CIS-DF Certified Implementation Specialist - Data Foundations (CMDB and CSDM) Questions and Answers

In Data Foundations, “Configuration” includes modeling CI relationships in a way that reflects real-world technology dependencies and supports operational use cases such as impact analysis, troubleshooting, and service mapping. For “Application Servers host Applications,” the scenario describes that multiple Application Servers can host one or more Applications. In most enterprise environments, the reverse is also true: an Application can be hosted across multiple Application Servers (for example, horizontal scaling, clustered deployments, active-active architectures, and separate servers for different tiers or components of the same application).

Because both sides can have multiple related records, the correct logical relationship is many-to-many:

One Application Server → hosts many Applications

One Application → can be hosted on many Application Servers

In ServiceNow CMDB terms, many-to-many relationships are represented through the CMDB relationship model (parent/child relationships), enabling the platform to store multiple relationship records linking servers and applications without forcing an unnatural single-reference constraint. This supports better CMDB quality and stronger downstream outcomes—especially for incident triage (“what apps are affected if this server is down?”) and change impact analysis (“what servers could be impacted if we change this app component?”).

A one-to-many or many-to-one model would incorrectly restrict either the server to one application or the application to one server, which does not align with common hosting patterns and would reduce the CMDB’s usefulness and accuracy.

Within the Common Service Data Model (CSDM), regulatory, security, and compliance-related information—especially for PII and PCI—must be modeled at the business and information level, not at the infrastructure or service offering level. The correct location for this data is Business Applications combined with Information Objects.

Business Applications represent the logical applications that support business capabilities and processes. Since compliance obligations (such as GDPR, PCI-DSS, or HIPAA) are assessed based on how the business uses data—not how many servers host the application—this is the correct anchor point for audit-relevant context.

Information Objects are explicitly designed to capture what data is processed, stored, or transmitted by an application, including data classifications such as PII, PCI, PHI, or confidential business data. They allow organizations to document regulatory scope, retention rules, encryption requirements, and audit controls without overloading CI records or polluting infrastructure classes.

Option A is incorrect because Technical Service Offerings and Groups focus on operational support and service delivery, not regulatory data context. Option C is also incorrect because Customer Service Offerings describe how services are consumed, while databases are technical components; neither is the authoritative place for compliance definitions.

Therefore, Business Applications and Information Objects are the correct CSDM constructs to support audits and regulatory compliance, making Option B the correct answer.

Within Data Foundations, “Configuration” includes designing the CMDB data model in a way that supports operational usability—especially for ITSM processes like Incident and Change. One common usability challenge is that CI reference fields (such as the Incident “Configuration item” field) can become cluttered and confusing if they allow selection from every CI class, including highly technical or rarely used classes. To address this, ServiceNow uses the concept of Principal Classes: a curated subset of CI classes that are considered primary for operational selection and reporting.

Principal Classes are designated in the CI Class Manager, because this is where administrators configure and manage CI class behaviors and class-level settings. Defining Principal Classes at the class-management layer ensures that the platform can consistently apply this constraint across CI reference fields and related experiences. This aligns with Data Foundations goals: improving data quality and process outcomes by making it easier for users to select the correct CI, which in turn increases accuracy for assignment, routing, impact analysis, and analytics.

The other options do not fit the responsibility. CMDB Workspace is primarily used for exploring and analyzing CMDB data, not configuring class-level constraints. CMDB Data Manager focuses on governance automation (like lifecycle policies and bulk remediation operations), not CI class designation rules. System Properties may influence global behaviors, but Principal Class designation is a modeling configuration handled through CI class configuration, which is why CI Class Manager is the correct location.

In CMDB governance, different CMDB Data Manager policy types serve different validation and enforcement purposes. When the objective is to allow an assigned individual to review and update specific fields on a CI record, the correct policy type is Certification.

A Certification policy creates actionable tasks that require the assignee to validate and, if necessary, correct specific CI attributes, such as lifecycle status, support group, environment, or ownership. During certification, the user can directly update CI fields to bring the record into compliance with defined standards.

Attestation (Option C) only asks the user to confirm that a CI still exists or is still valid; it does not require or enable attribute-level updates. Audit (Option A) is used for reporting and evidence collection, not remediation. Compliance (Option D) measures adherence to rules but does not itself generate editable remediation tasks.

Certification is therefore the primary mechanism used when human validation and correction of CI data is required—making it a cornerstone of CMDB data quality management.

Hence, the correct answer is B – Certification.

