IT Service Catalogue
Software.

Most enterprises can’t produce an accurate list of the services their business actually runs. Not IT services — business services. The ones customers pay for, the ones regulators care about, the ones suppliers are contracted to support. Without that list, every other governance decision floats.

HelixGate is built around the Service Catalogue. It is the authoritative register — owner, tier, lifecycle, dependencies, commercial data — that every other module connects through. The constellation map is the data model.

“Until we had a service catalogue, every change request started with three weeks of asking around. Now it starts with a query.”

§ Head of Architecture, FCA-regulated
Service register / 184 active√ 100% owned
SVC-002TIER 1Customer Banking Portal3 contracts
SVC-014TIER 2Identity & Access7 deps
SVC-031TIER 3Internal Wiki2 deps
SVC-052TIER 4Print Services1 dep
SVC-091RETIRELegacy ETL · Q3 2026EOL
II — CAPABILITIES

Authoritative.
Importable. Connected.

Stand it up in days, not months. CSV import for first load. Cross-references generated automatically as you add records to other domains.

Authoritative register

Owner, tier, lifecycle status, criticality, recovery objectives, commercial data — one record, one truth.

Tiered criticality

Tier 1 (mission-critical) through Tier 4 (low-impact). Drives RTO/RPO requirements, supplier risk thresholds.

Dependency graph

Interactive graph of upstream and downstream service dependencies. Find blast radius before the change.

CSV / XLSX import

Self-service import with validation. First load in an afternoon, not a quarter. Mapping templates supplied.

Lifecycle states

Proposed → live → retiring → retired. EOL dates tracked. Replacement services linked.

Change immutability

Every owner change, tier change, status change — logged immutably. Service ownership is never “just lost”.

III — CONNECTIONS

How it connects.

Service catalogue is the hub. Every other domain links through it.

→ Contracts. Spend per service tier visible. Concentration risk obvious.
→ Suppliers. Which suppliers underpin which services — with criticality flowing upstream.
→ ADRs. Architecture decisions linked to the services they shape.
→ Business cases. Cases reference the services they enhance, replace, or retire.
→ AI governance. AI systems registered as services — risk classification flows through.
II·b — CONTEXT

The register that makes all other governance possible.

An IT service catalogue in the ITIL sense is a list of services available to the business. Useful operationally, but insufficient as a governance foundation. An enterprise service catalogue is something different: an authoritative register of every service the organisation runs, who owns it, what technology and suppliers underpin it, what decisions shaped it, and what risk it carries. That distinction matters when a regulator asks about operational resilience.

FCA PS21/3 requires regulated firms to identify their important business services, map the people, processes, technology, and third parties that support them, and demonstrate that each service can tolerate specified disruption tolerances. That is not a catalogue of available services. It is a governance map of the operational estate — and it needs to be maintained, not just produced once for a regulatory submission.

HelixGate treats the service catalogue as the connective tissue of the platform. Every other module connects through it: suppliers linked to the services they support, contracts attached to the services they govern, architecture decisions linked to the services they shape, business cases traceable to the services they funded. Risk concentration becomes visible when a single Critical supplier underpins three important business services with no contractual exit provision.

Service ownership is explicit. Every service has a named owner, a risk classification, and a dependency map. When ownership changes, the record updates. When a service is retired, the governance history is preserved. The catalogue is a living register, not a slide deck produced for the last audit.

Further reading
§ Closing statement

Stand up the register in an afternoon.

Bring your existing service list as CSV — we’ll show how it imports, how dependencies are inferred, and how the rest of the platform connects.