Quick Introductions — Who’s Driving This Effort?

• Who is the primary sponsor or owner for this initiative? Options: Chief Data Officer (CDO), General Counsel (GC), Chief Technology Officer (CTO), Head of Compliance, CISO, Other
• Who else is at the table (names, titles, and role in decision-making)?
• What is the target decision timeline for selecting a platform? Options: Immediately / 30 days, 30–60 days, 60–90 days, 3–6 months, Undetermined
• What recent event or trigger brought this to the top of the agenda? Options: Regulatory exam finding, Failed internal audit, Data breach / incident, New regulation, Executive request, Other
• Briefly describe the regulator’s ask or the internal finding in one or two sentences.

Are We Still Relying on Fragile Inventories?

• When an examiner asks for a complete inventory of systems holding customer personal information, what do you typically have to produce—and what do you wish you had instead?
• How is your current inventory maintained today? Options: Spreadsheets / manual lists, CMDB, Point-tool inventories (ad hoc), Partially automated crawler, No single inventory
• When was the inventory last updated in a way you’d trust for an exam? Options: Within 7 days, Within 30 days, 1–3 months, 3–6 months, Longer / unknown
• What are the top three system types where you suspect coverage is weakest (e.g., analytics, third-party SaaS, archival storage)?
• Tell us about a specific time when inventory gaps caused a regulatory or operational problem — what happened and what was the impact?

What’s Broken About Lineage Right Now?

• If an auditor asked you to show column-level lineage for a customer personal data element, where would you expect to hit the biggest roadblock? Options: Unregistered pipelines, Code-based transformations (Python/Scala), Third-party SaaS exports, Event/streaming data, Lack of metadata (schemas)
• Which data platforms must we be able to trace across for the POC? Options: Oracle / DBMS, Snowflake, Databricks, Redshift, S3 / Blob Storage, Kafka / streaming, Third-party SaaS (Salesforce, Zendesk), Other
• How do you currently capture or represent transformations (ETL jobs, SQL, notebooks, data pipelines)? Options: Automated lineage in a tool, Manual documentation, Job-level logs only, No systematic capture, Other
• Typically, how long does it take your team to trace the flow of a single sensitive column from source to report? Options: < 1 day, 1–3 days, 1–2 weeks, Multiple weeks, Unknown
• Describe a recent investigation where missing lineage extended remediation work or triggered risk escalation.

Where Should Automation Immediately Reduce Risk?

• If you could have one manual task replaced by automation in the next 60 days, which would have the greatest regulatory impact? Options: Automated asset discovery, Column-level lineage mapping, Evidence packaging for deletion/retention, Policy enforcement across copies, Other
• Which data domain should be the POC focus to demonstrate maximum regulatory value? Options: Customer personal information (PII), Payment/account data, Loan origination, Claims data, Employee data, Other
• What percentage of your production systems must be discoverable in the POC for you to consider it meaningful? Options: 10–20%, 20–40%, 40–60%, 60–80%, 80–100%
• Which sensitivity / classification tags are essential for discovery to capture (select all that apply)? Options: PII/Personal Data, Financial Account, SSN/National ID, Payment Card Data, Health-related, Subject to retention law, Other
• What objections or cultural friction do you expect from teams about crawling production systems?

Can We Safely Crawl Production — What’s Non-Negotiable?

• What single operational requirement would make you immediately refuse a production crawl? Options: No read-only access granted, Any change to pipelines, Inability to pause/rollback, Lack of encryption in transit, Other
• Which access patterns are acceptable for connectors in your environment? Options: Read-only DB replicas, Audit/observer accounts, Service account with scoped permissions, Network jump host, Other
• Do you require a dry-run, throttling, or sampling approach before full crawls? Options: Dry-run first, Throttled crawling, Sampling only, Full crawl allowed immediately, Undecided
• What rollback or stop controls must be available before the CTO will sign off? Options: Immediate kill switch, Auto-throttle on latency spike, Connector-level pause, Detailed run logs, Other
• List the network/security owners and their preferred contact method and SLA for approvals.

