Twelve questions to answer before the next CMDB clean-up project

Why do clean-ups fade?

A team exports the CMDB, fixes thousands of records by hand, and declares victory. Six months later the record has drifted again, because nothing changed in how records arrive, match, get owners or leave. The questions below turn a clean-up into a fix of the inputs.

Questions about the record

1. What decisions depend on the CMDB? List the workflows that read it: incident routing, change approval, audits, license counts, security coverage. The answer tells you which fields matter.
2. Which ten fields matter most? Accuracy work should start with the fields those decisions use, not with every column.
3. Which asset classes are in scope? Laptops, servers, cloud resources, SaaS apps, identities, OT and IoT, network devices. Coverage differs widely between options by class.

Questions about sources

1. Which systems already know about each class? EDR, MDM, directory, cloud accounts, HR, procurement. Most organizations already hold better data than the CMDB; it is just elsewhere.
2. Which source wins for each field? Write field-level precedence down before configuring anything. Lesson 5 has an example.
3. How will duplicates be matched? Agree the identifiers, such as serial number, MAC address and hostname, and their order.

Questions about people

1. Who owns each record? Decide where owners come from automatically and what happens to records whose owner leaves.
2. Who owns the CMDB itself? One person or team approves rules for matching and write-back.
3. Who maintains connectors and credentials? Every automatic source needs someone to keep it running.

Questions about change

1. What may be written into the CMDB automatically? Creating missing records is low risk; updating fields is medium; retiring records is high. Axonius, for example, documents all three for ServiceNow as separate actions, which lets a team switch them on in that order.
2. How will you measure progress? Take a baseline: coverage against trusted lists, a sampled correctness rate, duplicates, ghosts, owner coverage and record age. Frameworks such as NIST's CSF 2.0 ask for an accurate inventory; these numbers are how you show it.
3. What does manual upkeep cost today? Put a figure on it with the drift cost calculator, so the cost of an alternative can be compared with the cost of doing nothing.

How do the answers point to an option?

• If questions 3 and 4 show devices that no system knows about, start with network discovery. Lansweeper and runZero publish prices and free tiers up to 100 assets.
• If question 5 shows many sources that disagree, start with a reconciliation layer that writes back to the CMDB.
• If question 1 shows the service desk is the center of everything and there is no CMDB yet, start with a CMDB that has discovery built in.

What if the answers are uncomfortable?

Sometimes question 4 shows that a better source already exists and nobody connected it, or question 8 shows that nobody owns the CMDB at all. Those are the most useful answers in the list, because they are cheap to fix compared with buying anything. Write them down first and fix them before any tool is chosen.

How long does this take?

The questions take a few meetings, not a project. The answers become the brief for a 30-day pilot, described in lesson 10.

Who should be in the room?

Answer the questions with the people who use the record and the people who feed it: the service desk lead, the CMDB owner, someone from security operations, someone from infrastructure or cloud, and someone from procurement or IT asset management. Each sees a different failure of the record. Leaving one out usually means a field that matters to them is missing from question 2.

The short version

Fix how records arrive, match, get owners and leave, and the clean-up stays clean. Fix only the records, and you will run the same project next year.