# Applications

List the organization's applications, built in-house or supplied by a vendor, and track their repositories, relations, personal data and assessments.

> **Access:** member. The register depends on your plan. The list only shows records you can access; an organization administrator sees them all. The **Personal data** tab depends on the GDPR module and is in **beta**.
>
> **Language:** these screens are not yet translated into English. Labels below translate the French interface.

An application is a technical solution of the organization (customer portal, billing API, business tool…), built in-house or supplied by a vendor. Former internal projects have been carried over as applications; old links lead straight to them.

## Create an application

1. Open **Registers → Applications**, then **New application** (or the menu **+** shortcut).
2. **Identity**: name, type (Web application, Mobile application, API / service, Business tool, Data pipeline, Automation script, System connector, Regulatory reporting, Other), sourcing (**Internal** or **Vendor**) and **Owner**. If the sourcing is **Vendor**, choose the **Publisher**. Name and owner are required.
3. **Context** (optional): **Linked projects**, lifecycle (Planned, In service, Retired), hosting (On premises, Cloud, SaaS, Hybrid, Unknown) and environments. Name each added environment, or delete it.
4. **Access** (optional): choose who can view or edit the record. You remain its administrator.
5. **Summary**, then create the record.

On a vendor record, the **Applications** section lists the solutions it publishes and offers **Add an application**.

## Read the record

| Tab | Content |
|---|---|
| Overview | Identity, owner, sourcing, lifecycle, hosting, environments, technical information. |
| Code and DevSecOps | Linked GitHub or GitLab repositories, with the tools enabled on each (currently **Dependencies**, the import of dependency vulnerability alerts). |
| Relations | Associated records and follow-up: vendors, projects, risks, actions, assessments… |
| Personal data | GDPR declaration of the application (if the module is available). |
| Access | Authorized people and teams, with Read, Edit or Administration rights. |

**Edit record** updates its information, with the edit right.

## Link code repositories

Repositories are linked from the GitHub or GitLab connector page, not from the record. The **Code and DevSecOps** tab offers **Open connectors** if no code connector is active. See [GitHub](https://docs.cisapp.eu/en/organization/connectors/github) and [GitLab](https://docs.cisapp.eu/en/organization/connectors/gitlab).

## Associate records and actions

In **Relations**:

1. **Associate a record**: choose the type (Application, Vendor, Business activity, Assessment, Risk, Incident, Exemption, GDPR processing activity, Action, Action plan, Project), then the record. For a vendor, set its role: Associated, Host, Integrator or Other provider.
2. **Add an action**: action to carry out, owner, due date, in an existing action plan or a new one.
3. **Assess** starts an assessment of the application; **Reuse an assessment** associates an existing one.

Relations grant no access rights: grant the required access explicitly in **Access**. Assessments keep their scope and date; vendor scores are not carried over to applications.

## Declare personal data

The **Personal data** tab asks whether the application processes personal data (Yes, No, To be qualified), then asks for data categories, GDPR role, hosting, DPIA (Not required, Required, In progress, Completed) and retention period. Findings flag inconsistencies with the processing register: missing DPIA, undefined retention, undeclared hosting, no linked processing activity, contradictory or outdated declaration.

## Assess an application

Open **Assessments → Application assessments**, or **Assess** from the record. See [Assessment types](https://docs.cisapp.eu/en/assessments/types).

## Expected outcome

The application is identifiable in the register with its owner, relations and access, and its assessment can be started.

## Common issues

- Record missing from the list: it is not shared with you. Ask its administrator for access rather than recreating it.
- Creation blocked: enter the name and owner, and the publisher for a vendor application.
- Someone linked through a relation cannot see the record: relations do not grant access.
- No repository shown: link the repository from the connector page.