CSDM
The CSDM 5.0 model

Here is the one-sentence version of CSDM that settles most modeling arguments: every entity in the model exists because a specific workflow consumes it — and an entity nothing consumes should not exist. The diagram isn't an org chart for technology; it's a set of contracts between data and the processes that run on it. Read the ladder that way and the design decisions mostly make themselves. The authoritative text throughout is ServiceNow's CSDM 5.0 White Paper — every bare page reference on this page cites it.
The ladder, read by consumer
| Entity | Table | Who consumes it |
|---|---|---|
| Business Capability | cmdb_ci_business_capability | Strategy and portfolio planning — what the business does, independent of any technology. |
| Business Service | cmdb_ci_service_business | The help desk and the business: what people would call about, with an accountable owner. |
| Business Service Offering | service_offering | The catalog and its subscribers: the commitment tier — audience, environment, SLA. |
| Business Application | cmdb_ci_business_app | Application portfolio management: rationalization, spend, lifecycle. Never incident routing. |
| Service Instance | cmdb_ci_service_auto | Operations: incident routing, change impact, event correlation — the deployed, running instance. Called Application Service before CSDM 5 renamed it (p.11); Application Service now names the discovered/mapped subclasses on cmdb_ci_service_discovered and its siblings (p.47). |
| Technology Management Service | cmdb_ci_service_technical | IT itself: how the estate is operated; default assignment when a CI has no support group. |
| Dynamic CI Group | cmdb_ci_query_based_service | The membership machinery: query-populated groups binding offerings to the CIs that deliver them. |
| Device CIs | cmdb_ci_* (leaf classes) | Everything above — which is why identity and classification quality decide the whole model’s fate. |
Explore the model
The white paper publishes its prescribed relationships as a picture. A picture can't be queried, so we transcribed it: 35 relationships across 26 entities, with the distinction most diagrams lose — whether an arrow is a real CMDB relationship that impact analysis can walk, a reference field, or a many-to-many map. Everything below is drawn from that one dataset. Select any entity to see exactly what the model prescribes, and where it is silent. Transcribing it also surfaced the places the source contradicts itself — checkable against the document you already have, with what we emit for each.
Then press Show my numbers. The map stops being a poster and becomes a way in: each class carries how many records of it exist in the estate and how many configuration items sit beneath them. A class with nothing under it is a finding, not a blank. (The numbers here are from a fabricated example estate; in the product they are yours.)
At rest this shows the spine — the path from business intent to metal. Select any entity to see exactly what CSDM 5.0 prescribes for it, and where it is silent.
How to read this map
Hatched strip — “not operational”. Not established as an operational CI. Do not select it on an Incident, Problem or Change. Click it to see whether the paper excludes it or is simply silent. (5 of 26)
Square corners — “not a CI”. Not a configuration item at all: referential data, not a CMDB record. (3 of 26)
Double bar — the walk stops here. The relationship exists, but as a reference field or a join table. It is real; impact analysis simply cannot walk through it. (9 of 35)
Span bracket — one record, two names. Inheritance, not a relationship: there is nothing between them to walk.
Nothing drawn — CSDM is silent. No line between two entities means the model does not prescribe that relationship. It does not forbid it: cmdb_rel_type and CI Class Manager permit far more. Three states, not two — prescribed (drawn here), documented absence (the paper says the relationship does not exist — select an entity to see its own), and unprescribed, which is the rest of the canvas.
The spine
Business Capability → Business Service → Business Service Offering → Service Instance → Application → Infrastructure CI. Six entities from what the business does to the box it runs on. The joint that matters most is the third hop: a Business Service Offering depending on a Service Instance is the only dependency crossing from the consumption layer into delivery — and every CMDB coverage number is, underneath, a question about whether it exists.
“Only dependency crossing” is doing real work in that sentence, and it is worth being exact rather than sweeping. There is a second traversable crossing out of a Business Service Offering: the bidirectional data-flow edge to an API, which reaches the delivery layer by another route and which impact analysis does walk. And the consumption layer is not the whole business half — Business Application sits in Design & Planning and reaches Application Service directly, which is why omitting that edge breaks Technology Portfolio Management. The spine is the dependency path, not the only path.
One step in that path is not a relationship at all. Application Service is a Service Instance — the concrete class of the abstract one, shown here as a span bracket above the two boxes. Most published CSDM diagrams draw inheritance and relationships with the same arrow, which is why the path so often looks broken.
