Use one row per important service. Start with the workflows whose interruption would have the greatest effect. One person may hold several roles; name the role anyway.
Review owner: Review date:
Inputs used: application and vendor inventory, the identity provider's application list, the renewal calendar, and the latest recovery and incident records. Ownership recorded without these sources is a guess; mark it as one.
Ownership map
| Workflow / service | Tier (1 critical, 2 important, 3 convenience) | Business owner | Technical owner | Alternate for each role | Support and escalation | Recovery owner | Evidence / last checked |
|---|---|---|---|---|---|---|---|
Tier definitions used: (state the interruption length or consequence that separates each tier)
Dependencies behind each Tier 1 service
| Service | Depends on (identity, network, vendor, data source, integration) | Authoritative data held | Administrative access recovery path | Renewal / contract date |
|---|---|---|---|---|
Monthly review agenda
- Review interruptions, near misses, and unresolved support issues.
- Inspect changes to access, dependencies, and ownership.
- Review the latest recovery and service-health evidence, including its limits.
- Look ahead to renewals, migrations, staffing changes, and new integrations.
- Assign the decisions and follow-up work below.
| Decision or gap | Business consequence | Decision owner | Next action | Due date | Closure evidence |
|---|---|---|---|---|---|
Pass criteria for the map itself
- [ ] Every Tier 1 service has a named alternate for each role, not only a primary.
- [ ] Every Tier 1 service has an administrative access recovery path that does not depend on one person's device or mailbox.
- [ ] Each row's evidence was checked within the stated review period; older rows are marked stale.
- [ ] Ownership changes since the last review trace to a staffing, vendor, or project change.
- [ ] Services with no business owner are listed for an adoption or retirement decision.
- [ ] The map itself is stored where the alternates can reach it when ordinary systems are unavailable.
- [ ] A new service is added only after a readiness check records its owner, monitoring, recovery path, access model, and budget line.
Handover check: Ask another operator to find the support path and recovery instructions for one service using this map. Record any missing information and its owner.
Common failure modes
- The map is created once and not re-read until an outage.
- The owner recorded is whoever set up the service, not whoever depends on it.
- Alternates are named but have never signed in or read the runbook.
- Vendor-managed services are treated as needing no internal owner.
Review cadence / next full refresh:
This map records who is responsible; it does not establish that recovery works. Use the recovery exercise scorecard for that evidence.