Configuration management

History

Configuration management originated in the United States Department of Defense in the 1950s as a technical management discipline for hardware material items—and it is now a standard practice in virtually every industry. The CM process became its own technical discipline in the late 1960s when the DoD developed a series of military standards called the "480 series" (i.e., MIL-STD-480, MIL-STD-481 and MIL-STD-483) that were subsequently issued in the 1970s. In 1991, the "480 series" was consolidated into a single standard known as the MIL–STD–973 that was then replaced by MIL–HDBK–61 pursuant to a general DoD goal that reduced the number of military standards in favor of industry technical standards supported by standards developing organizations (SDO). This marked the beginning of what has now evolved into the most widely distributed and accepted standard on CM, ANSI–EIA–649–1998. Now widely adopted by numerous organizations and agencies, the CM discipline's concepts include systems engineering (SE), Integrated Logistics Support (ILS), Capability Maturity Model Integration (CMMI), ISO 9000, Prince2 project management method, COBIT, ITIL, product life cycle management, and Application Lifecycle Management. Many of these functions and models have redefined CM from its traditional holistic approach to technical management. Some treat CM as being similar to a librarian activity and break out change control or change management as a separate or standalone discipline.

Overview

CM is the practice of handling changes systematically so that a system maintains its integrity over time. CM implements the policies, procedures, techniques, and tools that manage, evaluate proposed changes, track change status, and maintain an inventory of system and support documents as the system changes. CM programs and plans provide technical and administrative direction to the development and implementation of the procedures, functions, services, tools, processes, and resources required to successfully develop and support a complex system. During system development, CM allows program management to track requirements throughout the life-cycle through acceptance and operations and maintenance. As changes inevitably occur in the requirements and design, they must be approved and documented, creating an accurate record of the system status. Ideally the CM process is applied throughout the system life cycle. Many professionals mix up or get confused with Asset management (AM, see also ISO/IEC 19770), where it inventories the assets on hand. The key difference between CM and AM is that the former does not manage the financial accounting aspect but the service that the system supports or in other words, that the latter (AM) is trying to realize value from an IT asset.

The CM process for both hardware and software configuration items comprises five distinct disciplines as established in the MIL–HDBK–61A and in ANSI/EIA-649. Members of an organization interested in applying a standard change-management process will employ these disciplines as policies and procedures for establishing baselines, manage and control change, and monitor and assess the effectiveness and correctness of progress. The IEEE 12207 process IEEE 12207.2 also has these activities and adds "Release management and delivery". The five disciplines are:

1. CM Planning and Management: a formal document and plan to guide the CM program that includes items such as:
   • Personnel
   • Responsibilities and resources
   • Training requirements
   • Administrative meeting guidelines, including a definition of procedures and tools
   • Baselining processes
   • Configuration control and configuration-status accounting
   • Naming conventions
   • Audits and reviews
   • Subcontractor/vendor CM requirements
2. Configuration Identification (CI): consists of setting and maintaining baselines, which define the system or subsystem architecture, components, and any developments at any point in time. It is the basis by which changes to any part of a system are identified, documented, and later tracked through design, development, testing, and final delivery. CI incrementally establishes and maintains the definitive current basis for Configuration Status Accounting (CSA) of a system and its configuration items (CIs) throughout their life cycle (development, production, deployment, and operational support) until disposal.
3. Configuration Control: includes the evaluation of all change-requests and change-proposals, and their subsequent approval or disapproval. It covers the process of controlling modifications to the system's design, hardware, firmware, software, and documentation.
4. Configuration Status Accounting: includes the process of recording and reporting configuration item descriptions (e.g., hardware, software, firmware, etc.) and all departures from the baseline during design and production. In the event of suspected problems, operators can quickly verify baseline configuration and approved modifications.
5. Configuration Verification and Audit: an independent review of hardware and software for the purpose of assessing compliance with established performance requirements, commercial and appropriate military standards, and functional, allocated, and product baselines. Configuration audits verify that the system and subsystem configuration documentation complies with the functional and physical performance characteristics before acceptance into an architectural baseline.