Read the marks
A hatched strip along the bottom of a box means the entity is not an operational CI; square corners mean it is not a configuration item at all. The distinction matters — and so does the reason, because there are three of them. The white paper explicitly excludes the Design & Planning and Build & Integration domains from Incident, Problem and Change, so Business Application and SDLC Component are cited exclusions, and routing a ticket at them is among the most common CSDM errors. Value Stream and Service Portfolio are simply not configuration items at all. Business Process is a CI the paper never rules on either way.
Select any marked entity and it tells you which of the three applies, with the page. Collapsing them into one claim would be exactly the kind of quiet over-reach this resource exists to avoid.
Walk it
The map shows you everything at once. Sometimes you want the opposite — to stand on one entity and move. Below, the cursor stays where you put it while you change lens, and the Plain English toggle changes the language without changing the model: one node, two labels, never two diagrams that quietly disagree.
Business Service Offering
A promise level — who gets what, how fast
service_offeringService ConsumptionService ConsumptionoperationalWalk down — what it reaches (1)
Walk up — what reaches it (2)
The same model as a matrix
A node-link map cannot show you sparsity, and it cannot show you that one entity is a solid column of inbound arrows. The same relationships as a grid answer a different question: not “what connects to what” but “how much of this model is deliberately empty”.
35 relationships out of 676 possible pairs — 5.2% density. CSDM prescribes the common core — the entities and paths most workflows actually use — not every relationship that can exist, so the empty cells are the majority of the model. Read them in three states: a filled cell is prescribed; the 3 pairs the paper explicitly rules out are documented absences; every other empty cell is unprescribed, which is not the same as forbidden. The busiest target is Service Instance with 7 inbound relationships — a fan-in no node-link drawing makes obvious.
| from ↓ / to → | Foundation | Design | Build | Service | Service | Functional | Infrastructure |
|---|---|---|---|---|---|---|---|
| Foundation | 2 | 3 | · | · | · | · | · |
| Design & Planning | 1 | 2 | 1 | 1 | 1 | · | · |
| Build & Integration | · | · | · | · | 1 | · | · |
| Service Consumption | · | · | · | 2 | 1 | · | · |
| Service Delivery | · | · | · | 1 | 11 | 2 | · |
| Functional | · | · | · | 1 | 1 | 1 | 2 |
| Infrastructure | · | · | · | · | 1 | · | · |
Say it in your words
The hard part of CSDM is rarely the schema. It is translating what people actually say into what the model actually stores. Below are things a stakeholder says out loud, and where each one lands.
cmdb_ci_service_business
Why. People phone about it, and one person is accountable when it breaks. That is the whole test.
The usual mistake. Logging the ticket against the mail software instead. That is the thing underneath — not the thing people lost.
The Armature Service Model — a fixed core, a flexible form
ServiceMatch ships three standard target shapes: Full Rollup (every device under its device-management service), Full CSDM (the complete capability tree), and the Armature Service Model — the flexible middle. The Armature shape models only the layers that run workflows today: technology-management offerings that park every device with an accountable owner, plus the business offerings your evidence actually supports. Business capabilities and application portfolios are deliberately deferred — they're planning objects, and modeling them before anyone consumes them produces diagrams, not operations.
The name is the message. An armature is the rigid inner skeleton a sculptor builds the flexible material around: the form can change completely, the skeleton holding it up does not. The offering layer is that skeleton — every device parked, every offering owned, every relationship exclusive. The business tier above it takes whatever shape your services actually have. It flexes by adoption stage — the crawl and walk shapes emit the Armature model; run and fly unlock the capability tier — and it firms up as interview claims and device evidence accrue. Capture is never gated; only the emitted shape flexes. Staged emission is governed by Adoption stages.
Offerings stratify commitment, not software
The most common offering mistake is treating offerings as a list of applications. An offering answers "delivered to whom, at what level?" — Email — Executive, 24×7 and Email — Standard are offerings. Exchange is not; it's the application underneath. If two offerings would have identical support structure, audience, and commitments, they are one offering wearing two names.
Which is the test for whether an offering is real: an offering is the things it carries. Strip the commitments off and two offerings that looked distinct become the same record twice — because the audience, the support structure and the terms were the only things telling them apart. That is why the model puts SLA, support group and change approval on the offering rather than on the service above it. The service is what people call it; the offering is what you promised, to whom, and who answers.
The application ≠ service test
The single most common CSDM failure is collapsing Business Applications into Business Services. The test is callable: would the help desk take a ticket for it, and is one person accountable for it? Email passes — it's a service. The mail platform doesn't — it's an application in the portfolio. Our stakeholder interview probes this distinction explicitly, because stakeholders volunteer application names and almost never volunteer services.
Run something you are unsure about through the same four questions our interview asks:
Would the service desk accept a ticket for it, using that name?
Services are things people report. Applications are things engineers change.
Is one named person accountable for delivering it to consumers?
A Business Service without a named owner is unsupported. The white paper calls that person the service owner (p.11); “quarterback” is our word for the role, not CSDM’s.
Is its name a product or vendor name?
Product names are a strong signal you are looking at the Business Application.
If you replaced the software underneath, would the business still ask for the same thing?
Services survive re-platforming. Applications do not — that is the whole distinction.
Where devices attach
Infrastructure joins the service layer through Dynamic CI Groups: living, query-populated memberships that follow the estate as it changes. One offering-to-group relationship replaces thousands of hand-made CI relationships, and support-group data propagates through it — so "who supports this box" is a property of the model, not a spreadsheet. End-user devices attach to the technology management services that operate them; hosting infrastructure earns business placements on evidence (see CSDM doctrine).
What actually propagates, and what it costs to leave empty
“Support-group data propagates” is worth stating precisely, because the precision is the whole value of the layer. It is three named fields — Managed By, Support Group, Change Group — copied by a scheduled job called CSDM Data Sync from the offering, down through its Dynamic CI Groups, onto every member CI. The group has to be classified as a technology management service for the copy to happen at all.
Which means an offering with those three fields empty is a chain that is structurally perfect and moves nothing. Every device beneath it gets a home and no owner: no routing, no change approver, no answer to “who gets the call.” It is the offering-layer version of the empty service layer — present, conformant, inert.
We report that as its own state rather than folding it into a completeness score, because the fix is different. An offering with no SLA is an unstated promise. An offering with no support group is a broken mechanism, and on a device-parking offering it defeats the entire point of parking. So the three propagation fields and the commitment metadata (SLA, KPI, cost) are tracked apart, and only the propagation set is treated as a defect on a technology management offering.
None of it is derived. A support group is a statement about who answers the phone, and no packet on the wire carries one — so the gap becomes an interview question, addressed to the service owner, and the answer lands on the ledger in their words.
What 5.0 changed — and the rename that didn't rename the data
- "Technical Service" is now "Technology Management Service" — but the
service_classificationchoice value still says Technical Service. Labels moved; stored values didn't. Automation keyed to the display name breaks quietly. Our emission pins the legacy value in conformance tests. - Service Instance generalizes Application Service, extending the pattern to data, network, and operational services — additive, not breaking.
- 5.0 is incremental, not a rewrite. The paper calls it “an incremental and expanded version” of CSDM 4 (p.3) and says not all products must adopt it at once (p.50) — though it does ship migration guidance, so “backward compatible” would be our word, not theirs. Adoption is incremental, which is why staged emission (see Adoption stages) is the delivery shape the spec itself implies.
- 5.0 is still moving. A July 2026 addendum published under the 5.0 banner formalises AI assets in the model — AI Function, AI Model Deployment, MCP Function, AI Application — plus a new Digital System class that groups Business Applications, a re-introduced DevOps Package, and two new lifecycle states. Worth knowing what it is and is not: it is guidance on modeling AI as configuration items, not guidance on AI populating the model. The dataset on this page is the May 2025 white paper; the addendum is not in it yet, and we would rather say so than let a reader assume the transcription is current with every supplement.
Non-negotiables we validate
Stage 4.5 checks a model against these and reports what fails. Two of them restate the white paper; three are ours, flagged because the model is unactionable without them. Which is which matters more than the rules do — the source describes far more than it mandates, so treat anything below phrased as a requirement as a ServiceMatch choice unless the second column says otherwise.
What “checks” means here, precisely
Two of these are hard gates today: a design with a cycle in its capability hierarchy, or a leaf business service with no offering, is rejected outright and will not write. The rest are reported rather than blocking — you can emit a model that fails them, and the report will say so. We would rather name that distinction than let “validate” imply a wall that is currently a warning.
