Understanding Configuration Management

There are so many different definitions of the term "configuration management" that one could easily fill up a small book with them. Different industries take different views into configuration management and what works for software developers, for example, may be quite different than what works for civil engineers.

Most major standards organizations like the British Standard Association and the Institute of Electrical and Electronics Engineers (IEEE) have formalized definitions of configuration management which attempt to be generic enough to cover most situations. Major software configuration management tool vendors have their own definitions and other industries have their favorite view into configuration management.

Probably the most generic working definition of configuration management comes from the U.S. Department of Defense in their 'DoD-Mil-Std-973' document which states:

"Configuration Management (CM) is a discipline that applies technical and administrative direction and surveillance over the lifecycle of items to:"

But what does all the techno-speak mean in plain English? In its simplist form, configuration management means:

1. Developing a formalized approach to knowing how "something" works. That "something" could be an internal manufacturing process, an accounting procedure, a software system, or anything else which is considered critical to the operation of the organization and which is subject to change from within our without the organization for any reason.
2. Putting a procedure in place for handling changes to the way that this "something" works. This procedure might be pre-approved methodologies which define how change can be affected, definitions of what person or teams are allowed to effect change, and what procedures exist to gain approval for effecting those changes.
3. Developing a formalized methodology for documenting the configuration changes including the steps which were taken, what results the changes are designed to produce and the current status of the project.
4. Developing a formal system to monitor the results of the changes and to ensure that the changes continue to provide the level of service that the organization requires and expects.

One of the biggest motivators for the use of configuration management these days is the The Sarbanes-Oxley Act. Designed to shine more light into the financial operations of U.S. public corporations, and equipped with its own set of fines and potential prison terms for violators, the Act is a force to be reckoned with by the nation's top CEOs and CFOs.

One particular requirement of Sarbanes-Oxley requires the organization to document and manage "the nature and characteristics of a company's use of information technology in its information system affect the company's internal control over financial reporting."

One of the best ways to remain in compliance with those requirements is to have a well planned, functioning and monitored configuration management system in place. Nothing short of that is "good enough".

Configuration Management Books