Software

The software configuration management (SCM) process is looked upon by practitioners as the best solution to handling changes in software projects. It identifies the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes for the purpose of maintaining software integrity and traceability throughout the software development life cycle.

The SCM process further defines the need to trace changes, and the ability to verify that the final delivered software has all of the planned enhancements that are supposed to be included in the release. It identifies four procedures that must be defined for each software project to ensure that a sound SCM process is implemented. They are:

1. Configuration identification
2. Configuration control
3. Configuration status accounting
4. Configuration audits

These terms and definitions can change somewhat from standard to standard.

• Configuration identification is the process of identifying the attributes that define a configuration item's every aspect. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed.
• Configuration change control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them.
• Configuration status accounting is the ability to record and report on the configuration baselines associated with each configuration item at any moment.
• Configuration audits are broken into functional and physical configuration audits. They occur either at delivery or at the moment of effecting the change. A functional configuration audit ensures that functional and performance attributes of a configuration item are achieved, while a physical configuration audit ensures that a configuration item is installed in accordance with the requirements of its detailed design documentation.

Configuration management database

A configuration management database (CMDB) is a database used to store information about configuration items and their relationships.. CMDBs are used to track Configuration Items (CIs) and the dependencies between them, where CIs represent the things in an enterprise that are worth tracking and managing, such as but not limited to computers, software, software licenses, racks, network devices, storage, and even the components within such items. CMS helps manage a federated collection of CMDBs.

The benefits of a CMS/CMDB includes being able to perform functions like root cause analysis, impact analysis, change management, and current state assessment for future state strategy development.

Configuration Management (CM) is an ITIL-specific ITSM process that tracks all of the individual CIs in an IT system, which may be as simple as a single server or as complex as the entire IT department. In large organizations a configuration manager may be appointed to oversee and manage the CM process. In ITIL version 3, this process has been renamed as Service Asset and Configuration Management.

Information assurance

For information assurance, CM can be defined as the management of security features and assurances through control of changes made to hardware, software, firmware, documentation, test, test fixtures, and test documentation throughout the life cycle of an information system. CM for information assurance, sometimes referred to as secure configuration management (SCM), relies upon performance, functional, and physical attributes of IT platforms and products and their environments to determine the appropriate security features and assurances that are used to measure a system configuration state. For example, configuration requirements may be different for a network firewall that functions as part of an organization's Internet boundary versus one that functions as an internal local network firewall.

Maintenance systems

Configuration management is used to maintain an understanding of the status of complex assets with a view to maintaining the highest level of serviceability for the lowest cost. Specifically, it aims to ensure that operations are not disrupted due to the asset (or parts of the asset) overrunning limits of planned lifespan or below quality levels.

In the military, this type of activity is often classed as "mission readiness", and seeks to define which assets are available and for which type of mission; a classic example is whether aircraft on board an aircraft carrier are equipped with bombs for ground support or missiles for defense.

Operating system configuration management

Configuration management can be used to maintain OS configuration files. Many of these systems utilize Infrastructure as Code to define and maintain configuration.

The Promise theory of configuration maintenance was developed by Mark Burgess, with a practical implementation on present day computer systems in the software CFEngine able to perform real time repair as well as preventive maintenance.

Preventive maintenance

Understanding the "as is" state of an asset and its major components is an essential element in preventive maintenance as used in maintenance, repair, and overhaul and enterprise asset management systems.

Complex assets such as aircraft, ships, industrial machinery etc. depend on many different components being serviceable. This serviceability is often defined in terms of the amount of usage the component has had since it was new, since fitted, since repaired, the amount of use it has had over its life and several other limiting factors. Understanding how near the end of their life each of these components is has been a major undertaking involving labor-intensive record keeping until recent developments in software.

