Ask the people who run IT how accurate their hardware and configuration records are and most will say, with some confidence, that things are in decent shape. Ask finance, security or an auditor and the answer changes. A survey of 600 respondents published in August 2025 by asset-tracking vendor WanAware found that 95 percent of IT leaders trust their asset data, while only 35 percent of managers outside IT do. The vendor has a commercial interest in that finding, so treat the exact figures with care. The gap itself will be familiar to anyone who has been through an audit, a laptop refresh or a major incident.
A hardware asset management (HAM) and CMDB maturity assessment is how you find out which side of that gap you are really on, and what it would take to close it. This article explains what such an assessment is, what it covers, who should take it, what the benefits look like in practice, and what you should expect to walk away with.
What a HAM and CMDB maturity assessment actually is
It is a structured review of how well your organization identifies, records, governs and uses information about its hardware and configuration items. The output is a score for each area, usually on a scale of one to five, plus a prioritized list of what to fix first. It is not a tool audit and it is not a data cleanse. It looks at the practice behind the data: who owns it, how it enters the records, how it is kept right, and whether anyone relies on it when decisions are made.
HAM and the CMDB belong in the same assessment because they fail together. A hardware record that never reaches the CMDB cannot support an impact analysis. A CMDB full of servers with no owner, no lifecycle status and no link to a purchase record cannot support a refresh plan. ITIL 4 treats IT asset management and service configuration management as separate practices, which is correct for ownership and process design, but the data they produce is consumed by the same people and fails for the same reasons.
Why the data problem is bigger than most teams admit
The public numbers are uneven in quality, so it helps to be clear about what is solid and what is folklore. Flexera’s 2024 State of ITAM report found that 53 percent of IT teams struggle to get or keep complete visibility of their technology investments, and that 65 percent felt they had an accurate view of on-premises hardware but only 19 percent said the same for bring-your-own laptops. That second pair of numbers is the one we see reflected in almost every engagement: the data is reasonable where IT controls the process and weak where it does not.
Public audits show the same pattern in sharper form. In 2017 the New York City Comptroller examined hardware at nine Department of Education locations and found that 4,993 of 14,329 sampled items, about 35 percent, were not properly accounted for, and that 1,816 devices could not be produced at inspection. It is an older and public-sector example, but it is documented and specific, which is more than can be said for most statistics in this field.
CMDB failure rates deserve a note of caution. The most quoted figure, that 80 percent of CMDB projects add no value, is usually credited to Gartner. We have not been able to trace the original document, so we would not put that number on a slide. A safer statement is the one PwC Luxembourg used in July 2026: analysts have repeatedly observed that a clear majority of CMDB initiatives, often estimated at well over half, did not deliver sustained value. Forrester data cited by Flexera points the same way, with less than half of respondents saying they trust what is in their CMDB.
What the assessment covers
We organize the review around seven areas. The labels vary between consultancies, but the substance is consistent: people, process, data, tools, automation, governance, and whether the data is actually used.
| Area | What we look at | A question we ask |
|---|---|---|
| People and ownership | Owners for each asset type and CI class, who approves disposal, whether roles exist outside job titles | Can you name the owner of the server class in your CMDB? |
| Process | Lifecycle from request to retirement, receiving and stockroom, moves and changes, reconciliation, disposal | What happens to a laptop when its user leaves? |
| Data quality | Completeness, correctness and compliance of records, plus duplicate, stale and orphaned CIs | What share of CIs have an owner and a support group? |
| Tools and discovery | Discovery coverage, links between procurement, endpoint management, ITSM and the CMDB, spreadsheets still in use | Which devices never show up in discovery? |
| Automation | Automatic reconciliation, onboarding and offboarding triggers, scheduled audits, refresh forecasting | How much of the monthly reconciliation is still done by hand? |
| Governance and compliance | Policy, KPIs, audit trail, links to DORA, NIS2, ISO 27001 and similar requirements | When was the inventory last reviewed, and by whom? |
| Use of the data | Whether incident, change, security and finance teams rely on the records | Does change approval use the CMDB impact view or a meeting? |
On the data side, most CMDB health dashboards report three measures, and they are a useful frame for the data quality part of the assessment.
The benefits, in the order our clients feel them
Audit and regulatory readiness
Asset inventories have moved from good practice to written requirement. DORA Article 8 asks financial entities to identify and document their ICT assets and the dependencies behind critical functions, and to review that inventory at least annually and after major changes. NIS2 lists asset management among the required security measures, and ISO 27001:2022 Annex A control 5.9 requires an inventory of information and associated assets with an owner for each. None of these texts says how complete the data must be, which is why an assessment is useful: it tells you how an auditor would score you before one does.
Security visibility
The CIS Critical Security Controls put inventory first for a reason. Control 1 covers enterprise assets and includes safeguards for keeping an inventory, finding unauthorized assets and running active discovery. Control 2 does the same for software. If the hardware record is missing a device, the patching, EDR and vulnerability programs will miss it too, and nobody will see the gap until the device is involved in an incident.
Cost control and a calmer refresh cycle
Good hardware data pays for itself in boring ways. You buy what you need instead of what the spreadsheet suggests. You claim warranty on devices that are still covered. An Ivanti survey in 2020 found that 61 percent of respondents lacked full purchase, contract and warranty data in their asset records, and half said they had sometimes spent time fixing devices that turned out to be under warranty. Estimates of the cost of ghost assets, such as WanAware’s claim that up to a quarter of IT spend is wasted on them, come from a vendor and should be read as an upper bound rather than a benchmark.
Disposal is the other half. The UN Global E-waste Monitor 2024 reported 62 million tonnes of e-waste in 2022, of which only 22.3 percent was documented as properly collected and recycled. If your records cannot show where a device went, you cannot show it was wiped, recycled or resold properly, and that matters for both data protection and sustainability reporting.
Faster incident and change decisions
A reliable CMDB shows which business services an incident touches and which recent changes could be responsible. PwC Luxembourg’s 2026 advice is to start with a minimum viable CMDB scoped to critical services and to measure it against three uses: incident impact, change risk and resilience reporting. That is a sensible order. Scope the data to the decisions it has to support, then raise the quality bar where those decisions are made.
Readiness for AI and automation
Every ITSM and ITAM vendor now sells agents that act on configuration and asset data. Gartner warned in February 2025 that through 2026 organizations would abandon 60 percent of AI projects that are not supported by AI-ready data. That statement is about data in general, not CMDBs specifically, but it applies directly. An agent that reads a wrong owner, a stale relationship or a missing device does not hesitate. It acts on it. We go into this in more detail in our look at agentic AI in ITSM and ITOM.
Who should take it
The people who should be in the room are the ones who produce the data and the ones who depend on it. In practice that means the IT asset manager, the CMDB or configuration owner, the service desk or ITSM lead, a security or GRC representative, someone from procurement and someone from finance. The WanAware numbers earlier are the argument for including the non-IT voices: if only IT scores the data, the result will be flattering.
Certain events make the assessment urgent rather than optional.
- A refresh wave. Windows 10 support ended on 14 October 2025. Commercial extended security updates run in annual periods that end on 13 October 2026, 12 October 2027 and 10 October 2028, so the first paid year is about to end. Omdia put the per-device price at $61, $122 and $244 for years one to three, which makes replacement cheaper than paying for a second or third year on many devices. You can only plan that if you know which devices you have.
- An audit finding or a new regulation. DORA, NIS2 and ISO 27001 all point at the inventory.
- A tool change. Moving to a new ITSM platform or rebuilding the CMDB is the cheapest moment to fix the practice, and the most expensive moment to discover it is broken.
- A merger, a cloud move or a new AI program. Each adds assets, owners and dependencies that nobody has mapped yet.
What value you get out of it
A good assessment ends with a decision, not a report. You should leave with four things: a score for each area so you know where the weakest links are, a gap analysis in plain language that names the process and data causes rather than just the symptoms, a prioritized roadmap with quick wins separated from structural work, and a clear view of which tool problems are really practice problems. That last item saves money. Many organizations replace a tool that was fine, because nobody had scored the process around it.
Notice what the starting profile shows: tools score higher than data quality and automation. That shape is typical. The tool was bought, but the practice around it was not built, so the data stays poor and the automation has nothing reliable to act on.
Three scenarios that come up repeatedly
These are composites we use to explain the work. They are not named clients.
The spreadsheet-based firm facing a refresh. Inventory lives in spreadsheets, as it still does for roughly a quarter of IT teams in the WanAware survey. The assessment scores them at level one on process and data. The first moves are cheap: name owners, add active discovery, and reconcile against purchase records. Within a year, devices, warranty and disposal status sit in one tool, and the refresh is planned from data instead of from a guess.