What Will ‘Examiner-Ready Evidence’ Actually Look Like?

• If the GC were asked to present proof that deletion requests were honored across systems, what artifact would satisfy them? Options: Time-stamped deletion logs, End-to-end lineage with timestamps, Automated compliance report (PDF), Signed attestation with evidence bundle, Other
• Which elements must the evidence include for legal acceptance? Options: Immutable timestamps, System identifiers/asset IDs, User/process that executed action, Hashes or checksums, Chain-of-custody notes
• How granular does enforcement evidence need to be (system-level, table-level, column-level, instance-level)? Options: System-level, Table-level, Column-level, Instance/record-level
• What format and delivery cadence does the examiner expect for POC evidence? Options: One-time evidence bundle, Daily snapshots, Weekly report + artifacts, On-request export
• Share an example of evidence you’ve previously delivered (what worked, what fell short).

Who Signs Off on Success — Metrics and People?

• If you had to pick the three most important acceptance criteria for the 60-day POC, what would they be? Options: Catalog coverage (assets discovered), Column-level lineage depth, Verified enforcement actions, Non-disruptive integration, Examiner-ready evidence packaging
• For each selected criterion above, what is the numeric or qualitative target you’d accept?
• Who will provide the formal acceptance sign-off at the end of the POC? Options: CDO, GC, CTO, Head of Compliance, Cross-functional committee
• If a criterion is not met, what remediation or extension options are acceptable? Options: 30-day extension, Targeted re-run of specific connectors, Additional engineering support, No extension — deal off
• Describe your escalation path if the POC reveals a major compliance gap.

Integration Deal-Breakers — What Must Never Change?

• What integration requirement would cause the CTO to veto the platform immediately? Options: Requires pipeline refactor, Adds measurable latency to production flows, Requires privileged network changes, Agent installation on prod nodes, Other
• Which connector types are preferred and which are forbidden in your environment? Options: Preferred: read-only replicas, Preferred: API-based connectors, Forbidden: write-capable agents, Forbidden: root access
• What are your latency and performance thresholds we must respect during crawls? Options: No measurable impact allowed, <1% latency increase allowed, <5% latency increase allowed, Acceptable if off-peak only
• Which security controls must a vendor demonstrate before any production access is granted? Options: Pen test report, SOC2 / ISO certification, Network segmentation proof, Encryption key handling details, Other
• List any internal policies or compliance standards the integration must adhere to (e.g., data residency, encryption, logging).

Policy Enforcement — What Counts as Success?

• If policy enforcement is part of the POC, which automated actions are mandatory to demonstrate value? Options: Retention enforcement (deletion), Masking/pseudonymization, Access controls / entitlement changes, Alerting + workflow for remediation, Other
• How often must enforcement checks run to meet compliance expectations? Options: Real-time / streaming, Hourly, Daily, Weekly, On-demand only
• What level of human approval is required before automated deletion or masking can execute? Options: No manual approval, Automated with audit trail, Pre-approved by GC/Data Owner, Case-by-case approval
• What historical enforcement failures would you want the POC to detect or prevent?
• Which teams must be included in enforcement playbooks or runbooks created during the POC? Options: Data Engineering, Security / InfoSec, Legal / GC, Records / Archiving, Business Data Owners

What Would It Feel Like After a Successful POC?

• Imagine the regulator leaves satisfied — what two concrete outcomes would you point to that prove the problem is solved?
• What ongoing operational model do you prefer after the POC? Options: Vendor-managed service, Hybrid (vendor + internal ops), Fully internal operations, Undecided
• What training or handover will your teams need to sustain the capability? Options: Admin training, Technical integration workshops, Runbook + runbook drills, On-call vendor support
• How quickly would you want to expand beyond the POC domain if it succeeds? Options: Immediately (next 30 days), Within 2–3 months, Within 6 months, Longer / dependent on budget
• What risks or internal blockers could still derail adoption even after a successful POC?

