Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Assets, Configuration and Dependencies
Assets and configuration
- Asset management tracks what the organisation owns or uses: hardware, software, licences, cloud services and data.
- Configuration management tracks how each item is configured and how items depend on each other.
Dependencies
Baselines and drift
- Baselines define approved, hardened settings.
- Automated tools compare systems with the baselines.
- Drift is investigated: authorised change, or a problem?
- Baselines are updated through change management.
Example. Impact analysis for a database upgrade used the CMDB and found a forgotten dependency: the payroll interface. Without it, payroll would have failed on payday.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| MOST useful CMDB feature for risk | Relationships between configuration items |
| How to keep the CMDB accurate | Update it through change management |
| Systems drift from their baseline | Investigate; it may indicate an unauthorised change |
| Purpose of dependency mapping | Impact analysis for changes, incidents and continuity |
In short
- Asset management tracks what the organisation has; configuration management tracks how it's configured and how items relate.
- A CMDB's value lies in relationships: change one item and you see what depends on it.
- Configuration baselines define approved settings; drift from them is a risk signal.
- Accurate dependency data supports impact analysis, incident response and continuity.
- The CMDB must be updated through change management or it drifts from reality.
Exam traps
- Treating the asset register as a finance list rather than a risk tool.
- A CMDB not updated after changes.
- No baseline, so drift can't be detected.
- Missing cloud and SaaS assets from the inventory.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Dependencies
1 / 7