Costs
Part of Why does MarTech stack management start with capabilities, not logos?
Martech stack management checklist: evidence, owners and cadence
A martech stack management checklist covering capability, inventory, control, value and closure, with evidence, pass tests, owners, cadence and sign off.
What to take away
- The checklist covers five areascapability and ownership, inventory and architecture, control and operation, value and renewal, then closure.
- Verify every item against a live service using configuration, logs, contracts, exports, and one recovery test, not policy text alone.
- Run the full checklist twice a year. Refresh access, cost, and renewal dates every quarter.
- Each gap gets an owner, a consequence, a temporary control, and a due decision date.
This is a verification checklist run against live services, not a procurement spreadsheet or a policy audit. It does not rank vendors, and it does not replace legal advice. Every line asks one question: is this true today, and what evidence proves it?
Capability work comes before product choices, which is why MarTech stack management starts with outcomes rather than logos.
The evidence register, area by area
The evidence register
| Area | Minimum evidence | Pass test | Decision |
|---|---|---|---|
| Capability | Outcome, users, workflow, named owner, criticality | Owner names the workflow and the outcome it serves | Keep, change, or remove |
| Service | Inventory, architecture, access, support terms, risk | Live setup matches contract and diagram | Control or redesign |
| Economics | Usage, unit cost, contract terms, alternatives | Cost per successful workflow is known | Renew, negotiate, or migrate |
| Closure | Export file, transition record, deletion proof | Export opens outside the platform | Close or assign the remainder |
Work the register top to bottom. Each pass test can be answered with a screenshot, a log line, or a test result.
Capability and ownership
The first area maps what the business needs and who answers for it.
Capability and Ownership Setup
- Map outcomes to capabilities and personas
- Assign portfolio, business, technical owners
- Define authoritative data systems
- Document gaps, overlaps, and target state
- Name the customer and business outcomes, then the capabilities that serve them.
- List personas, workflows, criticality, and constraints.
- Name current products, overlaps, gaps, and the target state.
- Assign portfolio, technical, data, integration, contract, security, privacy, and backup owners.
- Name the authoritative system for identity, consent, customer, product, price, and order data.
Inventory and architecture
NIST's Secure Software Development Framework gives a shared vocabulary for secure development and supplier talks. Use it when custom code, extensions, or acquisition evidence is in scope. Do not treat it as a certification.
- Inventory products, editions, instances, environments, scripts, tags, plugins, APIs, and suppliers.
- Record contracts, costs, renewal dates, lifecycle status, and known risks.
- Map data stores, integrations, regions, trust boundaries, and sensitive flows.
- Document schema, identifiers, transforms, permissions, retry logic, and retirement per integration.
Stale registers cause most of the damage here. How to keep a stack register honest explains how a register drifts and what a review catches.
Control and operation
CISA's SCuBA FAQ describes an effort to secure cloud business applications through hardened settings. It is federal-specific, yet the lesson travels: verify the deployed configuration, not the product name.
- Review centralized identity, multifactor authentication, least privilege, service accounts, and secret storage.
- Check joiner, mover, and leaver controls, plus partner and credential expiry.
- Track releases, deprecations, configuration versions, change review, and rollback.
- Watch availability, latency, errors, data freshness, support tickets, and technical debt.
Teams unsure of the order should read which stack management questions come first, because sequencing the questions prevents wasted review cycles.
Value, renewal and exit
- Measure successful workflows, role fit, quality, adoption, total operating cost, and supplier health.
- Read contracts before notice dates for overage, AI consumption, service levels, data use, audit, export, and termination.
- Test outage, restore, integration replay, export, migration, rollback, and deletion.
Consent belongs in the same pass. Canadian obligations under PIPEDA are set out in the OPC guidance for businesses, and they differ from United States practice.
The marketing data governance checklist covers the evidence points that pair with this register, which helps when consent and deletion proofs live outside the stack team.
Example: one completed item
Item: backup tag fires after consent withdrawal.
One completed item
- Evidence inspected
- tag manager audit log, CRM consent field history, live network trace.
- What was found
- the tag fired from a cached audience for up to six hours.
- Gap
- withdrawal not honored near real time.
- Owner
- marketing operations lead, with the data governance group.
- Temporary control
- cache refresh cut to 30 minutes until the fix ships.
- Due decision
- 21 days, proven by a repeat withdrawal test.
Cadence and sign-off
- Monthlyaccess reviews, credential expiry, incident follow-up.
- Quarterlycost and usage, renewal dates, integration health, gap register.
- Twice a yearthe full checklist, end to end, with one recovery test.
- Annuallycontract terms, privacy review, and retirement candidates.
The marketing operations lead runs the cycle. The stack owner signs each pass, and finance signs the economics line. An unsigned cycle counts as incomplete.
Common questions
How often should the checklist be run?
Run the full list twice a year. Refresh access, cost, and renewal items quarterly, because those change faster than architecture does.
Who signs off each cycle?
The marketing operations lead completes it, the stack owner signs it, and finance signs the cost and renewal line.
What evidence counts as proof?
Configuration screenshots with timestamps, log extracts, contract clauses, an export file that opens, and a recovery test result.
When do I mark an item not applicable?
Only with a written reason. A material gap is a decision with an owner, a consequence, an interim control, and a due date.
