question CMDB audit vs Data certification in GRC forum

CMDB audit vs Data certification

jain25rajesh — Tue, 15 Oct 2019 11:23:51 GMT

We have a CI audit module(desired state) in compliance application , which helps "Desired State performs scheduled or on-demand audits of CMDB data to determine which records match the expected attributes, CI relationships, and relationships to other records in the system."

Other than that there is a separate module for Data Certification ( paid plugin) ,which also helps in "manages scheduled and on-demand validations of the configuration management database (CMDB) data."

Can someone please help in understanding the difference in above both CI data certification procedures and which one to use when ?

Re: CMDB audit vs Data certification

jain25rajesh — Tue, 15 Oct 2019 11:51:32 GMT

Got the Answer

Desired state differs substantially from data certification. Data certification is a manual process to ensure that your data matches reality. Desired state examines the same data and determines when the configuration of each item is in the desired and approved state.

https://docs.servicenow.com/bundle/london-servicenow-platform/page/product/compliance/reference/r_DesiredState.html

Re: CMDB audit vs Data certification

Muskan Dixit — Tue, 02 Jun 2020 09:41:35 GMT

what is the need to use Data certification(manual process) when we have compliance process(which is automated)?

Is data certification older module & now we can completely replace it with compliance and audit?

Re: CMDB audit vs Data certification

Nia McCash — Fri, 12 Jun 2020 14:52:28 GMT

Data Certification and Desired State/compliance have different purposes. Here's a trivial example:

Say you have 25 servers in 3 data centres.
Desired State could check to make sure that the [location] field for each server is one either Room A, B, or C - that is every server should be located in one of your 3 data centres.
But if at some point you move a server from Room A to Room B and forget to update the location field, or you decommission a server to a storage room and forget to update the location, that's where Data Certification comes in.
Data Certification can run every 6 months to remind you to check all server records in the CMDB to make sure that the location data for each are still accurate - not just that they match some condition but that they are also correct.

Re: CMDB audit vs Data certification

Tobias — Tue, 04 Jan 2022 07:28:33 GMT

I believe the use cases are different.

Audit/compliance runs a check on fields being empty/not empty according to desired state, e.g. owner is specified.

Data certification provides a way to manually validate that the data in given field is in fact correct according to reality, e.g. is this person still the right owner.

Re: CMDB audit vs Data certification

MikeWilsonNYC — Thu, 28 Jul 2022 21:00:02 GMT

Another difference:

CMDB audits generate follow on tasks (cert_follow_on_task) if a desired state is not met e.g. if a business app has no associated app services.

Data certification, on the other hand, generates certification tasks (cert_task) to get someone to verify data e.g. confirm that fields X Y Z on Business Application are still correct.