In ServiceNow, controlling source precedence when multiple authorized data sources update the same CI attributes is a core responsibility of Identification and Reconciliation Engine (IRE) governance.

The correct and supported method is to assign priority to each data source in reconciliation rules. Reconciliation rules determine which source wins when multiple sources attempt to update the same attribute on a CI. By defining source precedence, the Configuration Manager ensures that the most authoritative system of record (for example, Discovery over manual imports, or HR systems over spreadsheets) consistently controls specific attributes or classes.

Option B is incorrect because manually sequencing data source runs is unreliable, does not scale, and violates Data Foundations best practices. Option C only controls how often data is refreshed, not which source is authoritative. Option D is incorrect because identification rules are used to uniquely identify CIs—not to control attribute-level precedence.

Using reconciliation rules provides deterministic, auditable, and automated control, which is essential for maintaining CMDB trust and avoiding data conflicts.

Therefore, the correct answer is A – Assign a priority to each data source in reconciliation rules.

In CMDB modeling, accurately defining relationships is critical for impact analysis, service mapping, and Change Management. In this scenario, Application Servers can host multiple Applications, and Applications can also run across multiple Application Servers (for example, in clustered, load-balanced, or distributed architectures).

This architectural reality defines a many-to-many relationship between the Application Server table and the Application table.

In ServiceNow, many-to-many relationships are common for application hosting models, especially in modern environments that use horizontal scaling, redundancy, or containerized workloads. Modeling this correctly ensures that incidents, changes, and outages affecting a single server can be accurately traced to all impacted applications—and vice versa.

A one-to-many or many-to-one relationship would incorrectly assume exclusivity in one direction, which does not reflect real-world application deployment patterns. A one-to-one relationship would be even more restrictive and inaccurate.

Therefore, the correct relationship type is A – Many-to-many, which aligns with CMDB best practices and CSDM service modeling principles.

In Data Foundations, “Govern” is about putting repeatable, controlled mechanisms in place to keep CMDB data healthy over time. Duplicate CI cleanup is a governance activity because duplicates degrade trust, break reporting, create incorrect service impacts, and cause operational confusion (for example, incidents linked to the wrong CI). The preferred approach is to use the guided and purpose-built de-duplication experience designed for CMDB administrators rather than relying on generic task lists or ad-hoc work.

The de-duplication dashboard in CMDB Workspace is the preferred place because it centralizes duplicate identification, prioritization, and remediation in a single operational experience. It typically provides visibility into suspected duplicates, helps users review records side-by-side, and supports controlled actions (such as merge/retire workflows, depending on configuration) while maintaining auditability. This aligns with Data Foundations’ emphasis on standard processes and consistent remediation patterns rather than one-off manual fixes.

“My Tasks” is a generic work queue and does not provide the purpose-built context or tooling required to confidently resolve duplicates in a safe, repeatable way. A standalone “de-duplication task module” may exist as a navigation entry, but the recommended operational method is to use the workspace dashboard where duplicate remediation is organized and guided as part of CMDB health and governance. Therefore, the correct answer is the de-duplication dashboard on CMDB Workspace.

CSDM significantly enhances Change Management by providing service-aware context, enabling better planning, risk assessment, and stakeholder communication.

One key benefit is the ability to identify blackout windows (Option A). Through CSDM-aligned Business Services, Service Offerings, and service calendars, Change Managers can clearly see when services are unavailable for change due to business constraints, regulatory requirements, or peak usage periods. This helps prevent changes from being scheduled during high-risk windows.

Another critical benefit is the ability to understand the impact of the change on services (Option D). CSDM establishes clear relationships between infrastructure CIs, Application Services, and Business Services. When a change is proposed, these relationships enable accurate impact analysis, allowing Change Managers to assess risk based on business criticality rather than just technical scope.

Option B (root cause determination) is primarily a Problem Management function. Option C (dynamic routing of changes) is driven by workflow and approval logic, not directly by CSDM.

Therefore, the correct answers are A – Identify blackout windows and D – Understand the impact of the change on services.

The Agent Client Collector (ACC) in ServiceNow is designed to collect inventory data from endpoints that are not consistently reachable by traditional Discovery methods. ACC is especially valuable where credential-based, network-based discovery is impractical or impossible.

Devices in secure environments (Option C), such as isolated networks, restricted zones, or highly regulated environments, often block inbound discovery traffic. ACC runs locally on the device and securely sends inventory data outward, making it ideal for these scenarios.

Devices that intermittently connect to the network (Option D), such as laptops, remote endpoints, or roaming devices, are another core use case. Traditional Discovery requires the device to be reachable during scheduled scans, which is unreliable for mobile or off-network assets. ACC ensures inventory data is collected whenever the device is online.

Option A (data center servers) is better served by agentless Discovery, which provides deeper infrastructure and relationship data. Option B (network devices in the DMZ) are typically discovered using SNMP and network discovery, not ACC.

ACC complements Discovery as part of a layered ingestion strategy, ensuring accurate inventory coverage across diverse environments.

Therefore, the correct answers are C – Devices in secure environments and D – Devices that intermittently connect to the network.

The Run tab in the CSDM Data Foundations Dashboard focuses on enabling operationalized, risk-aware use cases, including Integrated Risk Management (IRM) and Entity Scoping. These use cases require organizations to understand what data is processed, where it resides, and which technical components are involved, rather than only service impact for ITSM.

Information Objects play a central role at this stage.

Option A is correct because Business Applications related to Information Objects allow organizations to identify what types of data (PII, PCI, PHI, regulated data) are processed by each business application. This relationship is essential for risk classification, regulatory compliance, and audit scoping in IRM. Without it, risk assessments lack data sensitivity context.

Option D is also correct because Logical CIs (such as databases, schemas, or data stores) related to Information Objects establish where sensitive data is stored or processed at a technical level. This enables IRM to trace risk from business context down to technical exposure, supporting control testing, issue management, and remediation prioritization.

Option B (Location hierarchy) supports foundational data quality but does not directly enable risk or entity scoping. Option C (Business Applications to Application Services) is critical for service impact and Change/Incident Management, but it is more aligned to service operations rather than risk and data-centric scoping, which is the focus of the Run playbooks for IRM.

Therefore, the correct answers are A and D, as they directly support IRM entity scoping, regulatory analysis, and risk visibility through CSDM-aligned data modeling.

The CMDB Data Foundations Dashboard is paired with Get Well Playbooks that guide administrators through structured remediation. The “Services Have Owners Identified” playbook focuses on closing ownership gaps for services, which is a governance and data correction activity.

Fix Data (Option A) is used to correct missing or incorrect values, such as populating owner fields, assigning responsible groups, or updating relationships. In this playbook, Fix Data actions are required to actually remediate the issue by assigning owners to services.

Govern Data (Option D) is also required because ownership is not a one-time correction—it must be enforced and sustained. Govern Data establishes policies, ownership accountability, and controls (such as certifications or attestations) to ensure services continue to have owners over time and do not regress.

Analyze Data (Option B) is used to understand patterns and root causes, but it does not remediate the issue. Report Data (Option C) provides visibility and communication, not corrective action.

Therefore, the remediation plays that apply to the Services Have Owners Identified playbook are Fix Data and Govern Data, making Options A and D correct.

In Data Foundations, “Insight” includes measuring CMDB health in ways that are actionable—so teams can identify where data is degrading and prioritize remediation. Stale CIs (records that are no longer current, not updated, or no longer exist in the environment) are a common source of CMDB risk: they distort reporting, mislead impact analysis, and create noise for operational processes. Reducing staleness supports higher trust in the CMDB and better decision-making.

On the CMDB Health Dashboard, stale CI concerns align most closely with Compliance because staleness is fundamentally about whether CIs continue to meet defined governance expectations over time—such as update frequency, lifecycle status controls, and adherence to rules that indicate whether records are still valid. Compliance scorecards typically highlight rule-based adherence to standards (for example, policies or health rules indicating that certain CI types must be recently updated or must not exceed staleness thresholds). This makes Compliance the right place to monitor and improve staleness.

By contrast, Completeness focuses on whether required attributes are populated (for example, owner, environment, support group). Correctness focuses on whether values are accurate and relationships make sense. While stale records can indirectly affect correctness, the dashboard tracking of “stale” is primarily treated as a governance adherence issue—whether the CMDB is being maintained according to lifecycle and freshness expectations—therefore it is surfaced through the Compliance scorecard.

When organizations transition from legacy CMDB status fields (such as custom install status or operational status values) to CSDM-aligned lifecycle status fields, the goal is to map old values to standardized lifecycle stages without disrupting existing processes. In ServiceNow, this is achieved through the Life Cycle Mapping table.

The Life Cycle Mapping table is specifically designed to translate legacy or custom status values into CSDM lifecycle stages and statuses. This allows organizations to preserve historical data and integrations while progressively adopting CSDM standards. By modifying this table, administrators can define how existing status values correspond to CSDM lifecycle stages such as Plan, Build, Deploy, Operate, and Retire.

The Life Cycle Stages table (Option A) defines the standard stages themselves and should not be modified, as these are core to CSDM governance. Life Cycle Stage Status (Option C) defines valid statuses within a stage and is also part of the standardized model. Life Cycle Controls (Option D) enforce governance rules but do not perform value translation.

Therefore, to safely transition from legacy status fields to CSDM lifecycle statuses, the correct and supported approach is to modify the Life Cycle Mapping table, making Option B the correct answer.

The CMDB Data Manager is the ServiceNow capability responsible for generating actionable governance tasks and assigning them to CI class owners and data stewards. These tasks appear directly in the “My Work” tab within the CMDB Workspace, enabling proactive and role-based CMDB governance.

CMDB Data Manager focuses on data lifecycle management, including archival, retirement, and cleanup of CIs based on defined policies. When lifecycle rules or retention thresholds are met—or when human validation is required—the Data Manager creates tasks to prompt responsible owners to take action. This ensures that CMDB data remains accurate, compliant, and lean over time.

The CMDB Health Dashboard (Option C) provides visibility into health metrics such as completeness, correctness, and compliance, but it does not generate tasks. Similarly, De-duplication templates (Option A) support duplicate identification and remediation workflows, but they do not create ongoing governance tasks in the CMDB Workspace.

By surfacing tasks in “My Work,” CMDB Data Manager operationalizes governance and embeds accountability into daily workflows, which is a key principle of CMDB Data Foundations.

Therefore, the correct answer is Option B – CMDB Data Manager.

Comprehensive and Detailed Explanation (200–300 words)

Within ServiceNow Data Foundations, CMDB Data Manager provides multiple policy types to support governance, data quality, and lifecycle management of configuration items (CIs). The scenario described—confirming that servers recorded in the CMDB physically exist in the data center—is a classic example of existence validation and ownership confirmation, which is exactly the purpose of an Attestation policy.

An Attestation policy is designed to request a human validation from a responsible individual or group (such as a data center manager, platform owner, or infrastructure team). The policy generates attestation tasks that require reviewers to explicitly confirm whether a CI is valid, accurate, and still exists. This aligns directly with CMDB governance best practices and ITIL 4 Service Configuration Management, where periodic verification ensures trust in the CMDB as a system of record.

The other policy types do not meet this requirement:

Certification is typically used to validate compliance with defined data standards (e.g., mandatory fields populated), not physical existence.

Delete, Archive, and Retire are lifecycle actions, used after a CI has already been identified as obsolete or no longer required.

None of these options involve human confirmation of real-world existence.

From a CSDM and Data Foundations perspective, attestation supports:

CMDB accuracy and credibility

Audit and regulatory compliance (especially critical in financial services)

Clear accountability for CI ownership and validation

Therefore, when the goal is to confirm that servers actually exist, the correct and fully aligned CMDB Data Manager policy type is Attestation (E).

Principal Classes are a key CMDB configuration concept used to control which CI classes are selectable in reference fields across ITSM processes. This helps reduce noise, prevent incorrect CI selection, and improve data quality.

In ServiceNow, Principal Classes are designated within the CI Class Manager. This tool allows CMDB administrators to manage the CI class hierarchy, define ownership, and explicitly mark classes as principal. Once a class is marked as principal, its CIs become available in CI reference fields such as those on Incident, Change, and Problem forms.

Option A (CMDB Workspace) provides operational and analytical views but does not control schema-level class behavior. Option C (System Properties) does not manage class designation. Option D (CMDB Data Manager) governs lifecycle and data quality policies, not reference field behavior.

By configuring Principal Classes in the CI Class Manager, organizations ensure that only relevant, high-value CI classes are exposed to end users, aligning with Data Foundations best practices.

Therefore, the correct answer is B – CI Class Manager.

Creating new CI classes is a high-impact configuration activity and must follow strict Data Foundations and CSDM-aligned best practices to avoid long-term technical debt and upgrade risk.

Option B is a recommended first step. Before creating any new CI class, administrators should install or update the CMDB CI Class Models Store application and verify whether an appropriate class already exists. ServiceNow frequently delivers new CI classes through updates and class model packages, and duplicating an existing or planned class can lead to fragmentation and governance issues.

Option C is also correct. When a new class is truly required, it should be added under an appropriate parent class to inherit attributes, behaviors, and discovery patterns. For an IoT Sensor, this might be under a hardware or device-related parent class, ensuring consistency and minimizing customization.

Option A is incorrect and dangerous—deleting unused classes can break dependencies and historical data. Option D is also discouraged; modifying existing classes to repurpose them violates upgrade-safe design principles and can negatively impact discovery, integrations, and reporting.

By verifying existing models first and extending the class hierarchy correctly, organizations maintain a clean, scalable, and upgrade-safe CMDB.

Therefore, the correct answers are B and C.

In Data Foundations, the “Insight” topic is about making CMDB and service data easy to discover, understand, and use for operational decisions. Natural Language Queries (NLQ) support this by enabling admins and practitioners to ask questions in plain language (for example, finding specific CIs, services, or relationships) and quickly retrieve relevant results without navigating multiple tables and filters.

NLQ is performed in CMDB Workspace because CMDB Workspace is the primary user experience for exploring configuration data, visualizing relationships, and consuming insights from the CMDB in a guided way. It is designed as the central hub where CMDB users validate CI information, examine dependencies, and use workspace capabilities to troubleshoot and analyze. NLQ fits naturally here: it accelerates discovery and analysis by reducing the need for advanced query building and manual report construction.

The other options are not the correct home for NLQ in the Data Foundations context. The CMDB Health Dashboard is focused on KPIs, completeness, correctness, and compliance scoring—showing what is wrong, not serving as the main interface for free-form natural language exploration. CI Class Manager is used for class modeling and class configuration tasks. CMDB Data Manager is used for governance automation such as lifecycle policies (attestation, archival, deletion) and controlled data operations. Therefore, the correct place for administrators to perform NLQ for CMDB exploration and analysis is CMDB Workspace.

In a mature CMDB implementation within ServiceNow, CI operational attributes are leveraged to automate ITSM workflows. One of the most important outcomes of accurate Configuration Management is automatic incident routing.

When a CI is selected on an Incident record, ServiceNow evaluates the CI’s Support Group attribute. If populated correctly, the platform automatically copies this value into the Assignment Group field on the Incident. This ensures incidents are routed to the correct resolver group without manual triage, reducing mean time to resolution (MTTR).

The Support Group is a CI attribute, not an incident field that drives workflow directly. The Assignment Group is the operational field used by Incident Management to assign ownership. Managed by Group, Approval Group, and Change Group are used in other governance and lifecycle contexts and are not auto-populated during incident creation.

This behavior is a direct result of Data Foundations best practices: maintaining accurate CI-to-support-group relationships to enable automation and consistency across ITSM processes.

Therefore, the correct answer is C – Assignment Group.

The CMDB Health Dashboard is a central component of CMDB Data Foundations insight and governance. It measures and tracks data quality using well-defined health indicators that focus on the accuracy, relevance, and usability of CI data.

Two key data quality areas included in the dashboard are Stale CIs and Duplicate CIs.

Stale CIs (Option D) refer to configuration items that have not been updated within a defined time window. These records are risky because they may no longer reflect the current state of the environment, leading to inaccurate impact analysis, poor change decisions, and misrouted incidents. Monitoring staleness helps organizations identify where discovery, integrations, or ownership processes are failing.

Duplicate CIs (Option E) occur when the same real-world asset or service is represented by multiple records. Duplicates undermine trust in the CMDB, distort reporting, and break service mappings. The CMDB Health Dashboard highlights duplicate trends and integrates with de-duplication and remediation workflows to address them.

Options A (Downgraded CIs), B (Upgraded CIs), and C (Missing CIs) are not standard CMDB Health Dashboard quality dimensions. While “missing” data may be inferred through completeness checks, Missing CIs as a category is not directly tracked.

Therefore, the correct answers are D – Stale CIs and E – Duplicate CIs, which are core CMDB Health indicators used to maintain high-quality configuration data.

The Unified Map in ServiceNow provides a consolidated view of services and their underlying components, integrating Discovery and Service Mapping data. To make this view actionable, Service Owners can apply filters to focus on relevant elements and reduce visual noise.

Filtering by CI type (Option A) is a core capability. It allows the Service Owner to show or hide categories such as servers, databases, load balancers, or applications—making it easier to analyze specific layers of the service.

Filtering by Business Criticality (Option D) is also available and highly valuable. This enables Service Owners to prioritize views around high-impact components, ensuring attention is focused on CIs that pose the greatest risk to service delivery.

