Software Technologies Inventory and Attributes

The relationship between the Software Technologies Inventory and the Applications Inventory is one of consumption. Applications are built on, deployed on, and depend upon software technologies; software technologies do not depend on applications. Data flows outward from this inventory in the sense that a technology record carries the set of applications dependent on it, but the assertion originates on the application side, because an application knows which technologies it requires. Each inventory remains authoritative for its own Noun Type: the Applications Inventory governs application identity, ownership, and lifecycle, while this inventory governs technology identity, version, and support status. Neither restates the other.

The connecting attributes are named on both sides. On this side, the Applications Dependent attribute in the Relationship Attributes category carries the derived set of applications that depend on the technology, referenced by Semantic Identifier. The Technical Dependencies attribute records the technologies this one requires in turn, so a dependency chain can be traversed more than one hop. From the application side, the equivalent attribute names the technologies the application requires. Criticality Tier in the Classification Attributes category is frequently derived from the criticality of the dependent applications rather than assessed independently, and Adoption Breadth in the Assessment and Health Attributes category is derived from the count and spread of those same applications.

The governance value of this relationship is the one most often cited as the reason to build a technology inventory at all. Well governed, it makes end-of-support exposure actionable: the enterprise can name every application affected by a technology reaching end of support, sequence remediation by application criticality, and cost a migration before committing to it. It makes vulnerability response proportionate, because the enterprise can distinguish a disclosure affecting one internal tool from one reaching a regulated customer-facing system. Poorly governed, the technology inventory reports that something is unsupported and the enterprise still has to convene a meeting to work out what that means — which is the state most enterprises are in, and the state this relationship exists to end.