Opening the conversation, how this reached your desk

• Tell me briefly how this regulatory issue first came to your team's attention Options: Examiner finding, Internal audit, Customer complaint, Third-party assessment, Other
• When the examiner set the timeline, what deadline were you given to produce a full inventory and evidence of deletion or retention Options: 48 hours, 1 week, 2 weeks, 30 days, Other
• Who on your side is accountable for responding to the examiner, and who will be our day-to-day contact for discovery Options: Chief Data Officer, General Counsel, Head of Data Engineering, Compliance Officer, Designated program manager, Other
• How many systems does your team estimate might hold customer personal information that we should prioritize in a first pass Options: Fewer than 10, 10–50, 51–200, 201–500, More than 500, Unsure

Where the current inventory breaks under pressure

• What single missing artifact in your current inventory would make an examiner consider the response incomplete Options: Source system list with owners, Column-level lineage, Retention policy logs, Deletion certificates for downstream copies, Time-stamped scan evidence, Other
• Walk me through the last time an examiner challenged your inventory, what information did they request beyond what you provided
• How often do such gaps occur across your systems Options: Almost always, Often, Occasionally, Rarely, Unknown
• Which data domains tend to be most problematic when tracing customer personal information in your estate Options: Core banking ledgers, Customer relationship systems, Data lake/warehouse, Analytics platforms and reports, Legacy on-prem databases, Cloud object storage, Third-party processors
• If you could only guarantee evidence from one system within the examiner's timeline, which system would you pick and why

How this failure actually hits the business

• Who bears the regulatory and financial risk if the examiner rejects your response Options: Board or executive team, Risk and compliance office, Chief Data Officer, General Counsel, Line-of-business owners, All of the above
• What financial or operational consequences followed the last negative exam finding
• Describe how much manual effort and how many FTE hours your team spends each month keeping the current inventory accurate Options: Less than 10 hours total, 10–40 hours, 40–160 hours, More than 160 hours, Not tracked
• Typically, what's the elapsed time from a regulator's request to a verifiable lineage report from your team Options: Under 24 hours, 24–72 hours, 3–7 days, More than 7 days, Unknown
• If the examiner required proof of deletion across all downstream copies, what part of your environment would make you stop the project immediately

What's getting in the way right now

• Where do integration or access bottlenecks create the biggest risk of missing the examiner deadline Options: No API access to critical systems, Security review delays, Lack of credentials or approvals, Network or VPN restrictions, Legal data-sharing constraints, Other
• Which teams own the connectors or APIs we would need to crawl, and how responsive are they to urgent access requests Options: Data Engineering, high responsiveness, Data Engineering, limited availability, Platform Engineering, Security/Infrastructure, Third-party vendor controls, Not assigned
• Do you have a central identity or access management process that can issue time-bound credentials for the seller to perform read-only discovery Options: Yes, automated provisioning, Yes, manual approval required, No, will need ad hoc provisioning, Unsure
• Tell me about any encryption or masking in place that might prevent automated column discovery without additional approvals
• Identify the single access gap, if unresolved, that would force you to extend the examiner's deadline

The alternatives you are weighing

• Name the main external solutions your team is actively evaluating and any internal option proposed to solve inventory and lineage gaps Options: Incumbent governance vendor, Internal build project, Point discovery tool, Cloud provider native features, Manual spreadsheet approach, Other
• Under what conditions would you keep your current approach instead of switching to an external solution
• Has an internal team proposed to build automated discovery and lineage rather than buying a vendor, and if so what timeline and budget did they estimate Options: No internal proposal, Yes, <3 months and limited budget, Yes, 3–6 months and moderate budget, Yes, >6 months and large budget, Unsure
• Pick the single most important evaluation criterion when choosing between external vendors and an internal build Options: Discovery accuracy, Column-level lineage depth, Legal defensibility of evidence, Integration non-invasiveness, Time to produce examiner evidence, Total cost of ownership
• Could any single missing capability from external vendors cause you to commit to an internal build instead Options: Yes, missing lineage depth, Yes, missing enforcement controls, Yes, unacceptable integration model, No, internal build not preferred, Unsure

If this succeeds, what changes for you

• Imagine a 60-day proof-of-concept proved full discovery and lineage for your highest-risk domain, what would change in your next examiner interaction
• List the measurable acceptance criteria your team would require from a 60-day POC to sign a commercial agreement Options: >=95% discovery accuracy for scoped systems, Column-level lineage for prioritized pipelines, Automated retention or deletion enforcement, Non-invasive integration with no pipeline changes, Examiner-ready evidence package delivered
• Identify the stakeholders who must approve POC success, and their individual success metrics or redlines
• Within your target timeline, what level of lineage depth do you expect the seller to produce for the pilot domain Options: Source to ETL job mapping, Source to table column mapping, Source to report column with transformations, Full column-level lineage including code-level steps
• Assuming the POC meets the acceptance criteria, what internal obstacle could still prevent your procurement or legal team from signing the contract within 30 days

