CIS-DF · Domain 3 of 5

CIS-DF Domain 3: Govern

Govern is the heaviest domain, about a third of the exam. It covers CMDB health metrics and dashboards, Data Manager policies, duplicate remediation, CMDB Workspace, principal classes, lifecycle attributes and the roles and processes that keep data trustworthy.

Exam weight estimate
35%
Official objectives estimate
16
Estimated questions estimate
~26
Suggested study time estimate
22–26 hrs

About 18 min read Reviewed October 2026

Overview

Domain 3 has sixteen blueprint objectives, the most of any domain, and they fall into four broad groups. Measurement: the six metrics behind the CMDB health score (required and recommended completeness, duplicate, orphan and stale correctness, and compliance), the CMDB Health Dashboard, and the CMDB Data Foundations Dashboard. Maintenance: CMDB Data Manager with its retire, archive, delete, attestation and certification policies, and the life cycle stage and status attributes.

Remediation covers how duplicates arise from identification gaps and how to resolve them with de-duplication tasks, templates and the deduplication wizard. Operating model covers governance goals, what is needed to govern, key roles such as CMDB manager, class owner and CI owner, principal classes, the CMDB Workspace and how to operationalise the CMDB inside ITSM processes.

How it's tested

Govern questions are usually scenarios about poor data quality or an unclear operating model. You identify the metric that measures the problem, the feature that fixes it, or the role responsible. Many items are multiple select, so check every option against the exact metric or policy definition.

  • Name the metric

    A data problem such as CIs without relationships or not updated for months is described, and you name the health metric that measures it.

  • Pick the Data Manager policy

    A lifecycle goal like confirming CIs still exist or removing retired records is given, and you choose attestation, certification, retire, archive or delete.

  • Who owns it

    A governance task is described, and you identify the role, such as CMDB manager, class owner or CI owner, accountable for it.

Reasoning it through

A stem says thousands of CIs have not been updated by any source for 90 days and the team wants owners to confirm whether they still exist before anything is removed. Options include a delete policy, an archive policy, an attestation policy and a de-duplication template. Attestation asks owners to confirm existence first, so it fits; retire, archive or delete policies come after confirmation.

Objectives 16

Official objectives from the ServiceNow outline, in outline order.

3.1 Identify the characteristics of the six metrics that make up the CMDB health scoreCompleteness, correctness and compliance in six metrics.
What it means
The CMDB health score combines three KPIs. Completeness uses required and recommended attribute metrics; correctness uses duplicate, orphan and stale metrics; compliance uses audit results against certification templates.
What to understand
Required fields are ones that must be populated; recommended fields are ones that should be. Duplicates are CIs matching other CIs under identification rules, orphans are CIs missing required relationships or meaningful context, and stale CIs have not been updated within the configured period. Compliance compares CIs with expected values defined in audits.
How it shows up
A stem describes a quality issue and asks which metric or KPI reports it.
Common confusion
Placing duplicates under completeness, or treating stale and orphan as the same problem.
3.2 Identify the purpose and/or requirements of Data ManagerPolicy-driven CI lifecycle and data maintenance.
What it means
CMDB Data Manager automates CI lifecycle actions through policies that target filtered sets of CIs, create tasks for owners where needed, and run on a schedule.
What to understand
Policies require a CI class, a filter condition and, for attestation or certification, an assignment to owners or groups. Data Manager depends on accurate ownership and lifecycle data. It replaces scripted cleanup jobs with governed, auditable policies and uses approval or review steps before destructive actions.
How it shows up
Expect a question on what must be in place before Data Manager policies can work well, such as ownership and lifecycle fields.
Common confusion
Thinking Data Manager is a reporting tool rather than an action engine.
3.3 Identify the goals of good CMDB governanceTrusted, scoped, owned and measured data.
What it means
Good governance aims for CMDB data that is accurate, complete for its purpose, owned and used by processes that deliver business value.
What to understand
Goals include defining scope by the services and processes that consume CI data, assigning accountability, setting KPIs and CSFs, controlling changes through ingestion standards and IRE, and reviewing health regularly. Governance favours fewer, well-maintained classes over collecting everything.
How it shows up
A question asks which goal justifies excluding a class from the CMDB scope.
Common confusion
Believing a bigger CMDB with more classes is automatically a better one.
3.4 Identify what is needed to govern the CMDBThe ingredients of a governance model.
What it means
Governing the CMDB needs a charter or plan, defined scope, roles and responsibilities, data standards, policies, measurement and a review cadence.
What to understand
In practice this means a CMDB governance board or steering group, documented class and attribute standards, approved data sources with reconciliation rules, health and Data Foundations dashboards, Data Manager policies and a process for requesting new classes. Without ownership and measurement, tools alone do not keep data accurate.
How it shows up
Scenarios ask for the first step when a CMDB has data but no owners or standards.
Common confusion
Starting with more discovery when the real gap is ownership and standards.
3.5 Identify the key roles involved in implementing and managing a CMDBWho does what in CMDB management.
What it means
Key roles include the executive sponsor, CMDB or configuration manager, CMDB administrator, CI class owner, CI owner or managed-by group, data steward and process owners for consuming processes.
What to understand
The configuration manager owns the overall process and governance; class owners define attributes and standards for their classes; CI owners keep individual CIs accurate and respond to attestation. Platform roles such as sn_cmdb_admin and sn_cmdb_editor control access in tools like CMDB Workspace.
How it shows up
A task such as approving a new attribute on a class is described and you choose the class owner.
Common confusion
Treating the CMDB administrator as the owner of every data value.
3.6 Identify how to configure and gain value from CMDB Health Dashboards to support Key Performance Indicators (KPI) and Critical Success Factors (CSF)Turning health scores into governance targets.
What it means
The CMDB Health Dashboard shows completeness, correctness and compliance scores, drillable by class and group, calculated by scheduled health jobs.
What to understand
Configure health inclusion rules to score only relevant CIs, set required and recommended fields, define staleness periods and audits, and set thresholds and weights. Link scores to KPIs, such as the percentage of production servers with owners, and to CSFs, such as accurate impact analysis for change. Review trends rather than single snapshots.
How it shows up
A question asks how to stop decommissioned CIs from lowering the health score, expecting health inclusion rules.
Common confusion
Assuming the dashboard updates instantly without the scheduled health jobs.
3.7 Identify how or why duplication records are created and how to remediate themRoot causes of duplicates and the fix process.
What it means
Duplicates appear when identification rules are weak, sources send inconsistent identifiers, data bypasses IRE, or manual entries are created for CIs that already exist.
What to understand
When IRE finds several matches, it creates a de-duplication task and, by default, updates only the oldest CI while flagging the others. Remediation includes choosing the CI to keep, merging attributes and relationships, retiring or deleting the others, and fixing the root cause in identification rules or ingestion. De-duplication templates can automate merging for recurring patterns.
How it shows up
Stems ask why duplicates keep returning after cleanup, expecting a root cause in identification or ingestion.
Common confusion
Cleaning duplicates without fixing the rule or source that creates them.
3.8 Identify when and how to remediate duplicate records using the deduplication wizardGuided merge of duplicate CIs.
What it means
The deduplication wizard, launched from a de-duplication task, guides an analyst through choosing the main CI and merging attributes, relationships and related items from the duplicates.
What to understand
Use it for individual or small sets of duplicates where a person must judge which values are right. For large, repeating patterns, de-duplication templates apply the same choices automatically. The wizard can retire or delete the duplicates once their data is merged.
How it shows up
A scenario with a few duplicates needing human judgment points to the wizard.
Common confusion
Using the wizard for thousands of duplicates that a template would handle.
3.9 Identify how to operationalize the CMDBMaking CMDB data part of daily work.
What it means
Operationalising means embedding CI data in processes such as incident, problem, change, event management and vulnerability response so people use and maintain it.
What to understand
Populate CI fields on tasks, use impact analysis in change, route incidents by support group from the CI, and give owners clear remediation tasks from health and Data Manager. Process owners should consume CMDB data and report quality issues back, which closes the loop.
How it shows up
A question asks how to increase the value of an accurate but unused CMDB.
Common confusion
Treating the CMDB as a standalone inventory project with no consuming processes.
3.10 Identify when or why to use the CMDB workspace or what features are availableThe Next Experience home for CMDB work.
What it means
CMDB Workspace is a Next Experience workspace that brings CMDB health, insights, search, Query Builder, Unified Map, Data Manager and class management into one interface.
What to understand
Its home page shows health and recommended actions, while management views reach Data Manager and governance tasks. Natural language search and CI views help analysts investigate. Access depends on CMDB roles, so analysts may see different features than administrators.
How it shows up
You are asked which interface gives configuration managers one place to review health and act on it.
Common confusion
Expecting CMDB Workspace to replace CI Class Manager or Discovery administration entirely.
3.11 Identify how to define principal classesLimiting which CIs users pick on tasks.
What it means
Principal classes are the CI classes that matter most to service operations, such as servers, applications, databases and services. They are flagged in CI Class Manager.
What to understand
When the principal class filter is active, configuration item reference fields on tasks such as incident or change show only principal class CIs, which stops users selecting low-level items like disks or network adapters. Health and reporting can also focus on these classes.
How it shows up
A stem says agents keep choosing network adapters as the CI on incidents, expecting the principal class filter.
Common confusion
Thinking principal classes control discovery or access rather than selection on tasks.
3.12 Identify the policy feature in Data Manager that should be used to accomplish the goal of the scenarioChoosing retire, archive, delete, attestation or certification.
What it means
Data Manager policy types are retire, archive, delete, attestation and certification, each suited to a different lifecycle goal.
What to understand
Attestation asks owners to confirm a CI still exists. Certification asks them to verify specific attribute values. Retire sets life cycle values to retired, archive moves CIs to archive tables, and delete removes them. A typical sequence is attest, retire, archive and finally delete, with review steps for destructive actions.
How it shows up
A scenario states a goal and asks for the single best policy type.
Common confusion
Confusing attestation (does it exist?) with certification (are its values correct?).
3.13 Identify how to validate data quality and/or data compliance in the CMDB Health DashboardAudits, certification filters and compliance scores.
What it means
Compliance in the health dashboard is calculated from audits that compare CI values with expected values defined in certification filters and templates.
What to understand
Define which CIs are audited with a certification filter, define expected attribute values in a template, schedule the audit, and review failures as remediation tasks. Completeness and correctness scores are reviewed alongside, and drill-downs show which CIs fail.
How it shows up
A question asks how to report CIs that do not meet a standard such as approved operating system versions.
Common confusion
Expecting completeness to catch wrong values, when it only checks whether fields are populated.
3.14 Identify how to configure Data Manager to manage the CMDBBuilding and running policies.
What it means
Configuring Data Manager means creating policies by type, choosing classes and filter conditions, setting assignment, review and approval options, and scheduling them.
What to understand
Start with narrow filters, preview affected CIs, and enable approvals for retire, archive and delete. Ensure owners and groups are populated so attestation and certification tasks reach the right people. Use the Data Manager views in CMDB Workspace to track policy runs and outstanding tasks.
How it shows up
Expect a question on which setting ensures no CI is deleted without review.
Common confusion
Running a broad delete policy before testing its filter on a small set.
3.15 Identify how to improve data quality using the CMDB Data Foundation DashboardPrioritised indicators for CMDB and CSDM foundations.
What it means
The CMDB and CSDM Data Foundations Dashboard is a Store application that scores foundational indicators, grouped by priority, about CMDB configuration and data quality.
What to understand
Indicators check things like discovery source population, duplicate rates, stale CIs, ownership and CSDM object usage. Each failed indicator links to a remediation recommendation in the accompanying playbook. Work through high-priority indicators first, then re-check scores as changes take effect.
How it shows up
A team wants a prioritised list of foundational fixes rather than raw health scores, which points to this dashboard.
Common confusion
Treating it as the same thing as the CMDB Health Dashboard.
3.16 Identify how to manage life cycle CI attributes between CIsLife cycle stage and status across related records.
What it means
CSDM defines standard life cycle stage and life cycle stage status fields that replace inconsistent use of install status and operational status.
What to understand
Map legacy status values to the standard life cycle fields, keep CI and asset lifecycle values aligned through mappings, and use Data Manager retire policies to set end-of-life values consistently. When a parent CI such as a server retires, dependent CIs and relationships should be reviewed so the map does not show retired items as live.
How it shows up
A stem asks which fields should express that a CI is in use or retired under CSDM.
Common confusion
Continuing to report only on install status when CSDM life cycle fields are the standard.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Completeness

    KPI measuring whether required and recommended fields are populated.

    Remember
    Required and recommended are two separate metrics.
    Tested as
    Questions about empty fields map here.
    Trap
    Using completeness to judge whether values are correct.

  • Correctness

    KPI made of duplicate, orphan and stale metrics.

    Remember
    Each of the three metrics answers a different quality question.
    Tested as
    Many metric-identification questions test this split.
    Trap
    Putting compliance or completeness issues here.

  • Compliance

    KPI based on audits against expected values in certification templates.

    Remember
    It checks values against standards, not field population.
    Tested as
    Appears in standard-enforcement scenarios.
    Trap
    Confusing it with regulatory compliance programs.

  • Stale CI

    A CI not updated within the configured staleness period.

    Remember
    The period is configurable per class.
    Tested as
    Targets for attestation and retire policies.
    Trap
    Assuming stale means duplicate.

  • Orphan CI

    A CI lacking the relationships or context that rules say it should have.

    Remember
    Orphan rules are defined per class.
    Tested as
    Appears when CIs exist without links to services or hosts.
    Trap
    Treating orphans as missing fields.

  • Health inclusion rules

    Rules that decide which CIs count toward health scores.

    Remember
    Exclude retired or out-of-scope CIs to keep scores meaningful.
    Tested as
    The fix when irrelevant CIs drag scores down.
    Trap
    Deleting CIs just to raise the score.

  • Attestation policy

    Asks owners to confirm that CIs still exist.

    Remember
    It precedes retirement of uncertain CIs.
    Tested as
    The answer when existence is in doubt.
    Trap
    Choosing certification, which checks values.

  • Certification policy

    Asks owners to verify specific attribute values.

    Remember
    Used for non-discoverable attributes such as support group.
    Tested as
    The answer when values must be confirmed.
    Trap
    Choosing attestation, which only confirms existence.

  • Retire, archive, delete

    Data Manager actions that progressively remove CIs from active use.

    Remember
    Retire changes lifecycle values; archive moves records; delete removes them.
    Tested as
    Sequencing questions test the order.
    Trap
    Deleting first, which loses history.

  • De-duplication template

    Saved merge rules applied automatically to matching duplicate tasks.

    Remember
    Suited to large, repeated duplicate patterns.
    Tested as
    Contrasts with the wizard in scale questions.
    Trap
    Using the wizard for thousands of tasks.

  • Principal class filter

    Restricts CI reference fields on tasks to principal classes.

    Remember
    Classes are flagged as principal in CI Class Manager.
    Tested as
    Fixes agents choosing low-level CIs.
    Trap
    Thinking it hides CIs from the CMDB.

  • CMDB Data Foundations Dashboard

    A Store dashboard of prioritised foundational indicators with playbook guidance.

    Remember
    Work high-priority indicators first.
    Tested as
    Shows up in improvement-planning questions.
    Trap
    Confusing it with the health dashboard's KPI scores.

  • Life cycle stage and status

    The CSDM standard fields for where a CI is in its life and its state within that stage.

    Remember
    They replace mixed use of install and operational status.
    Tested as
    Appears in lifecycle and retire scenarios.
    Trap
    Reporting only on legacy status fields.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Health metrics

ConceptMeaningKey differenceCommon trap
Required / recommended Completeness metrics for field population Counts empty fields, not wrong ones Using them for duplicates
Duplicate Correctness metric for CIs matching others Rooted in identification Calling it a completeness issue
Orphan Correctness metric for missing relationships Defined by class-specific rules Confusing it with stale
Stale Correctness metric for CIs not updated recently Based on a staleness period Assuming stale CIs are retired
Compliance (audit) Values checked against expected standards Measures value conformance Treating it as completeness

Data Manager policy types

ConceptMeaningKey differenceCommon trap
Attestation Owner confirms the CI exists Existence check Using it to verify field values
Certification Owner verifies attribute values Value check Using it to confirm existence
Retire Sets end-of-life lifecycle values CI stays in place Expecting records to move
Archive / delete Moves CIs to archive tables or removes them Progressively destructive Running before retirement and review

Deduplication options

ConceptMeaningKey differenceCommon trap
De-duplication task Created by IRE on multiple matches Flags the problem Assuming it fixes it
Deduplication wizard Guided manual merge Human judgment, small volume Using it at scale
De-duplication template Automated merge rules Repeated patterns, large volume Applying without testing

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Delete stale CIs

    What candidates pick
    A delete policy for CIs not updated in 90 days.
    Why it looks right
    It removes the problem quickly.
    Why it's wrong
    Stale may mean undiscoverable, not gone; attest first, then retire and archive before any deletion.

    Clue to watch for No owner has confirmed the CI is decommissioned.

  2. Certification for existence

    What candidates pick
    A certification policy to confirm virtual machines still exist.
    Why it looks right
    Certification sounds like a general verification.
    Why it's wrong
    Certification checks attribute values; attestation is the policy that confirms existence.

    Clue to watch for The question is whether the CI is still there.

  3. Completeness catches bad values

    What candidates pick
    Add the field to required fields to fix wrong operating system versions.
    Why it looks right
    Completeness is the best-known KPI.
    Why it's wrong
    Completeness only checks that a field has a value; audits under compliance check whether values match standards.

