[{"data":1,"prerenderedAt":283},["ShallowReactive",2],{"\u002Fen\u002Fdossiers\u002Fapplication-mapping":3,"dossiers-catalogue":250},{"id":4,"title":5,"body":6,"description":219,"extension":220,"image":221,"kind":222,"manufacturer":221,"meta":223,"metaTitle":224,"model":221,"navigation":225,"order":210,"path":226,"publishedAt":227,"relatedDossiers":221,"relatedDrones":221,"relatedServices":221,"seo":228,"sources":235,"specs":221,"stem":247,"translationKey":248,"updatedAt":227,"__hash__":249},"content\u002Fen\u002Fdossiers\u002Fapplication-mapping.md","Application mapping: what it must contain",{"type":7,"value":8,"toc":208},"minimark",[9,13,21,26,29,35,41,56,60,67,110,116,120,123,134,141,145,148,159,162,166,169,176,180,187,194,198,205],[10,11,12],"p",{},"Application mapping has a bad reputation, and it has earned it. Too many IT departments\nremember a six-month exercise that produced a handsome document, out of date before it\nwas circulated, that nobody ever opened again.",[10,14,15,16,20],{},"It is nonetheless the one deliverable everything else depends on. You do not repay a\ntechnical debt you have not located, you do not split a system into batches when you do\nnot know its dependencies, and you do not urgently patch an asset whose owner nobody can\nname. So the question is not whether you need a map, but ",[17,18,19],"strong",{},"why the previous ones died",".",[22,23,25],"h2",{"id":24},"what-is-an-application-map-actually-for","What is an application map actually for?",[10,27,28],{},"Three things, and they are worth separating because they do not demand the same level of\ndetail.",[10,30,31,34],{},[17,32,33],{},"Deciding."," Knowing what exists, what it costs, what is redundant. This is the use that\njustifies the budget, and the one that needs the least technical precision.",[10,36,37,40],{},[17,38,39],{},"Isolating."," A modernisation batch can only be carved out if you know what calls what.\nThis is where the map becomes an engineering tool rather than a presentation asset.",[10,42,43,46,47,51,52,55],{},[17,44,45],{},"Reacting."," When a vulnerability is published, the only question that matters is: are\nwe exposed, and where? France's cyber agency reports in its ",[48,49,50],"em",{},"Panorama de la cybermenace\n2025"," that ",[17,53,54],{},"more than 6,200 assets in France were still affected at the end of 2025"," by\nthe main vulnerabilities exploited since 2023 and 2024. These are not unknown flaws: the\npatches existed, on machines nobody could tie back to an owner.",[22,57,59],{"id":58},"what-must-a-map-actually-contain","What must a map actually contain?",[10,61,62,63,66],{},"ANSSI, the French national cybersecurity agency, publishes a five-step guide that settles\nthe question of content. A map is made of ",[17,64,65],{},"three visions moving progressively from\nbusiness to technical",", broken down into six views:",[68,69,70,85,98],"ul",{},[71,72,73,76,77,80,81,84],"li",{},[17,74,75],{},"Business vision"," — the ",[48,78,79],{},"ecosystem view",", showing the entities and systems the estate\ninteracts with, and the ",[48,82,83],{},"business view",", representing it through its main processes and\ninformation.",[71,86,87,76,90,93,94,97],{},[17,88,89],{},"Application vision",[48,91,92],{},"applications view",", describing software components, the\nservices they offer and the data flows between them, and the ",[48,95,96],{},"administration view",",\nlisting administrative perimeters and privilege levels.",[71,99,100,76,103,106,107,20],{},[17,101,102],{},"Infrastructure vision",[48,104,105],{},"logical infrastructure view"," (segmentation, address\nranges, filtering) and the ",[48,108,109],{},"physical infrastructure view",[10,111,112,113,115],{},"Two field remarks on that list. First, the ",[17,114,96],{}," is the one everyone\nskips, and it is the one an attacker cares about most: it says who can do what, and\ntherefore which account is worth stealing. Second, these views do not cost the same: the\nbusiness vision is built in workshops, the infrastructure vision is extracted from tools.\nTrying to produce both at the same granularity is the surest way never to finish.",[22,117,119],{"id":118},"why-are-existing-maps-wrong","Why are existing maps wrong?",[10,121,122],{},"Because their construction was funded and their upkeep was not.",[10,124,125,126,129,130,133],{},"A map is not a document, it is a ",[17,127,128],{},"state",". It describes a system that changes every week:\na server added, a component replaced, a flow opened to fix an incident and never closed\nagain. A document produced once is wrong at the first change, and wrong ",[17,131,132],{},"silently"," —\nnothing signals its drift from reality.",[10,135,136,137,140],{},"That is what makes the exercise different today. Inventory work, reconciling sources and\nkeeping entries current is repetitive, high-volume and verifiable: exactly the task\nprofile where AI assistance changes the unit cost. It is not building the map that\nbecomes affordable, it is ",[17,138,139],{},"maintaining it",". And maintenance was the real obstacle.",[22,142,144],{"id":143},"do-you-need-a-tool-or-a-spreadsheet","Do you need a tool, or a spreadsheet?",[10,146,147],{},"A spreadsheet, to start. No exception.",[10,149,150,151,154,155,158],{},"A mapping tool solves a problem you do not have yet: ",[17,152,153],{},"representation",". Your current\nproblem is ",[17,156,157],{},"collection"," — knowing what runs, who owns it, what it depends