Immediate Next Steps — Aligning People, Dates, and Deliverables

• If we don’t agree on immediate next steps right now, what usually slows projects like this most? Options: CTO/architecture hold, Legal/commercial negotiation, Lack of engineering time, Unclear success criteria, Budget approval
• Which deliverables would you like to see in a POC statement of work? Options: Asset inventory list, Lineage depth report, Enforcement evidence bundle, Security/impact assessment, Runbook and handoff plan
• What is the earliest feasible kickoff date for a scoped 60-day POC? Options: Within 2 weeks, 2–4 weeks, 1–2 months, Later / dependent on approvals
• Who are the named engineering and security contacts that must approve connector access (name, title, email)?
• Do you consent to an initial discovery crawl of the agreed POC scope under a read-only, non-disruptive contract clause? Options: Yes — consent, Maybe — need more information, No — not at this time

Starting Point: Why Are We Here Today?

• What prompted you to open this discussion about data governance right now? Options: Regulatory examiner finding, Internal audit, Board request, Major incident or data breach, Proactive modernization, Other
• Who is formally owning the evaluation and selection for this initiative? Options: Chief Data Officer, General Counsel, Chief Technology Officer, Head of Risk/Compliance, Other executive
• How urgent is a demonstrable fix—what timeline are you under to show progress to examiners or auditors? Options: Immediate (weeks), 60 days (POC window), 3 months, 6 months, No firm deadline
• When you picture success at the end of an initial engagement, what single outcome matters most to your execs? Options: Verified inventory of systems, Column-level lineage for a domain, Proof of policy enforcement/deletion, Readable examiner evidence, Other
• Who else on your team should we involve in discovery so we don’t miss key constraints (names/roles preferred)?

Are You Comfortable Being Surprised by Where Customer Data Lives?

• How confident are you today that you could, within two business days, produce a complete list of systems containing customer personal information? Options: Very confident, Somewhat confident, Not confident, No idea
• Tell us about a time a review or request revealed data in an unexpected place—what happened and how did it feel for the team?
• How often do you find previously unknown copies, exports, or analytics outputs containing customer records? Options: Weekly, Monthly, Quarterly, Rarely, Never tracked
• If an examiner asked for proof that a deletion request was honored across every downstream copy, how comfortable would you be with the evidence you could produce today? Options: Completely comfortable, Partially comfortable, Uncomfortable, Can't produce evidence
• Which of these emotions best describes how the data team reacts when an unknown system is discovered? Options: Frustration, Urgency to fix, Embarrassment, Calm, expected, Confusion

Where Does Data Disappear (or Multiply) in Your Estate?

• Which platforms and pipeline types currently host or process customer personal information in your environment? Options: Relational DBs (Oracle, SQL Server, Postgres), Cloud warehouses (Snowflake, Redshift, BigQuery), Data lakes (S3/ADLS), Streaming systems (Kafka, Kinesis), Analytics platforms (Tableau, Looker), SaaS apps (CRM, marketing platforms), Custom ETL/Code pipelines
• Are there known dark spots (e.g., undocumented reports, ad-hoc exports, contractor environments) where visibility is limited? Options: Yes—many, Yes—some, A few, but we track them, No
• Describe an example of a pipeline or process that routinely creates downstream copies—what tools, teams, and handoffs are involved?
• Who currently holds operational responsibility for tracing lineage when an issue arises (role/team)? Options: Data Engineering, Platform/Infrastructure, Data Governance/Stewardship, Security/Privacy, No clear owner
• Which of the following best describes your current method for tracking where customer PII lives? Options: Spreadsheets/manual inventory, Partial automated discovery, Enterprise catalog (limited scope), No formal method

What Would Passing an Examiner Actually Feel Like?

