CM Policy
Policy is leadership. Your organization needs to implement Policy statements in the form of "though shall" which support the objectives of the Configuration Management function. I have had the opportunity to write policy statements that were sent out with the signature of the CIO of a large firm. There two things that I realized were necessary. The first is that I needed to be very brief or no one would actually read the whole policy. The second was that the Policy statements needed to provide the vision for the future use of CM on a large scale basis. Frankly, I decided to keep things very simple with three short statements:

1.       All source code and compile dependencies must be under source code control (read locked down securely here).

2.       All runtime dependencies had to be traceable and also under lock and key.

3.       All releases in production must be easily identifiable and there must be a clear procedure to get the exact source used to create that release.

Policy is important leadership and sets the stage for your success or failure. Make sure that you work hard to get senior management's support for your CM effort and make sure that you also get them to put that support in writing.

CM Standards and Frameworks 
There are many standards and frameworks which support Configuration Management as well as Change Management. CM is discussed in a number of the ISO and IEEE standards including the IEEE 12207 life cycle standard which can be understood in terms of software development or systems or service engineering. The IEEE standard discusses the CM plan along with the EIA 649-A National Consensus Standard for Configuration Management. ITIL is moving CM practices forward with their excellent focus on service level management and the very popular Configuration Management Database (CMDB). But from an IT Governance and compliance perspective Cobit has to take center stage.

The isaca Cobit 4.1 framework is one of the leading tools for implementing practices which support IT Governance and Compliance.

DS9 - Manage the Configuration

Ensuring the integrity of hardware and software configurations requires the establishment and maintenance of an accurate and complete configuration repository. This process includes collecting initial configuration information, establishing baselines, verifying and auditing configuration information, and updating the configuration repository as needed. Effective configuration management facilitates greater system availability, minimises production issues and resolves issues more quickly.

There are the activities that are required by the framework:
1. Develop configuration management planning procedures. 
2. Collect initial configuration information and establish baselines.
3. Verify and audit configuration information (includes detection of unauthorised software).
4. Update configuration repository

There is a lot more to Cobit (that supports CM) and CM practitioners should know about all of the standards and frameworks that impact CM. The good news is that you have to right place to learn about them! At CM Crossroads we are raising the stakes in supporting IT Governance and Compliance with CM best practices along with educating our readers on standards, frameworks and best practices that are essential to create effective CM solutions.

CM Procedures 
Procedures should be written at a generic - tools agnostic - level. Creating baselines, supporting variants in the code and identifying configuration items (e.g. compile and runtime dependencies) are all essential tasks involved with writing CM procedures. Good procedures come from the activities described in the standards and frameworks.

CM Best Practices 
Best practices often get down to the trenches and are often tools specific. CM Crossroads is the best place to learn CM best practices because you share them with your colleagues.

IT Governance and compliance is about providing senior management with the visibility that they need to make the right decisions and keep the IT organization in alignment with the rest of the corporation. Aligning IT Policies with Corporate policies is essential. Adopting the right Policies, standards, frameworks, procedures and best practices are essential tools in successfully establishing IT Governance and Compliance in your organization.

Bob Aiello is the Editor-in-Chief for CM Crossroads and an independent consultant specializing in Software Process Improvement including Software Configuration and Release Management. Mr. Aiello has over 25 years experience as a technical manager in several top NYC Financial Services firms where he had had company-wide responsibility for CM, often providing hands-on technical support for enterprise Source Code Management tools, SOX/Cobit compliance, build engineering, continuous integration and automated application deployment. Bob is a long standing member of the Steering Committee of the NYC Software Process Improvement Network (CitySPIN), where he serves as the chair of the CM SIG. Mr. Aiello holds a Masters in Industrial Psychology from NYU and a B.S. in Computer Science and Math from Hofstra University. You may contact Mr. Aiello at raiello@acm.org This e-mail address is being protected from spam bots, you need JavaScript enabled to view it   or link with him at http://www.linkedin.com/in/bobaiello

Trackback(0)

TrackBack URI for this entry

Comments (2)

Subscribe to this comment's feed

Bob Aiello said:

	... sorry I am a little jaded by the Deming principle of "drive out slogans". I prefer to know what YOU think and believe is necessary and advisable.
	report abuse vote down vote up

April 22, 2008
Votes: +0

Hans Thelosen said:

	... For me a practical description of CM Policy is provided by Delta-Axiom in their "Configuration Management at a glance - or two" poster: CM Policy: . Definition of CM . Activities to perform . Quality goals for CM . Approach to improvement . Authority, standards
	report abuse vote down vote up

April 22, 2008
Votes: -1

Write comment