Templates and records · ISO 20000 · Clause 8.2.6

ISO 20000-1 configuration item record (CMDB)

The map of what underpins each service: servers, applications, contracts, certificates or documents, with their relationships, status and change history.

In one sentence

The configuration item record uniquely identifies each item, its type, description, relationships with other items and services and its status, with traceability of its changes, because clause 8.2.6 of ISO/IEC 20000-1 requires configuration item types to be defined, their information recorded at an appropriate level of detail, their changes controlled and the accuracy of the information verified at planned intervals.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 20000 · Clause 8.2.6 Clauses are cited using the numbering of ISO/IEC 20000-1:2018, the current edition and the same one the Academy uses.
Type of information: Mandatory record Configuration information recorded and verified (8.2.6)
Who fills it in: Configuration manager Each technical team updates the items it manages, always through a change
When: When the item is added and at every change Accuracy verified at least annually, or at the frequency in the plan
How long it is kept: Set by the organisation The standard requires control of the retention and disposition of documented information (7.5.3) without setting periods. It is usual to cover at least the three-year certification cycle, or the term of the customer contract if longer.

What the standard requires

What ISO 20000 demands and what it leaves to your judgement

The organisation defines the configuration item types — hardware, software, services, documentation, contracts — and records their information at the level of detail appropriate to the criticality and type of service.

Changes to configuration items must be traceable and auditable, to maintain the integrity of services and their components, and are controlled through change management.

The accuracy of the information is verified at planned intervals and corrected where deficiencies are found. The standard does not require a configuration management database by that name; it requires the information and its control.

Read it in context: Service design and transition, in the ISO 20000 Academy

Structure

Fields the template should include

Unique identifier
Item type
Description, version and location
Owner
Services it supports
Relationships with other items
Status: in test, in production, retired
Change history with change numbers
Date of last verification

Example

Example: mail server certificate

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Identifier	CI-CERT-019
Type	Server digital certificate
Description	TLS certificate for the email service · expires on 12 July 2027
Owner	Systems team
Service	SRV-04 email and collaboration
Relationships	Installed on CI-MAIL-01 · issued by an external certificate authority (CI-SUP-03)
Status	In production
Changes	CHG-26-077 (registration) · CHG-26-102 (early renewal)
Verification	15 September 2026 · matches the server

At the audit

Mistakes auditors commonly flag

A configuration database nobody updates that does not reflect reality.
Items with no relationships: there is no way to tell which services a fault affects.
Changes to items that do not go through change management.
No periodic verification of accuracy.
Excessive detail on low-criticality items, making the record unmanageable.

In Kimobox

How this record is kept in Kimobox

1Configuration items are recorded as versioned assets.
2Each change keeps its approval and outcome in the same workflow, linked to the item.
3Periodic verification is scheduled as a task with a date and a reminder.

Frequently asked questions

What people ask us before getting started

Is a CMDB mandatory?

ISO/IEC 20000-1 does not require any particular tool. It requires configuration information to be recorded at an appropriate level of detail, its changes controlled and its accuracy verified. A configuration management database is the usual way of doing this.

What is the difference between an asset and a configuration item?

Asset management (8.2.5) deals with the value and life cycle of resources; configuration management with the items that must be controlled to deliver the services, and their relationships. Many assets are also configuration items, but not all.

Keep your ISO 20000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring