Infrastructure discovery establishes where a business application runs, which services it depends on and who can control them. It is essential during a supplier handover, legacy takeover, audit or recovery because the visible website may represent only a small part of the operating system.
Define the scope by service, not by server
Modern applications may use virtual machines, managed databases, object storage, queues, serverless functions, content-delivery networks and third-party APIs. Begin with the business services that must continue, then map the infrastructure supporting them.
Include production, staging, test, recovery and administrative environments. An forgotten test environment can still contain sensitive data or generate cost.
Build an infrastructure inventory
| Area | Record |
|---|---|
| Accounts and subscriptions | Provider, tenant, legal owner, billing owner, administrators and recovery contacts. |
| Compute and application hosting | Services, regions, operating systems, runtimes, scaling and patch responsibility. |
| Databases and storage | Engine, version, location, size, encryption, retention and recovery method. |
| Network and access | DNS, certificates, firewalls, private networks, VPNs and administrative routes. |
| Deployments | Repositories, pipelines, artefact stores, approvals and rollback procedure. |
| Operations | Monitoring, logs, alerts, backups, schedules and incident contacts. |
| Integrations | APIs, webhooks, file transfers, email, payments, identity and data feeds. |
Identify ownership and billing control
For each provider, establish whose organisation or account holds the service. A supplier may have created resources inside its own shared account, which can complicate access, billing and transfer.
Check:
- contracting legal entity;
- primary and backup administrators;
- payment method and invoices;
- support plan and provider contacts;
- renewal or commitment terms;
- whether resources can be transferred or must be migrated.
Trace a business transaction
Static inventories often miss dependencies. Choose representative journeys—such as submitting an application, taking a payment or producing a daily report—and trace them across:
- user interface;
- application service;
- database;
- background processing;
- third-party integration;
- notification;
- logging and monitoring.
This reveals components that are not obvious from a hosting dashboard.
Review access safely
Do not begin discovery by disabling accounts or rotating every credential. First establish which automation and integrations depend on them. Then move towards named accounts, least privilege, multifactor authentication and controlled service identities.
Secrets should be stored through an appropriate secrets-management process rather than copied into the discovery document.
Verify backups and recovery
A backup label in a provider console is not enough. Record:
- what is backed up;
- frequency and retention;
- where copies are stored;
- who can restore them;
- the latest successful restoration test;
- dependencies needed after restoration.
Include database, uploaded files, configuration and any external records required to reconcile the system.
Find undocumented operational work
Ask about activities performed manually by the outgoing supplier:
- renewing certificates or domains;
- clearing queues or disk space;
- running data corrections;
- importing files;
- restarting services;
- checking failed payments or messages;
- updating allowlists and integration credentials.
Convert repeated manual work into documented procedures, monitored automation or explicit support tasks.
Assess immediate risks
| Finding | Immediate response |
|---|---|
| Single personal administrator account | Create controlled organisational administration and recovery access. |
| Unknown production version | Preserve the environment and link deployment to a verified source baseline. |
| No tested restoration | Protect current backups and schedule a controlled recovery test. |
| Supplier-owned shared hosting | Document dependencies and plan transfer or migration before ending access. |
| Unmonitored scheduled jobs | Identify business impact, add logging and define failure alerts. |
Completion criteria
Discovery is complete when the receiving organisation can explain the system, access the agreed accounts, identify the current release, see operational health, restore important data and name an owner for each dependency. A spreadsheet full of hostnames without those capabilities is not a completed handover.