Step two, what the client can actually give us A database is the easy channel. Half of what an ontology needs is not in one: it is in a framework document, a contract annex, or the spreadsheet one team keeps because no system ever held it. Both are read here, and neither is interpreted on this page.

Connect the source

Not connected

The connector is chosen first, because it decides what the rest of the form asks for. An RDS instance wants an IAM role or a secret; a Snowflake account wants a key pair; an ODBC source wants a driver and a connection string.

Amazon RDS for PostgreSQL

Nothing is read until the test passes. The test is also what proves the role is as narrow as it claims to be.

What the test checks

Run the test and the results appear here: reachability, TLS, server version, and the privileges the role actually holds, which is the part nobody verifies until an audit asks.

How the documents were taken in

Half the ontology is not in a database

Most of these documents already live somewhere the client manages. Connecting to that place beats asking somebody to export a folder, because the connection notices when a policy is superseded and a mailed zip file does not.

FileExtent What was pulled out of itKept
Kritische_Geschaeftsprozesse_2026.xlsx 214 rows A whole entity. Sheet Prozesse 2026, range A2:I215, nine columns with headers. Entity
ICT-Risikorahmenwerk_v4.2.pdf 68 pages Seven business definitions and four tolerance thresholds, each tied to the clause it came from. Definitions
Rahmenvertrag_CloudProvider_2024.docx 41 pages Annex B is a table: provider, subcontractor, service, country. Read as rows, not as prose. Entity
Notfallhandbuch_ITSM.pdf 112 pages One section per system, each with a labelled RTO and RPO. Structure carried the data, not a table. Entity
Confluence_ITSM_Space.zip 340 pages A glossary page the team wrote for itself in 2019. 34 terms, 12 of which contradict the framework PDF. Definitions, conflicting
Praesentation_Vorstand_Q1.pptx 22 slides Summary figures with nothing underneath them. No page, no cell, no row to trace any number back to. Dropped

A document is kept only when what it says can be traced to a page, a sheet and a cell. The board deck fails that test, so it is read and then dropped rather than quietly averaged into the model.

Business definitions found

The client’s own words for their own things. These are not mapped to anything yet; they are what the client means, recorded with where they said it.

Kritischer Geschäftsprozess
A process whose interruption for more than four hours causes material harm to customers or to the bank.
ICT-Risikorahmenwerk_v4.2.pdf, §4.2, p. 19
Störung
An unplanned interruption or reduction in quality of an IT service. Distinct from a Notfall, which is declared.
Notfallhandbuch_ITSM.pdf, §2.1, p. 8
Kritikalität conflicting
Four tiers in the framework PDF, tied to recovery time. Three tiers on the Confluence glossary page, tied to user count. The database carries the four-tier version.
ICT-Risikorahmenwerk §3.4 · Confluence/ITSM/Glossar
Wiederanlaufzeit
The time within which a system must be usable again after an interruption. Measured from declaration, not from onset.
Notfallhandbuch_ITSM.pdf, §3, p. 34
Auslagerung
Any arrangement where a third party performs a process the bank would otherwise perform itself.
Rahmenvertrag_CloudProvider_2024.docx, §1.3
12 conflicts Twelve terms are defined twice and differently, mostly between the 2019 wiki glossary and the 2024 framework. Nothing is resolved automatically. Each conflict is put in front of the client, because which one is true is a question about their business and not about their data.
See the ontology this adds up to Next: their estate drawn out, with every inferred relationship put to a person.