Realities that will block or speed implementation

• Name the non-negotiable technical or compliance constraints we must meet before beginning discovery Options: Read-only access only, No changes to production pipelines, No added latency requirement, Pre-approved legal agreement, Segregated test environment, Encrypted-at-rest only
• Do you currently have service accounts or vetted connectors the seller can use for read-only crawling Options: Yes, preapproved service accounts exist, Yes, but require explicit request per system, No, accounts must be provisioned, Unsure
• Point to the owner or team who controls API access for each critical system and whether escalation paths exist
• Is there an active legal or compliance review process that will need to clear a third-party discovery run before credentials are issued Options: Yes, formal approval required, Yes, but expedited path available, No formal process, Unsure
• List any external vendor contractual terms or insurance requirements that would block discovery without higher approval

The technical path: connectors, latency, and non-invasiveness

• Given your current architecture, what integration approach would be unacceptable to your CTO Options: Any pipeline changes, Agents with write access, Introducing measurable latency, Unvetted third-party dependencies, Required refactoring of ETL code
• Provide the top five source systems or storage endpoints we must crawl during the POC Options: Relational databases, Data warehouse, Cloud object storage, Streaming platform, BI and reporting tool, Data lake, Third-party processor endpoints
• Are there encryption, tokenization, or masking layers that will prevent column-level inspection without additional approvals Options: At-rest masking prevents inspection, In-transit encryption only, Tokenization via proxy blocks access, Full column access available, Unsure
• Estimate the minimum window of uninterrupted access you can provide during the 60-day POC for continuous crawling and lineage capture Options: 8 hours per day for 60 days, 24/7 access for 14 consecutive days, 24/7 for the full 60 days, Custom schedule we will propose
• Point out the single integration or security concern that would stop your CTO from approving the POC
• Provide the expected SLA for discovery jobs in production and any maximum acceptable performance impact thresholds

What examiner-ready evidence must look like

• Describe the minimum evidence package the examiner will accept to close this finding Options: Inventory of systems with timestamps and owners, Column-level lineage maps with hashes, Deletion event logs with verifiable timestamps, Retention enforcement audit logs, Signed attestations from data owners
• Outline the stakeholders who must receive the evidence and their preferred format Options: Regulatory exam team, PDF and CSV, Internal legal, audit trail and raw logs, Board compliance committee, executive summary, Business unit owners, searchable catalog, External auditors, full export
• Within what timeframe after POC completion do you need the first examiner-ready package Options: Immediately on day zero, Within 1 week, Within 2 weeks, Within 30 days
• Would a demonstration of automated deletion certificates for downstream copies close the finding, or does the examiner require additional steps Options: Sufficient to close the finding, Not sufficient, additional evidence required, Unsure, needs discussion with examiner

If we proceed, what must happen next

• Assuming we proceed, what authorization and legal steps need to be finished before we can start the POC within your requested timeline Options: Standard vendor security review, Data processing agreement signed, Internal legal signoff on scope, Board or executive approval, Other
• Share the top three systems you want prioritized in the 60-day POC and briefly explain why each is critical
• Estimate the internal resource commitment you can allocate to the POC in FTEs and approximate weekly hours per FTE Options: <0.5 FTE, 0.5–1 FTE, 1–2 FTEs, More than 2 FTEs
• State the single event that would allow your procurement team to sign within 14 days after a successful POC Options: Legal terms preapproved, Budget released, Stakeholder signoff completed, No outstanding security issues, Other
• When would you be ready to start a discovery run if all approvals are in place Options: Immediately, Within 2 weeks, Within 1 month, More than 1 month

• Automated Production Database Discovery
• Automated Data Warehouse Connector Deployment
• Cloud Object Storage Discovery and Cataloging
• Analytics and BI Platform Connector Deployment
• Streaming and Message Bus Connector Deployment
• Column-Level Lineage Reconstruction (SQL & Code)
• Non‑Invasive Pipeline Integration and Metadata Capture
• Live Data Catalog with Column Metadata
• Automated Retention and Deletion Enforcement
• Automated Data Masking and Pseudonymization
• Continuous Lineage and Schema Change Monitoring
• Regulatory Evidence Package Generation

