However, in this case, we simply have a service provider that provides an API (or some kind of interface) for us to interact with - no users interact directly with the service. In this scenario it feels less appropriate to represent it as a business application, since there are no "deployed application stacks" for us to track, per se. We could see it potentially represented as a Business Service, or maybe a Technical Service, but both of those feel not quite right as well.
Below is a simple example of what we're dealing with. The Business Application and Application Service represent an in-house developed online store application. It does everything except the payment processing which is handled by a 3rd party service that we have contracted with. We want to be able to represent that payment processing service as a CI so that we can see that our application depends on it. The question is what kind of CI would be best to represent that external service? You could have a similar scenario with other kinds of services such as payroll processing, etc.
Thanks for all feedback!
Hello @Lyle Taylor , thank you for your question!
There are key aspects to your use case I want everyone to understand:
1. Data is being sent to a 3rd party service through an API
2. The 3rd Party Service is a contractually obligated Vendor
That said, we want to ensure we can identify those unique aspects to this use case: the API and the 3rd party service. I have drawn our recommendation that takes into account the points above. Note: we are NOT recommending the use of an Application Service for this 3rd Party Service... Why?
One of the aspects of a Service Offering is identifying the Vendor providing said Offering and the contracts associated to the Service. If used within ITSM, there are tracking capabilities available to understand if a Vendor is performing their obligations. In this use case, the Technical Service Offering is a critical object to identify the 3rd Party Service and, if desired, manage them as a Vendor. The API object is a bonus. You mentioned this in the use case and we recently added API as a class within the CMDB. This enables you to identify the APIs (in-house or 3rd party provided) that you depend on. APIs can exist between Application Services (in-house use case) or a Service Offering (3rd party use case).
Regardless if you plan on using our Vendor Management features, this model is the recommended solution from ServiceNow.
Thank you again for the How Would I Model This using CSDM question.
I hope this helps.
Feel free to reach out directly if you have additional questions on this topic