on. That is\ndone in a spreadsheet, with a handful of columns and naming discipline.",[10,160,161],{},"A tool becomes useful when two conditions hold: the data is already fed automatically\nfrom authoritative sources, and several teams need to consult the map without stepping on\neach other. Buying the tool before you have the data means buying a handsome display of\nemptiness — and turning a governance problem into an IT project.",[22,163,165],{"id":164},"how-long-does-it-take-to-produce-one","How long does it take to produce one?",[10,167,168],{},"For a first usable inventory over a bounded perimeter, count weeks, not months. The\nduration almost never depends on the technology: it depends on how many people you have\nto interview and how available they are.",[10,170,171,172,175],{},"The trap is wanting to map the whole estate at once. ANSSI explicitly recommends\n",[17,173,174],{},"defining the perimeter to be mapped"," in the very first step, and setting a trajectory.\nA partial, accurate map is worth infinitely more than a complete, stale one.",[22,177,179],{"id":178},"where-should-the-map-be-stored","Where should the map be stored?",[10,181,182,183,186],{},"Here is the least intuitive recommendation in the ANSSI guide, and the one almost nobody\napplies: ",[17,184,185],{},"the map must not be stored on the information system it describes",". The\nreasoning is plain — an attacker who has got in would find the complete plan of their\ntarget, dependencies and privileges included.",[10,188,189,190,193],{},"The guide also recommends keeping a backup accessible ",[17,191,192],{},"during a network outage",", an\nup-to-date paper copy being acceptable. It reads as a quaint precaution until the day of\na crisis, when you discover that the document explaining how everything reconnects is\nstored inside the thing that just went down.",[22,195,197],{"id":196},"how-does-this-connect-to-technical-debt","How does this connect to technical debt?",[10,199,200,201,204],{},"Directly: the map is what makes debt ",[17,202,203],{},"quantifiable",". As long as you do not know how many\napplications rest on an out-of-support component, debt stays a worry; once the map exists,\nit becomes a budget line with a scope and a deadline.",[10,206,207],{},"It also protects against the opposite error — modernising what is visible rather than what\nweighs. Without a map, the arbitration goes to whichever application has the loudest user.",{"title":209,"searchDepth":210,"depth":210,"links":211},"",2,[212,213,214,215,216,217,218],{"id":24,"depth":210,"text":25},{"id":58,"depth":210,"text":59},{"id":118,"depth":210,"text":119},{"id":143,"depth":210,"text":144},{"id":164,"depth":210,"text":165},{"id":178,"depth":210,"text":179},{"id":196,"depth":210,"text":197},"Without a map, no batch can be isolated and no debt repaid. What the French cyber agency requires, and what kills a map.","md",null,"dossier",{},"Application mapping for your estate",true,"\u002Fen\u002Fdossiers\u002Fapplication-mapping","2026-08-21",{"keywords":229,"title":5,"description":219},[230,231,232,233,234],"application mapping","information system mapping","application landscape inventory","IT asset inventory","enterprise architecture mapping",[236,240,244],{"label":237,"url":238,"date":239},"ANSSI — Cartographie du système d'information, guide d'élaboration en cinq étapes (v1b)","https:\u002F\u002Fmesservices.cyber.gouv.fr\u002Fdocuments-guides\u002F20181213_anssi_guide_cartographie_v1b.pdf","2018",{"label":241,"url":242,"date":243},"ANSSI \u002F CERT-FR — Panorama de la cybermenace 2025","https:\u002F\u002Fwww.cert.ssi.gouv.fr\u002Fuploads\u002FCERTFR-2026-CTI-002.pdf","2026",{"label":245,"url":246},"McKinsey — Tech debt: reclaiming tech equity","https:\u002F\u002Fwww.mckinsey.com\u002Fcapabilities\u002Ftech-and-ai\u002Four-insights\u002Ftech-debt-reclaiming-tech-equity","en\u002Fdossiers\u002Fapplication-mapping","application-mapping","sRROzoS8Zad-Q300YTSjZX4UgulnPk-89_an8wWejXc",[251,253,257,261,266,271,275,279],{"locale":252,"slug":248,"path":226,"title":5,"translationKey":248},"en",{"locale":252,"slug":254,"path":255,"title":256,"translationKey":254},"chatgpt-visibility","\u002Fen\u002Fdossiers\u002Fchatgpt-visibility","ChatGPT visibility: what actually works, measured",{"locale":252,"slug":258,"path":259,"title":260,"translationKey":258},"it-obsolescence","\u002Fen\u002Fdossiers\u002Fit-obsolescence","IT obsolescence: what it really costs you",{"locale":252,"slug":262,"path":263,"title":264,"translationKey":265},"technical-debt-ai","\u002Fen\u002Fdossiers\u002Ftechnical-debt-ai","Technical debt and AI: finally clearing the legacy","tech-debt-ai",{"locale":267,"slug":268,"path":269,"title":270,"translationKey":248},"fr","cartographie-applicative","\u002Ffr\u002Fdossiers\u002Fcartographie-applicative","Cartographie applicative : ce qu'elle doit contenir",{"locale":267,"slug":272,"path":273,"title":274,"translationKey":265},"dette-technique-ia","\u002Ffr\u002Fdossiers\u002Fdette-technique-ia","Dette technique et IA : solder enfin le legacy",{"locale":267,"slug":276,"path":277,"title":278,"translationKey":258},"obsolescence-informatique","\u002Ffr\u002Fdossiers\u002Fobsolescence-informatique","Obsolescence informatique : ce qu'elle vous coûte",{"locale":267,"slug":280,"path":281,"title":282,"translationKey":254},"referencement-chatgpt","\u002Ffr\u002Fdossiers\u002Freferencement-chatgpt","Référencement ChatGPT : ce qui marche, mesuré",1787432459002]