• If an examiner demanded evidence, which artifacts would convince you that the answer is rock-solid? Options: Column-level lineage diagrams, Time-stamped audit logs of enforcement, Automated scan reports with screenshots, Reproducible queries that validate inventory, Signed attestation from data owners
• What minimum catalog coverage percentage (by systems, tables, or lineage hops) would you need to accept a POC as successful? Options: >90%, 75–90%, 50–75%, <50% or unsure
• How deep does lineage need to go for you to feel comfortable—surface-level system mapping, table-level, or column-to-column with transformation detail? Options: System and table-level, Column-level with basic transformations, Column-to-column with full code details, Depends on domain
• Which enforcement outcomes would you need demonstrated during the POC to present to GC and the examiner? Options: Automated deletion across copies, Masking in analytics, Retention enforcement with proof, Policy violations flagged for remediation
• Who must sign off on the POC acceptance—list names/roles and their top concern (e.g., GC: evidentiary sufficiency)?

If We Run a 60‑Day Proof, What’s Non‑Negotiable?

• What CTO or platform constraints would immediately disqualify a vendor or POC approach? Options: Requires pipeline refactor, Adds measurable latency to production, Requires privileged DB access we won't grant, Installs persistent agents, Other
• Which type of production access can you realistically grant for a controlled POC (read-only credentials, service account, metadata-only, other)? Options: Read-only DB credentials, Service account with scoped permissions, Metadata/connector access only, No production access allowed
• What windows or maintenance schedules must we work around to run crawlers or scans without impacting teams?
• If we request a temporary connector or role for 60 days, what security checks or approvals will that require (list stakeholders)?
• What rollback or emergency controls do you require to feel safe authorizing crawling against production systems? Options: Kill-switch for connectors, Read-only enforcement guarantee, Monitoring and alerting to ops, Pre-approved runbook for issues, Other

Where Does Enforcement Need to Happen Without Drama?

• Which enforcement actions matter most to your compliance team during a POC—deletion, masking, quarantine, or policy flagging? Options: Automated deletion, Masking/anonymization, Quarantine or freeze, Policy violation alerts only, Other
• Have you had situations where enforcement in one system caused problems downstream (e.g., stopped reporting or broke dashboards)? Tell us about one.
• How do you expect a governance platform to coordinate enforcement across heterogeneous systems—fully automated, human-in-the-loop, or hybrid? Options: Fully automated, Human-in-the-loop, Hybrid
• What SLAs or time-to-action would be required for an automated enforcement (e.g., delete propagated within 24 hours)? Options: Immediate (minutes), Within hours, Within 24 hours, Within days, Unsure
• What evidence of enforcement will satisfy auditors—time-stamped logs, replayable actions, signed attestations, or other artifacts? Options: Time-stamped audit logs, Replayable action scripts, Screenshots/reports, Signed attestation from data owner, Other

What Will Integration Actually Look Like for Your Teams?

• Who will own day-to-day POC operations on your side (names/roles) and who will be the escalation contact?
• What internal teams must be engaged for connectors, network approvals, or security reviews? Options: Data Engineering, Platform/Infra, Security/InfoSec, Legal/Privacy, Business/Data Owners, Third-party vendors
• What monitoring and reporting do your engineers want during the POC to feel in control (latency metrics, error rates, resource usage)?
• If integration required a short runbook or playbook, what three items must be included for your ops team to allow it?
• Which teams should receive automated alerts versus which should get summary reports? Options: On-call/platform ops (alerts), Data engineering (alerts + reports), Data governance/stewards (reports), Execs (summary only), Legal/Privacy (reports)

Deciding Risks, Rewards, and Red Lines

• What contractual or legal constraints would make you decline a POC even if the technology validated every claim (data residency, audit rights, liability caps)?
• What minimum privacy and security controls must a vendor demonstrate before legal allows access to production metadata or systems? Options: SOC2/ISO certification, Encryption-in-transit and at-rest, Third-party pentest report, Scoped access with short-lived creds, Other
• How will GC evaluate the sufficiency of examiner-ready evidence—what format and sign-offs are required? Options: Formal report + logs, Signed attestation + supporting logs, Replayable evidence bundle, Other
• Are there any internal procurement or contract clauses (e.g., indemnities, IP, data handling) that are absolute non-starters?
• If a technical approach required a minor contract amendment to enable production connectivity, how long would legal typically take to review? Options: <1 week, 1–2 weeks, 3–4 weeks, Longer

What Would Make You Say Yes—Right Now?