Automated Production Database Discovery

• Which production database engines store customer personal information (for example, core banking PostgreSQL, Oracle, or mainframe DB)?
• How many distinct database instances (by host:port) contain customer account numbers or personally identifiable information (PII) you want crawled during the 60-day POC? Options: 1-5, 6-20, 21-50, More than 50
• Do you have any read-only replicas or reporting clones that must be excluded to avoid double-counting records? Options: Yes, No, Not sure
• List the schemas and example table names that hold KYC or customer contact fields we should prioritize (e.g., customers.customer_profile, loans.accounts).
• Provide the authentication method available for each database (username/password, certificate, cloud IAM role) and indicate where credentials will be stored. Options: Username/password, Certificate, Cloud IAM role, Kerberos, Other

Automated Data Warehouse Connector Deployment

• Identify the data warehouse platforms to connect for the POC (for example, Snowflake, Redshift, BigQuery) and the analytic schemas that host customer PII.
• Which warehouse schemas contain denormalized customer datasets used by reporting teams (for example, customer_ods, marts.customer_analytics)?
• Specify expected average daily query volume during discovery to estimate connector load on the warehouse. Options: Low (<100 queries/day), Medium (100-1,000 queries/day), High (>1,000 queries/day)
• Confirm whether we can create a read-only service account with usage limits and list any approval steps required by your security team. Options: Yes, approval pre-granted, Yes, requires approval, No, cannot create service account
• Provide sample SQL or table access controls (grant statements) that our connector will need to discover column-level metadata.

Cloud Object Storage Discovery and Cataloging

• List the cloud object storage buckets that may contain customer documents or exported PII (for example, S3 prefixes or GCS buckets).
• Indicate file formats present (CSV, Parquet, JSON, Avro) and which prefixes hold extracts of account or transaction data. Options: CSV, Parquet, JSON, Avro, Other
• Where are retention policies that govern object storage exports of customer data documented (policy repo, compliance binder)? Options: Policy repository, Legal binder, GRC tool, Not documented
• Do you use server-side encryption or customer-managed keys for buckets that contain PII? Options: Provider-managed encryption, Customer-managed keys, No encryption, Unknown
• Attach an example path to a sensitive object and sample object metadata we can scan during the POC.

Analytics and BI Platform Connector Deployment

• Identify BI tools that host dashboards built from customer datasets (for example, Tableau workbooks, Looker explores) that need lineage tracing.
• How many dashboards, scheduled extracts, or data models reference customer PII that we should include in scope? Options: 1-10, 11-50, 51-200, More than 200
• Are dashboards embedding SQL-derived fields or referencing derived tables created by ETL jobs such as Airflow DAGs or Spark jobs? Options: Yes, SQL-derived fields, Yes, code-based pipelines, Both, No
• State the connectors that require OAuth or SSO and note whether admin consent is pre-approved.
• Specify whether BI extracts run on a schedule or are live queries and the typical extraction window that may impact POC performance. Options: Scheduled extracts, Live queries, Both

Streaming and Message Bus Connector Deployment

• Name the streaming platforms that carry customer events (for example, Kafka topics, Kinesis streams) and specify the topics containing PII. Options: Kafka (topics), Kinesis or cloud stream, Other
• Estimate the partition count and consumer groups for high-volume topics used for transaction-level data. Options: Low partitions/consumers, Medium partitions/consumers, High partitions/consumers
• Indicate whether streams undergo schema evolution (Avro or Protobuf) and whether a schema registry exists. Options: Schema registry present, No registry, Partial registry coverage
• State the retention window for each topic containing customer identifiers and whether compaction is enabled. Options: <24 hours, 1-7 days, 8-30 days, More than 30 days
• Share connector network details including bootstrap servers, ports, and TLS requirements.

Column-Level Lineage Reconstruction (SQL & Code)

• Describe the primary ETL technologies that transform customer fields (for example, Airflow, dbt, Spark, stored procedures) and where transformation code is stored.
• Report the number of distinct transformation jobs that reference customer identifiers or PII and include representative job names. Options: 1-10, 11-50, 51-200, More than 200
• Enumerate SQL patterns commonly used to derive customer fields (joins, window functions, regex extraction) that impact lineage reconstruction.
• How will we access in-repo code artifacts (git URLs, access tokens) for code-based transformations to parse column mappings? Options: Read-only repo access, Code snapshots provided, No repo access allowed
• What acceptance criteria will confirm the POC has reconstructed column-level lineage from production reporting tables back to original source columns for a sample set of 50 pipelines? Options: >=95% column mapping accuracy, >=90% accuracy with manual exceptions log, Custom acceptance

Non‑Invasive Pipeline Integration and Metadata Capture

• Explain any constraints that prohibit installing agents or modifying existing ETL pipelines in your core banking or fraud detection environments.
• Detail which metadata surfaces are available for passive capture (query logs, job run metadata, orchestration APIs) in your data platform. Options: Query logs, Job run metadata, Orchestration APIs, Storage access logs
• Are there compliance rules that prevent connecting to audit logs or query history from the fraud analytics cluster? Options: Yes, No, Requires legal approval
• Report any windows of change freeze during the POC (for example, month-end close) when pipeline metadata is unstable.
• Share owner contacts for pipeline teams and the escalation path if connector activity triggers operational alerts.

