# HAV Seafood — IT & Systems Reference Tables

## Purpose

This workbook is the **derived, AI-friendly navigation and joining layer** across the complete static **IT & Systems Architecture** for HAV Seafood.

It belongs to **Phase 1 — Business Architecture**:

**1. Business architecture -> 2. Stories -> 3. Operational dataset**

The workbook contains no new authoritative IT master data. It reorganizes and joins structures from the four authoritative IT workbooks and selected upstream Shared Enterprise, HR and Production sources so humans and AI systems can answer common cross-IT questions quickly.

If any value in this workbook conflicts with an authoritative source, **the authoritative source wins**.

---

## Architecture scope surfaced here

The reference workbook currently exposes:

- **13 enterprise systems**;
- **26 application components**;
- **21 system environments**;
- **22 defined system integrations**;
- **54 integration-to-data-object relationships**;
- **70 system access roles**;
- **34 reusable access profiles**;
- **222 access-profile-to-system-role relationships**;
- access defaults for all **56 enterprise job roles**;
- security classification for all **132 governed data objects**;
- **103 managed IT assets**;
- **18 IT services**;
- **24 IT processes**;
- **32 core IT service/change controls** plus **22 IAM/security control requirements**;
- **26 consolidated IT/IAM segregation-of-duties rules**;
- **14 service-level/metric definitions**.

These values describe static architecture, not operational history.

---

## Authoritative source workbooks

### `hav_seafood_it_systems_applications_integration_architecture_v1.xlsx`
Authoritative for IT technical system profiles, application components, environments, integrations, integration data scope, system technical dependencies, support models and change-window rules.

### `hav_seafood_it_identity_access_security_framework_v1.xlsx`
Authoritative for identity/account classes, authentication, system access roles, access profiles, role/position access defaults, privileged access, access lifecycle, information classification, system security requirements and IAM/security controls.

### `hav_seafood_it_infrastructure_endpoint_continuity_v1.xlsx`
Authoritative for managed IT assets, endpoint profiles, network zones, infrastructure services, Production-to-IT bridges, infrastructure dependencies, backup profiles, recovery tiers, continuity requirements, patch/lifecycle profiles and monitoring requirements.

### `hav_seafood_it_service_change_control_framework_v1.xlsx`
Authoritative for IT services, request/incident taxonomies, problem/change structures, change authority, core IT controls, IT segregation of duties, exception/escalation structures, service-level definitions and IT processes.

Upstream Shared Enterprise, HR and Production workbooks remain authoritative for system identity, business-data ownership, employee/job-role/position identity, enterprise locations and Production work centers/equipment respectively.

---

## Reference sheets

### `System_Reference`
Main system-centric front door. Combines enterprise system identity with technical, security, continuity and primary IT-service context for all 13 systems.

### `System_Component_Ref`
Application components grouped under their authoritative `System_ID`, with technical context.

### `System_Environment_Ref`
Explicit system environment definitions. Components are **not** implicitly mapped to environments where the source architecture does not define that relationship.

### `Integration_Reference`
One row per authoritative `System_Integration_ID`, showing source/target systems, transfer method, automation, criticality, security and operational control requirements.

### `Integration_Data_Ref`
Expanded integration-to-data-object layer connecting each interface to governed data objects, business owner domains and authoritative systems.

### `System_Dependency_Ref`
Consolidates explicit application/system dependencies and infrastructure dependencies. It does not infer unrecorded dependencies.

### `Access_Profile_Reference`
Compact overview of reusable IT access profiles and the systems represented in each profile.

### `Role_Access_Reference`
Maps all 56 enterprise job-role/position defaults to their normal access profile. This expresses **eligibility/default architecture**, not actual employee permissions.

### `Profile_System_Access_Ref`
Expanded relationship from access profile to system access role and its capabilities, sensitivity and approval requirements.

### `Security_Reference`
System-level security requirements covering information classification, authentication, MFA, encryption, logging, monitoring, review and export controls.

### `Data_Security_Reference`
Joins all 132 governed data objects to business ownership, authoritative system and information-security classification.

### `IT_Asset_Reference`
Compact view of all 103 managed IT assets with endpoint, location, department, network, system and Production work-center context where explicitly defined.

### `Location_IT_Reference`
Location-centric view of IT assets, network zones and explicit Production work-center bridges.

### `System_Infrastructure_Ref`
System-centric infrastructure dependency view, including recovery context.

### `Backup_Recovery_Reference`
Combines recovery tiers and applicable backup profiles for enterprise systems and infrastructure services.

### `IT_Service_Reference`
Compact overview of IT services, primary system/infrastructure dependencies, criticality, support and ownership.

### `Request_Incident_Reference`
Union view of service-request types and incident categories. These remain different business objects; the sheet merely provides a common navigation layer through IT services.

### `Change_Reference`
Compact view of change types, default risk classifications and matching class/risk approval rules.

### `Process_Control_Reference`
Expands IT processes to their referenced IT controls and applicable enterprise systems.

### `Control_Reference`
Consolidated catalog of the core Service/Change IT controls and IAM/security control requirements. The original control IDs and source workbooks remain authoritative.

### `SoD_Reference`
Consolidated view of IT-service/change and IAM/access segregation-of-duties requirements.

### `Exception_Escalation_Ref`
Joins exception types to their reusable escalation classes and response expectations.

### `Service_Metric_Reference`
Static service-level and performance metric definitions only. No results are included.

### `Cross_Domain_Bridges`
Consolidates explicit cross-domain relationships from the IT architecture, including department-to-system use, HR role/position-to-access defaults, Production work-center-to-IT-asset bridges and business-domain/IT responsibility handoffs.

### `Entity_Ownership_Source`
Quick source-of-truth guide for important IT and upstream entities. It is documentation of existing authority, not a new ownership model.

### `Relationship_Catalog`
Machine-friendly explanation of the most important IT entity joins and their authoritative sources.

### `Architecture_Source_Catalog`
Lists the authoritative IT workbooks, supporting upstream sources and this derived reference workbook.

### `Architecture_Notes`
Important scope, ownership and interpretation decisions.

### `Data_Dictionary`
Field-level description of the reference workbook.

---

## Recommended AI navigation

For fast context:

- What systems does HAV Seafood use? -> `System_Reference`
- What technical components/environments belong to a system? -> `System_Component_Ref` + `System_Environment_Ref`
- How do two systems exchange data? -> `Integration_Reference`
- What data passes through an interface? -> `Integration_Data_Ref`
- Which system is authoritative for a data object? -> `Data_Security_Reference` / `Integration_Data_Ref`, then verify the System/Data Ownership source
- What does role X normally access? -> `Role_Access_Reference`
- What can access profile X do in system Y? -> `Profile_System_Access_Ref`
- What security requirements apply to a system? -> `Security_Reference`
- What classification applies to data object X? -> `Data_Security_Reference`
- Which IT assets exist at a location? -> `Location_IT_Reference`
- Which Production work centers have explicit IT asset bridges? -> `IT_Asset_Reference` / `Location_IT_Reference`
- What infrastructure does a system depend on? -> `System_Infrastructure_Ref`
- What recovery/backup expectations apply? -> `Backup_Recovery_Reference`
- Which IT service supports a system or infrastructure object? -> `IT_Service_Reference`
- Which request/incident taxonomy applies? -> `Request_Incident_Reference`
- How are changes governed? -> `Change_Reference`
- Which controls apply to an IT process? -> `Process_Control_Reference`
- Which IT and IAM controls exist? -> `Control_Reference`
- Which segregation rule applies? -> `SoD_Reference`
- How should an exception escalate? -> `Exception_Escalation_Ref`
- Which IT service metrics are defined? -> `Service_Metric_Reference`
- Where does IT responsibility meet another business domain? -> `Cross_Domain_Bridges`
- Which source should be trusted? -> `Entity_Ownership_Source` + `Architecture_Source_Catalog`

---

## Important conceptual boundaries

The reference layer preserves these distinctions:

`Enterprise System != Application Component`

`Application Component != System Environment`

`System Integration != Integration Execution`

`System Dependency != Integration`

`Employee != Digital Identity != Account`

`Access Profile != System Access Role != Actual Permission Grant`

`Access Eligibility != Actual Access`

`IT Asset != Production Equipment`

`Network Zone != Physical Location`

`Backup Requirement != Backup Execution`

`Recovery Tier != Outage / Recovery Event`

`IT Service != Enterprise System`

`Incident Category != Incident`

`Change Type != Change`

`Control != Control Execution`

`Service Metric Definition != Metric Result`

`Technical System Owner != Business Data Owner`

---

## Phase 1 exclusions

This workbook does **not** contain operational or historical IT records such as:

- user accounts or usernames;
- actual access grants or permission changes;
- authentication/login events;
- password/MFA events;
- IT tickets or service requests;
- incidents or incident comments;
- problems/root-cause cases;
- change requests or deployments;
- approval events;
- patch executions;
- endpoint/network/security logs;
- integration executions or failures;
- system uptime/outage history;
- backup jobs or restore events;
- security alerts/incidents;
- vulnerability findings;
- control executions/failures;
- service-level results;
- IT operational emails or communications.

Those belong to Phase 3 after the business stories are deliberately designed in Phase 2.

---

## Overall role

This workbook is the **main AI front door for HAV Seafood's static IT & Systems Architecture**.

It allows fast system-, access-, data-, asset-, continuity-, service- and control-centric navigation without copying every authoritative workbook into context. Detailed decisions should still be verified in the relevant authoritative source when exact rules, scope or ownership matter.