Predictive maintenance

Many types of component use electronic sensors to capture data which provides live condition monitoring. This data is analyzed on board or at a remote location by computer to evaluate its current serviceability and increasingly its likely future state using algorithms which predict potential future failures based on previous examples of failure through field experience and modeling. This is the basis for "predictive maintenance".

Availability of accurate and timely data is essential in order for CM to provide operational value and a lack of this can often be a limiting factor. Capturing and disseminating the operating data to the various support organizations is becoming an industry in itself.

The consumers of this data have grown more numerous and complex with the growth of programs offered by original equipment manufacturers (OEMs). These are designed to offer operators guaranteed availability and make the picture more complex with the operator managing the asset but the OEM taking on the liability to ensure its serviceability.

Standards

A number of standards support or include configuration management, including:

• ANSI/EIA-649-1998 National Consensus Standard for Configuration Management
• EIA-649-A 2004 National Consensus Standard for Configuration Management
• SAE EIA-649-C 2019 Global Consensus Configuration Management Standard
• ISO 10007 Quality management systems – Guidelines for configuration management
• Federal Standard 1037C
• GEIA Standard 836–2002 Configuration Management Data Exchange and Interoperability
• IEEE 829 Standard for Software Test Documentation
• IEEE Standard for Configuration Management in Systems and Software Engineering. 2012. doi:10.1109/IEEESTD.2012.6170935. ISBN 978-0-7381-7232-3.
• MIL-STD-973 Configuration Management (cancelled on 20 September 2000)
• NATO STANAG 4427 Configuration Management in Systems Life Cycle Management including
• NATO ACMP 2000 Policy on Configuration Management
• NATO ACMP 2009 Guidance on Configuration Management
• NATO ACMP 2100 Configuration Management Contractual Requirements
• CMMI CMMI for Development, Version 1.2 Configuration Management
• CMII-100E CMII Standard for Enterprise Configuration Management
• Extended List of Configuration Management & Related Standards
• ITIL Service Asset and Configuration Management
• ISO 20000:1 2011& 2018 Service Management System.
• ECSS-M-ST-40C Rev.1 Configuration and information management

Guidelines

• IEEE 828-2012 Standard for Configuration Management in Systems and Software Engineering, published date:2012-03-16
• ISO 10007:2017 Quality management – Guidelines for configuration management
• NATO ACMP-2009 – Guidance on configuration management
• ANSI/EIA-632-1998 Processes for Engineering a System
• ANSI/EIA-649-1998 National Consensus Standard for Configuration Management
• GEIA-HB-649 – Implementation Guide for Configuration Management
• EIA-836 Consensus Standard for Configuration Management Data Exchange and Interoperability
• MIL-HDBK-61B Configuration Management Guidance, 7 April 2020
• MIL-STD-3046 Configuration Management, 6 March 2013 and canceled on June 1, 2015
• Defense Acquisition Guidebook, elements of CM at 4.3.7 SE Processes, attributes of CM at 5.1.7 Lifecycle support
• Systems Engineering Fundamentals, Chapter 10 Configuration Management
• Configuration Management Plan United States Dept. of Defense Acquisition document

Construction

More recently configuration management has been applied to large construction projects which can often be very complex and have a huge number of details and changes that need to be documented. Construction agencies such as the Federal Highway Administration have used configuration management for their infrastructure projects. There are construction-based configuration management tools that aim to document change orders and RFIs in order to ensure a project stays on schedule and on budget. These programs can also store information to aid in the maintenance and modification of the infrastructure when it is completed. One such application, CCSNet, was tested in a case study funded by the Federal Transportation Administration (FTA) in which the efficacy of configuration management was measured through comparing the approximately 80% complete construction of the Los Angeles County Metropolitan Transit Agency (LACMTA) first and second segments of the Red Line, a $5.3 billion rail construction project. This study yielded results indicating a benefit to using configuration management on projects of this nature.