Establish and Document the Application's Key Data and Information

This chapter explains how to establish and document the key data and information an Application creates, holds, uses, and exchanges.

Why Key Data and Information Matter

Data often outlives the Application that holds it, and it is frequently the most valuable, most regulated, and most sensitive part of an Application. Knowing which data an Application holds is essential to protecting it, complying with regulations, integrating with other Applications, and eventually migrating or disposing of it when the Application is retired.

Establish the Key Data and Information

Identify the key data and information the Application deals with, at the level of the enterprise’s logical data and information types, such as customer, order, employee, or payment information. For each, establish:

• Whether the Application is the authoritative source for it, or holds a copy.

• Its sensitivity and classification, including whether it is regulated data.

• Which data and information move across the Application’s documented Integrations and Application Programming Interfaces (APIs), and in which direction.

Describing data at the level of logical data types keeps this documentation useful and maintainable; detailed data structures belong in the Application’s data design and data dictionary.

Document and Share the Key Data and Information

Record the key data and information, whether the Application is authoritative for each, their sensitivity and classification, and the data exchanged across Integrations and APIs, in the Application Documentation, and link each data type to its entry in the enterprise’s data and information inventory where one exists. Record known Data Owners as described in the chapter “Document Other Known Contacts — Data Owners, Security Owners, and Executive Sponsors.” Review the data documentation with every Release that changes the Application’s data.

Best Practice: Establish and Document the Application’s Key Data and Information

It is a best practice to both establish and document the solution for what data an Application holds and exchanges: identify its key data and information by logical type, whether it is authoritative for each, how sensitive each is, and what moves across its Integrations and APIs.

Benefits: Knowing what data each Application holds lets the enterprise protect sensitive data where it actually lives, respond accurately to privacy requests and audits, and see the impact of a data change across Applications. It also turns migration and retirement from a data discovery exercise into a planned transfer.

Connections to Related IF4IT Practices and Inventories

The Data and Information Inventory and Attributes describes how logical data and information types are recorded. The Application Portfolio Management (APM) Best Practices addresses connecting APM to the data and information inventories.