• If we could guarantee non-disruptive discovery, column-level lineage for one high-risk domain, and examiner-ready artifacts in 60 days, what remaining concern would still stop you from greenlighting the POC?
• What practical first step would you be willing to commit to this quarter (e.g., sign off on scope, provide read-only creds to two systems, schedule an integration call)? Options: Approve POC scope, Provide credentials to 1–2 systems, Schedule technical kickoff, Legal starts review, Unsure
• Who are the decision-makers and what is the decision process/timeline for moving from POC to enterprise license?
• What would you like us to prepare next—a focused scope doc, security questionnaire responses, or a technical integration checklist? Options: Scope doc for domain, Security & compliance pack, Connector integration checklist, Detailed POC timeline & milestones
• On a scale of 1–10, how ready do you feel to begin a limited production POC after we've addressed the items above? Options: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10

Quick Win: Who's Already Caring About This?

• Who will be the core team evaluating and signing off on this POC? (pick all that apply) Options: Chief Data Officer (CDO), General Counsel (GC)/Privacy, Chief Technology Officer (CTO), Head of Data Engineering, Security/InfoSec, Business Unit Owner, Compliance Officer, Other
• Who is the single point of accountability for moving the POC forward? Options: CDO, GC/Privacy, CTO, Head of Data Engineering, Compliance Officer, Other
• What is the regulatory/exam timeline we are trying to meet? (choose the range closest to your deadline) Options: Urgent: <30 days, Short: 30–60 days, Medium: 61–120 days, Long: >120 days, No fixed deadline
• Which single outcome would make you feel this POC was a clear success at day 60? Options: Complete inventory of systems holding customer PII, Column-level lineage for a high-risk domain, Automated enforcement evidence for retention/deletion, Repeatable deployment pattern for production connectors, Other
• If you could summarize one worry you hope this POC will remove, what would you say?

If an Examiner Called Right Now, What Would You Do?

• If an examiner demanded a full inventory of every system holding customer personal data today, what would your first reaction be?
• How are inventories and system registries created at your institution today? Options: Manually maintained spreadsheets, Internal tooling/catalog, Ad hoc team knowledge, Partially automated discovery, Third-party vendor list, Other
• What confidence level would you give your current inventory if inspected by an examiner? (estimate) Options: Very high (90–100%), High (75–89%), Moderate (50–74%), Low (25–49%), Very low (<25%)
• What specific blockers prevent you from being able to answer the examiner within the requested timeframe? (select all that apply) Options: Lack of automated discovery, No column-level lineage, Disconnected ownership across teams, Incomplete access to production systems, Lack of documented retention/deletion evidence, Legal/privacy concerns, Other
• When you think about the last time you failed to meet an information request, what emotion best describes the leadership reaction? Options: Urgent alarm/panic, Frustration and blame, Pragmatic problem-solving, Minimization/deny risk, Embarrassment/pressure

Where Your Customer Data Is Actually Living (and Hiding)

• Which data platforms and locations do you expect to contain customer PII for the POC? (select all that apply) Options: On-prem relational DBs (Oracle, SQL Server), Cloud warehouses (Snowflake, Redshift, BigQuery), Data lakes (S3/ADLS) and lakehouses, NoSQL stores (Cassandra, MongoDB), ETL/ELT pipelines (Airflow, dbt, Spark), BI/analytics tools (Looker, Tableau), Message/event systems (Kafka), Other
• Roughly how many distinct ingestion/transformation pipelines move customer data between systems in scope? Options: <10, 10–25, 26–50, 51–100, >100, Don't know
• Which copies of data (backups, snapshots, downstream marts) are you most worried examiners will ask about? