Document Other Known Contacts — Data Owners, Security Owners, and Executive Sponsors

This chapter addresses contacts who are important to an Application but are not Application Management roles defined by this document: Data Owners, Security Owners, and Executive Sponsors.

Why These Contacts Are Documented but Not Defined as Roles

Data ownership, security ownership, and executive sponsorship are each governed by their own disciplines, which define their responsibilities across the whole enterprise, not for one Application. This document therefore does not define them as Application Management roles. Even so, they are often important to an Application: decisions about its data may require a Data Owner, decisions about its security may require a Security Owner, and decisions about its funding or strategic direction may require an Executive Sponsor.

Document the Known Contacts

Where the Application team knows of any of the following, record them in the Application Documentation, with their area of responsibility and current contact details:

• Data Owners for the key data and information the Application holds or processes.

• Security Owners responsible for the Application’s security posture or for the security of the data it handles.

• An Executive Sponsor who champions or funds the Application.

Where the enterprise’s Application Inventory includes attributes for these contacts, also populate them in the Application Record. Review these contacts with every Release.

These contacts are recorded when known, rather than established by the Application team, because the authority to assign them usually sits outside the Application’s own management. Where an Application clearly needs one of these contacts and none is known, raise the question with the Application’s owners.

Best Practice: Document Known Data Owners, Security Owners, and Executive Sponsors

Record any known Data Owners, Security Owners, and Executive Sponsors for the Application, with their areas of responsibility and contact details, and populate the corresponding Application Record attributes where they exist.

Benefits: Recording these contacts saves time whenever a decision about the Application’s data, security, or funding falls outside the Application team’s own authority. It routes the decision directly to the person who can make it, instead of delaying a Release or a remediation while the right person is tracked down.

Connections to Related IF4IT Practices and Inventories

The Data and Information Inventory and Attributes describes how the enterprise’s data and information, and its ownership, are recorded. The Application Portfolio Management (APM) Best Practices addresses connecting APM to the data and information inventories to understand data ownership and compliance exposure.