    Clue to watch for The data is present but incorrect.

  4. Clean and forget

    What candidates pick
    Merge all duplicates with the wizard and close the project.
    Why it looks right
    Clearing the dashboard feels like success.
    Why it's wrong
    Duplicates return unless identification rules or the offending source are fixed.

    Clue to watch for Duplicates reappear after earlier cleanup.

  5. Restrict access to stop bad CI selection

    What candidates pick
    Remove read access to low-level CI classes for agents.
    Why it looks right
    It stops agents seeing the wrong CIs.
    Why it's wrong
    The principal class filter limits selection on task fields without breaking access needed elsewhere.

    Clue to watch for Agents choose disks or adapters on incidents.

  6. Admin owns all data

    What candidates pick
    The CMDB administrator should update every support group value.
    Why it looks right
    Administrators have access to everything.
    Why it's wrong
    Data accuracy belongs to CI owners and class owners; the administrator maintains the platform and tools.

    Clue to watch for The stem asks who is accountable for values.

  7. Two dashboards, one purpose

    What candidates pick
    Use the CMDB Health Dashboard to get a prioritised foundation remediation plan.
    Why it looks right
    Both dashboards report data quality.
    Why it's wrong
    The Data Foundations Dashboard and its playbook give prioritised foundational indicators and fixes; the health dashboard tracks ongoing KPI scores.

    Clue to watch for The words 'prioritised', 'foundation' or 'playbook'.

Answer framework

Use these steps to work through Govern scenarios on metrics, policies, duplicates and roles.

  1. Classify the problem: missing values, wrong values, duplicates, missing relationships, outdated CIs, unclear ownership or unused data.
  2. Map data problems to the metric that measures them: completeness for missing values, compliance for wrong values, and duplicate, orphan or stale for correctness.
  3. For lifecycle goals, choose the Data Manager policy: attestation for existence, certification for values, then retire, archive and delete in that order with review.
  4. For duplicates, resolve current records with the wizard or templates by volume, and fix the identification rule or source that produced them.
  5. For operating-model questions, assign the task to the right role and check that consuming processes, principal classes and CMDB Workspace support daily use.

Practice question

A configuration manager finds that many network devices have accurate values but lack a support group, while several hundred others have not been updated by any source for six months. Which combination of CMDB Data Manager policies addresses both issues?

Want more like this? The CIS-DF practice test has questions for every domain.

Checklist

0 of 15

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain about a third of your study time. Start with the health score because many other objectives refer to it: write the three KPIs and six metrics from memory, with one example problem for each, until you can do it without hesitation.

Then work in a Personal Developer Instance with CMDB Workspace. Review the health views, run the health jobs, and change one staleness period and one health inclusion rule to see scores move. Create one Data Manager policy of each type on a small filter and follow the tasks they generate.

Next, create two CIs that a payload will match at the same time, trigger a de-duplication task, and resolve it with the wizard. Read how templates automate the same merge.

Install or read about the CMDB and CSDM Data Foundations Dashboard and skim its playbook. The area candidates underestimate is roles and governance: write a short RACI for configuration manager, class owner, CI owner and administrator. Finish with mixed scenarios and review every wrong answer against the metric and policy tables.

FAQ

How much of the CIS-DF exam is the Govern domain?

Govern is weighted at 35% of the 75-question exam, around twenty-six questions as a planning estimate. It is the largest of the five domains.

What are the six health metrics?

Required and recommended under completeness; duplicate, orphan and stale under correctness; and audit-based compliance.

Is CMDB Data Manager the same as Data Certification?

Data Manager now provides certification and attestation policies alongside retire, archive and delete, covering work earlier releases handled through separate Data Certification features.

Do I need to install the Data Foundations Dashboard to study?

It helps, because seeing indicators and the playbook makes the objectives concrete, but reading its documentation and playbook is enough for most questions.

Why does deleting CIs not count as good governance?

Deletion removes history and relationships. Governance expects confirmation, retirement and archiving with review, so decisions stay auditable.

How are principal classes different from health inclusion rules?

Principal classes restrict which CIs users choose on tasks, while health inclusion rules decide which CIs are scored. Both focus attention on important CIs.

What is the main governance role tested?

The configuration or CMDB manager role appears often, but expect questions on class owners and CI owners as well.

Other CRM & Business Applications certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered health metrics, Data Manager policies, deduplication and governance roles. Practise the heaviest domain under exam timing to see where points slip.

Take the CIS-DF practice test Check your CIS-DF readiness

Keep going