Establish and Document the Technologies and Tools Used to Build the Application

This chapter explains how to establish and document the technologies an Application is built from and the tools used to build it.

Why Build Technologies and Tools Matter

An Application is built from many technologies, such as programming languages, frameworks, third-party libraries, runtime platforms, databases, and middleware, and with many tools, such as compilers, build tools, code analysis tools, and integrated development environments. These choices determine who can work on the Application, what skills it needs, which security vulnerabilities may affect it, and when parts of it will reach end of support. When they are undocumented, the enterprise cannot answer basic questions such as “which of our Applications use this library that was just found to be vulnerable?”

Establish the Build Technologies and Tools

Identify, with the IT Application Owner and the Development or Engineering Organization:

• The programming languages and their versions.

• The frameworks, third-party libraries, and other components the Application is built from, with their versions.

• The runtime platforms, databases, and middleware it depends on.

• The tools used to build, analyze, and package it, with their versions.

Prefer technologies the enterprise has approved through its technology standards, and record the rationale for any exception.

Document and Share the Build Technologies and Tools

Record the technologies and tools, with their versions, in the Build, Packaging, and Configuration section of the Application Documentation, and link each technology to its entry in the enterprise’s technology inventory where one exists. Where component lists can be generated automatically, for example as a Software Bill of Materials, link to the generated list for each Release. Update the record with every Release that changes a technology or version.

Best Practice: Establish and Document the Technologies and Tools Used to Build the Application

It is a best practice to both establish and document the solution for what an Application is made from: identify the languages, frameworks, libraries, platforms, and tools used to build it, with their versions, prefer enterprise-approved technologies, and keep the record current with every Release.

Benefits: A current record of an Application’s technologies lets the enterprise quickly find every affected Application when a vulnerability or end-of-support notice is announced. It also tells managers which skills are needed to maintain the Application, and gives Technology Portfolio Management the data it needs to manage technology risk.

Connections to Related IF4IT Practices and Inventories

The Technology Portfolio Management (TPM) Best Practices addresses the governance of technologies across the enterprise. The Software Technologies Inventory and Attributes describes how technologies are recorded.