Board Technology Oversight

The Tech Stack Census: One Page, Every System, Every Owner

Nobody in your company can name every system it runs. The census fixes that with one page: every system, its owner, its data, its renewal date.

A printed inventory sheet with checkboxes on a clipboard.

Try the question at the next leadership meeting: how many software systems does this company pay for? The guesses will range wildly - twenty, forty, someone says 'has to be over a hundred' - and nobody will know. The finance system says one number, IT's list says another, and the truth is in nobody's head.

The census is the answer: one page that lists every system the company runs, with the four facts that make a system governable - its owner, its data, its cost, and its renewal date. It is the least technical document in the technology program and the one everything else quietly assumes exists.

Here is how to build it in two weeks of small asks, and why it will be the most-used page in the company.

Key takeaways

  • Nobody can govern a stack nobody has counted.

  • The census fits one page: system, owner, data, cost, renewal.

  • Build it from the credit card statements, not from memory.

  • Every row needs a named human owner; 'the company' is not an owner.

  • The census feeds everything: renewals, security reviews, exit tests, the board's picture.

Step 1: Start from the money, not the memory

The reliable census begins in the accounting system: every recurring software charge, every corporate card subscription, every annual renewal buried in a vendor bill. Memory misses the tools entire departments run on; the money never lies about what is being paid.

Add the free tier sweep: the tools no one pays for but everyone uses, found by asking each team lead one question - what do your people open every morning?

Expect the first count to be double the guess. That is normal, and it is the first insight the census was built to deliver.

Step 2: Attach the four facts to every row

Each system gets: a named owner - a person accountable for whether it earns its keep; the data it holds, in plain words; the annual cost; and the renewal date. Four facts, no more - the census that tries to capture everything captures nothing past row twelve.

The owner column does the quiet work. A row with no owner is a finding: a system nobody is accountable for is a subscription on autopilot and a risk on nobody's desk.

This fictional example shows the census middle rows. It is an illustration, not a prescription.

System Owner Holds $/yr Renews
CRM Sales VP All customer data 18k Mar
Scheduling tool Unassigned Customer contact info 400 Monthly
E-sign platform Ops manager Signed documents 3k Nov

The unassigned row is worth the whole exercise: four hundred dollars of customer data with no adult in the room.

Step 3: Put the page to work immediately

The census earns its keep in its first month. The renewal calendar alone pays for it: no more auto-renewals discovered on the credit card statement. The security reviews start from it - the access review, the vendor risk pass, the exit tests all begin with 'what do we have.'

And it is the answer page for the questions that arrive from outside: the auditor's list of systems in scope, the insurer's application, the acquirer's diligence request. Each used to be a fire drill; now it is a sort and a filter.

The discovery parallels with finding unapproved tools are deliberate: the census is the standing version of that one-time sweep.

Step 4: Keep it alive with two habits

Habit one: nothing enters the stack without entering the census. New tool, new row, named owner - a rule as much about visibility as control. Habit two: a thirty-minute review twice a year, pruning the dead rows and refreshing the facts.

The review has a side effect worth more than the data: it forces the question of whether each system still earns its row. Tools die quietly in companies; the census is where they are buried properly.

For the board, the census becomes the standing backdrop of technology oversight - the one page that makes the architecture conversation, the budget conversation, and the risk conversation share the same nouns.

The related discussion of finding unapproved tools is worth your time alongside this one. The related discussion of technology oversight is worth your time alongside this one.

Frequently asked questions

How long does the first census take?

About two weeks of calendar time, mostly waiting on small answers: a finance export, five team-lead conversations, an hour of assembly. The second census takes an afternoon.

What about systems IT does not know about?

That is most of the point. The money sweep catches the paid ones; the team-lead question catches the free ones; the amnesty principle applies - rows are information, not evidence.

Who should own the census?

Operations or finance, with IT as a contributor. It is a business document about technology, not a technology document - the owner should be the person who feels the renewals.

A Defensible Next Step

This week, ask finance for one export: every recurring software charge for the last twelve months. Sort it by vendor, and you are looking at the first draft of the most useful page in the company. Book a Decision-Clarity Call if you want the census built and kept.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Board Technology Oversight

All CISO Insights
Board Technology Oversight

Concentration Risk in One Cloud Region

When most workloads sit in one cloud region, one failure reaches everything. A dependency heat map shows where the blast radius is bigger than intended.