Now that we have identified the information types within our organization we need to understand where this information resides within the information system. You may find that your business users might not be able to help as much now that we are starting to look for the information within the IT environment. However, your business users should be able to point you in the right direction. Ask them who they work with in the IT organization when using their services. Ask them how they access their information and what the path is to that location. From a business user perspective, you may quickly find this is all they can give you. On a positive note, your business users should be able to provide this level of detail. This information is a great start, then you can go back to the IT team and start tracking down where the business information resides.

Now that you have some basic information from your business users you can take this to your IT department and begin hunting down the physical location of the data. You may need to work with various members of your IT department, including the following:

• Information and system architects
• Database administrators
• System administrators
• Network administrators

More than likely, the data that you discover based on your interviews with business users does not exist on a single server. Modern information systems have components that are spread across multiple physical servers.

For example, in the case of a web-based application a properly architected application will sit across three tiers:

1. Presentation tier: This is the top-most level of the application stack and comprises the user interface.
2. Logic tier: This level of the application stack communicates between the presentation and data tier. This part of the stack performs calculations, processes commands, makes decisions, and so on.
3. Data tier: This is the lowest level of the application stack. This part of the stack stores that data of the application.

In the preceding example, you can see that a simple URL provided by a business user could easily expand out into 36 servers with 12 application interconnections across 3 security zones. This is information that the average business user would not have and that the IT team will have readily available.

While the information storage exists within the database tier, the totality of the application must be considered when it comes to information as the data is processed and manipulated by the entire application.