Option B (Discovery source) is not typically exposed as a Unified Map filter because the map focuses on operational and service context, not ingestion provenance. Option C (Managed by group) is a governance attribute and is not a standard visual filter within the Unified Map.

Thus, the correct filter options are A – CI type and D – Business criticality.

When building advanced CMDB queries using CMDB Query Builder in ServiceNow, the correct approach is to model CI scope, relationships, and task context explicitly on the canvas.

To limit results to databases in a specific location, the administrator must filter the Database CI node by the Location attribute. Therefore, Option C is required to scope the query to Database CIs where Location = Seattle.

To include Incidents related to those databases, the Incident table must be added from the Non-CMDB Tables list and linked through the task_ci relationship. This is exactly what Option A provides. CMDB Query Builder separates CMDB tables (CIs) from task and transactional tables, so incidents must be explicitly added from the Non-CMDB section.

Option B is incorrect because property columns on Application Services do not scope databases or incidents. Option D is unnecessary because relationship depth alone does not include non-CMDB task data and does not filter by location.

Thus, the correct actions are A (add Incident table) and C (filter Database by location).

Application Service Mapping is a critical capability in ServiceNow for enabling business-aware Change Management. Its primary value is not in identifying physical shutdown sequences or CI locations, but in translating technical changes into business impact.

When an organization plans a data center move, multiple infrastructure components—servers, databases, network devices—may be affected. On their own, these technical CIs provide little insight into business risk. Application Service Mapping connects these CIs to Application Services and Business Services as defined by the Common Service Data Model (CSDM). This relationship allows Change Managers to see which business services, customers, and processes are impacted by the planned change.

By leveraging service maps, Change Management can answer critical questions such as:

Which customer-facing services may experience downtime?

What revenue-generating or mission-critical services are at risk?

Which stakeholders must be notified or involved in approvals?

Option A is incorrect because service mapping does not determine shutdown order; that is handled by infrastructure planning. Option C focuses on physical location data, which is typically managed through Location CIs and Discovery, not service mapping.

Therefore, the correct answer is B – To understand the business impact of CIs, which aligns directly with ITIL 4, CSDM, and Change Management best practices.

In ServiceNow, validating whether Configuration Items (CIs) still exist is a core CMDB governance activity. Over time, environments change rapidly—servers are decommissioned, cloud resources are torn down, and applications are replaced. If existence validation is not enforced, the CMDB quickly fills with obsolete or “ghost” CIs.

Attestation policies are specifically designed to address this need. An attestation policy automatically generates and assigns tasks to responsible users or groups, asking them to confirm that a CI still exists and is still relevant. This process focuses on acknowledgment rather than deep data validation, making it lightweight and scalable across large CMDBs.

Certification policies (Option A) are used when specific attributes must be validated, such as lifecycle status, support group, or environment. While important for data correctness, certification is not intended solely to confirm CI existence. Delete (Option B) and Retire (Option C) policies are lifecycle actions that remove or transition records, but they do not validate existence before taking action.

Attestation integrates cleanly with CMDB Workspace, assigns tasks automatically, and supports auditability—ensuring accountability for CI ownership. This makes it the correct and Data Foundations–aligned policy type for validating CI existence.

Therefore, Option D – Attestation is the correct answer.

CSDM is designed to connect technology delivery to business consumption so organizations can answer questions like “who is impacted?” quickly and consistently. In a critical incident, the healthcare provider needs to identify impacted users in business terms—clinicians, admin teams, specific sites, or departments—rather than only listing technical components.

Option D (“Service Offerings by Department or Location”) is the most CSDM-aligned data because it reflects who consumes the service and how that consumption is segmented. In CSDM, a Business Service / Service Offering represents what customers consume, and the offering can be associated with organizational constructs such as department, business unit, or location. For healthcare, this is especially valuable because impact is often location-based (hospital site, clinic) and role-based (patient intake, scheduling, ward operations). Using service offerings and their consumer mapping helps quickly identify likely impacted user groups and prioritize communications and workarounds.

Option A (environment attribute) helps differentiate production vs non-production and can support prioritization, but it does not identify impacted users. Option B is historical context, not a reliable mechanism to determine current impacted users. Option C is useful operationally for listing impacted configuration items, but it is ITSM task data, not specifically CSDM consumer modeling. CSDM’s value here is linking the technical disruption to the business consumer view via service offerings and consumption segmentation.