The rules themselves:
| What we flag | Where it comes from |
|---|---|
| Every Business Service has a named Service Owner. | CSDM 5, p.11 — a Business Service “is associated with a service owner and has one or more Business Service Offerings”. Requiring the owner be named before we emit is ours. |
| Every Business Application has at least one Application Service. | CSDM 5, p.32 — you “will need to manually create relationships between the business application and… the application services class”. Written there as guidance, not as a constraint. |
| Every Application Service has a corresponding Business Service Offering. | ServiceMatch rule. A widely cited community guideline rather than a white-paper requirement. We enforce it because an Application Service no one can raise an incident against, or request a change on, is an orphan record. |
| Every CI and Asset references a Product Model. | ServiceMatch rule, from field practice. Model resolution is what makes version and lifecycle answerable at all, so a null model_id is a gap we surface rather than ship. |
| Applications handling regulated data carry an Information Object. | ServiceMatch rule. Information Object is CSDM 5 (p.31); tying it to regulated data is our addition, and it is the one here most worth arguing with. |
Where the source contradicts itself
Transcribing the figures rather than reading the summaries turned up six places where the white paper disagrees with itself. They are recorded here because anyone building an importer against that document will hit them, and because absence of errata in every other CSDM resource is not evidence that the document is clean.
These are contradictions — places the document disagrees with itself. They are not absences. Where CSDM prescribes nothing it is silent, and that silence is deliberate: the model fixes a common core, not every relationship that can exist. The 6 below are the separate case where the document fails its own text.
3 of 6 will break an importer if transcribed faithfully — a relationship descriptor is a literal cmdb_rel_type value, so a typo copied carefully is still a broken import.
- Two names for the Business Application → Application Service edgep.48 figure vs p.48 bodybreaks an importer
The figure says
[Uses::Used by]
The prose says
Business Application “consumes” Application Service
What we do
Emit [Uses::Used by] — the figure is the schema-level statement. Verify against cmdb_rel_type on the target instance before importing.
- Network Service Instance given the wrong tablep.38 figure vs p.47 tablebreaks an importer
The figure says
cmdb_ci_connection_service_instance — the same table as Connection Service Instance
The prose says
cmdb_ci_network_service_instance
What we do
Figure 15 is correct. The class diagram on p.38 has a copy-paste error.
- Typo in a relationship descriptorp.48 figurebreaks an importer
The figure says
[Operrationalizes::Operationalized by]
The prose says
—
What we do
Read as Operationalizes. A descriptor is a literal cmdb_rel_type value, so a typo transcribed faithfully becomes a broken import.
- A legacy reference the same paper deprecates is still drawnp.33 body vs p.48 figuremodelling decision
The figure says
Business Application → Business Process reference, drawn without qualification
The prose says
the singular reference to Business Process is considered legacy and not recommended for use
What we do
Render it as deprecated. A reference field is 1:1; the real relationship is 1:many.
- “Tecnology Mgmt Service”p.48 figurecosmetic
The figure says
Tecnology Mgmt Service / Tecnology Mgmt Offering — four occurrences
The prose says
Technology Management Service
What we do
Cosmetic. Noted only so a reader comparing our transcription to the source is not confused.
- Manage Portfolio spans five domains, but the model has sevenp.10 and p.46cosmetic
The figure says
—
The prose says
portions of all five previous domains
What we do
The list is stale twice over. It omits Ideation & Strategy — the domain CSDM 5 adds — and it still uses CSDM 4 names for two domains CSDM 5 renamed (“manage technical services” became Service Delivery, “sell/consume” became Service Consumption). Note the list does begin with foundation, so the omitted domain is Ideation & Strategy, not Foundation.
None of these are gotchas anyone invented. They are what happens when a reference architecture is published as slideware — and they are the reason a model that lives as data, importable and diffable and testable, beats one that lives as a PDF.
Found a seventh — or think one of these is wrong?
Write us: info@swipeleft.ai. The dataset is corrected in place, and corrections we accept are credited if you want the credit.
Why table-level precision matters
These entities drive incident routing, change impact, and portfolio reporting. A model that's right at the diagram level and wrong at the table level fails exactly when those workflows fire — which is the worst possible time to find out.