Live Data Catalog with Column Metadata

• Declare canonical identifiers that must be visible in the live catalog for examiners (for example, customer_id, ssn_hash, account_number).
• How frequently should column metadata refresh to capture schema drift in reporting tables used by compliance? Options: Near real-time (<1 hour), Daily, Weekly, On schema change only
• Should lineage-annotated column descriptions include legal basis or retention policy references used by general counsel during examinations? Options: Yes, include legal basis, Yes, include retention policy, Both, No
• Estimate expected column-level cardinality ranges for representative customer tables to size catalog storage.
• Who will own catalog curation and approve edits to column metadata during the POC?

Automated Retention and Deletion Enforcement

• Describe your current statutory retention schedules for customer records (for example, account statements: 7 years, transaction logs: 3 years) and where they are stored.
• Explain which systems currently perform deletion workflows and how deletions are documented for examiners (audit trail, deletion receipts).
• What automated thresholds would you accept for POC success (for example, automated deletions executed within 7 days of policy expiry for 95% of eligible objects)? Options: >=95% within 7 days, >=90% within 30 days, Custom threshold
• Confirm whether deletions must propagate to downstream analytic copies, archived backups, and exported CSVs and name the archive storage locations. Options: Yes, must propagate, No, source-only, Propagate to selected sinks only
• Who will approve retention rule changes and which legal artifact documents the retention schedule (policy ID, legal memo) that examiners expect?

Automated Data Masking and Pseudonymization

• Enumerate the PII categories that require masking or pseudonymization for analytics (for example, SSN, full name, birthdate, payment card data) and preferred masking techniques. Options: SSN, Full name, Birthdate, Payment card data, Address, Other
• Name downstream consumers that expect masked values versus true values for production reporting or modeling.
• Outline key rotation and key management requirements if pseudonymization relies on deterministic encryption and customer-managed keys. Options: Customer-managed keys (CMK), Platform-managed keys, HSM-backed keys
• Clarify whether trial datasets used for model development require reversible pseudonymization under legal hold and which legal holds currently exist. Options: Reversible required, Irreversible only, Depends on dataset
• Give an example of a table and column where masking must preserve analytic aggregation properties (for example, masked credit_score still supports average calculation).

Continuous Lineage and Schema Change Monitoring

• How quickly must the system detect schema changes for customer-facing reporting tables (for example, within 24 hours of deployment)? Options: Near real-time (<1 hour), Within 24 hours, Within 3 days, Weekly
• Select preferred notification channels for schema-change alerts to data owners (email, Slack, ticketing system) and indicate severity thresholds. Options: Email, Slack, Ticketing system, SMS
• Declare the expected retention period for historical lineage graph versions for examiner review (for example, 90 days, 7 years). Options: 90 days, 1 year, 7 years, Other
• Clarify whether scheduled schema migrations (for example, quarter-end normalization) should be excluded from alerting windows. Options: Exclude scheduled migrations, Include all migrations, Exclude by agreed calendar
• Declare recipients for monthly lineage health reports and the KPIs they should contain (discovery accuracy, drift rate, missing lineage percent).

Regulatory Evidence Package Generation

• Outline regulator templates or evidence formats examiners expect (for example, CSV audit logs, PDF retention certificates, chain-of-custody manifests). Options: CSV audit log, PDF certificate, Chain-of-custody manifest, Other
• What evidence artifact will validate automated discovery accuracy for the POC (for example, a side-by-side CSV of discovered tables versus ground-truth inventory) and who will sign off?
• Detail the file formats and signing requirements for producing examiner-ready export bundles and whether notarization is required.
• Clarify whether evidence packages must include hash chains or checksums for each exported dataset and which hashing algorithm is required. Options: SHA-256, SHA-1, MD5, Other
• Supply the contact on your legal or compliance team who will accept the final evidence package and the delivery method (secure portal, SFTP, encrypted email).

• desired_state
• current_state
• stakeholders
• gaps
• success_criteria
• decision_readiness
• desired_state
• decision_readiness
• current_state
• success_criteria
• gaps
• stakeholders
• desired_state
• success_criteria
• stakeholders
• gaps
• current_state
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Subscription Agreement
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Service Level Agreement (SLA)
• Data Processing Agreement (DPA)
• Financial Services Compliance Addendum (Data Residency & SOC2)
• Data Access Authorization & Credentialing Form
• Technical Integration Requirements & Acceptance Annex
• Subprocessor Disclosure & Approval
• Change Order Agreement

• Go-live health check (weeks 1-4)
• First measurement review (weeks 4-10)
• Examiner evidence validation and handoff (approx. day 90)
• Operational enhancement and incident triage (monthly)
• Quarterly operational review (quarterly)
• Annual compliance readiness review (annual)

• Approve the prioritized backlog for the next quarter focused on closing remaining gaps.
• Reduce the count of open high-severity incidents and assign resolution windows for each.
• Agree the top 5 enhancement priorities for the next delivery cycle to support the acceptance criteria.
• Confirm the incident notification and evidence request process for regulators.
• Create fixes or workarounds for the top two high-severity incidents and schedule testing.
• Update the incident SLA tracker with measured mean time to resolve values and next milestones.
• Deliver a short incident root-cause report for each resolved enforcement failure.
• Quarterly metrics dashboard
• Confirm that catalog coverage and enforcement metrics are stable or improving toward the targets recorded in the POC Scope & Acceptance Criteria stage.
• Re-confirm deployment checklist and owners
• Validate retention and archive samples meet regulatory evidence requirements.
• Schedule remediation sprints for the top coverage gaps identified in the metrics dashboard.
• Publish the quarterly evidence sampling report and archive index.
• Update the operational runbook to reflect any process changes agreed in the meeting.
• Yearly metric trend analysis
• Confirm the organization can produce examiner-ready evidence within the mean time targets recorded in the POC Scope & Acceptance Criteria stage.
• Validate archive integrity and that the percentage of verified deletion requests meets compliance expectations.
• Agree the annual drill schedule and responsibilities for evidence retrieval testing.
• Run an annual evidence retrieval drill and publish the results with any remediation steps.
• Update retention and deletion configurations to reflect any regulatory or policy changes.
• Schedule the next annual compliance readiness review and interim sampling checkpoints.
• Confirm production crawling, lineage capture, and enforcement rollouts are running against the deployed connectors and environments.
• Document the top 5 open issues with remediation actions and target completion dates.
• Confirm schedule for the First measurement review meeting within the 4-10 week window.
• Publish a deployment health report capturing connector status, recent crawl results, and error logs.
• Log remediation tasks with resolution dates and evidence acceptance criteria references.
• Circulate user onboarding checklist and initial training completion summary.
• Present first-run metrics versus targets
• Agree a remediation plan with dates to bring discovery precision rate and column-level lineage coverage to the targets recorded in the POC Scope & Acceptance Criteria stage.
• Identify the top 3 technical causes for shortfalls and schedule fixes in the operational backlog.
• Confirm the exports and evidence artifacts required for the examiner-ready package and the delivery date for each.
• Implement prioritized connector or mapping fixes to improve discovery precision rate.
• Run a targeted re-crawl and lineage capture for the affected pipelines and publish results.
• Deliver the first evidence artifact pack for review prior to the Examiner Evidence Validation meeting.
• Restate acceptance criteria sources
• Deliver a complete examiner-ready evidence package that maps to the POC Scope & Acceptance Criteria artifacts and metrics.
• Confirm archive location and retention metadata for all evidence artifacts required for regulator review.
• Document the incumbent decommissioning status and next steps to prevent parallel usage.
• Publish the finalized examiner-ready evidence package to the agreed repository with retention metadata.
• Execute the agreed incumbent wind-down steps: archive or set read-only and record the retention decision.
• Document any remaining remediation items from evidence validation with target completion dates.
• Review open high-severity incidents
• Deployment and integration validation
• Present the examiner-ready evidence package
• Root cause analysis for metric gaps
• Persistent issues and systemic risks
• Archive integrity and sampling results
• Discuss mean time to resolve enforcement failures
• Verify metrics against evidence
• Regulatory change and retention obligations review
• Agree corrective actions and timelines
• Early adoption and usage signals
• Prioritize enhancement requests
• Backlog prioritization and resourcing
• Open issues and blockers
• Confirm evidence collection plan for final validation
• Plan for next-year evidence drills
• Archive and access plan for evidence
• Confirm communication plan for audit and incident notification
• Retention and evidence archive compliance check