The regulated entity preparing for DORA. Each team keeps its own inventory. The assessment recommends a minimum viable CMDB for critical services, an owner for every CI, and a documented annual and post-change review. That turns an obligation into a routine.
The organization with a failed CMDB and an AI program. Trust in the data is low and staleness is high. The assessment rescopes the CMDB to the services that matter, adds health measures with targets, and gives every class an owner. Only then do the AIOps and agent pilots start, on data that can support them.
How the assessment works
The Desqcon online assessment is built to give a first reading quickly. A free trial covers one process area in about 15 minutes and returns an instant scored read. The paid assessment goes deeper and benchmarks results against ITIL 4, SIAM and IT4IT, and for larger programs our consultants run a deep-dive that adds a People, Process and Tools gap analysis and a working session to build the roadmap. Either way, the sequence is the same: agree scope, collect evidence, score each area, then turn the findings into a roadmap with owners and dates.
Mistakes we see in assessments
- Scoring the tool instead of the practice. A strong platform with weak ownership still scores low.
- Letting only IT answer. Include finance, security and procurement.
- Treating the score as the goal. The decision it supports is the goal.
- Aiming for a perfect CMDB. Forrester’s advice to aim for fit-for-purpose data is sound: be accurate where decisions are made.
- Skipping the second look. A re-score after six to twelve months shows whether the work stuck.
Frequently asked questions
How long does a HAM and CMDB maturity assessment take?
A first reading can take about 15 minutes online. A consultant-led deep-dive depends on how many sites, tools and teams are in scope, and we agree the timeline when we scope it.
Do we need a CMDB tool before we assess?
No. The assessment is most useful before a tool decision, because it shows whether the problem is the tool or the practice around it.
Is a HAM assessment different from a software asset management assessment?
Yes in focus, no in method. Hardware has its own lifecycle, procurement, stockroom and disposal concerns. Software adds entitlements, licensing rules and audit exposure. Many organizations assess both. See our article on enterprise software license management for the software side.
How often should we reassess?
Once a year is a reasonable default, and again after a major change such as a tool migration, a merger or a regulatory deadline.
What do we need to prepare?
A current list of owners, your discovery and ITSM tools, any recent audit findings, and an honest sample of records to check. Evidence matters more than opinion.
Where to go from here
If you are not sure where your records stand, start with the online assessment. The Hardware Asset Management maturity assessment and the Asset and Configuration Management maturity assessment cover the two halves of this article, and the ITSM and ITOM maturity assessment overview shows how they fit with the rest of your service management practice. If you are weighing tools next, our guide to hardware asset management and CMDB tools is the follow-on read.
Find out where your HAM and CMDB practice stands
Take the Desqcon online maturity assessment for hardware asset management, or the asset and configuration management assessment for your CMDB. Or talk to one of our senior consultants about a deep-dive.
Take the HAM Maturity AssessmentTake the CMDB AssessmentTalk to a Senior Consultant
Sources and further reading
- WanAware, ITAM confidence gap survey, August 2025: accessnewswire.com/newsroom/en/computers-technology-and-internet/wanaware-survey-finds-itam-confidence-gap-is-costing-enterprises-1059049
- BetaNews, Flexera State of ITAM 2024 coverage, June 2024: betanews.com/2024/06/12/it-teams-struggle-to-get-visibility-into-tech-assets
- NYC Comptroller, audit of Department of Education hardware, July 2017: comptroller.nyc.gov
- PwC Luxembourg, CMDB and AI, July 2026: blog.pwc.lu/?p=226656
- Flexera, CMDB data quality: flexera.com/flexera-one/it-visibility/cmdb-data-quality
- Ivanti survey via Help Net Security, February 2020: helpnetsecurity.com/2020/02/14/tracking-assets
- ServiceNow documentation, CMDB Health: servicenow.com/docs
- CIS Controls v8: cisecurity.org/controls/cis-controls-navigator/v8
- Advisera, ISO 27001 Annex A 5.9: advisera.com/27001academy
- UNITAR, Global E-waste Monitor 2024: unitar.org
- Gartner press release, 26 February 2025, on AI-ready data: gartner.com/en/newsroom
- Microsoft Learn, Windows ESU lifecycle FAQ, and Omdia, October 2025, on ESU pricing
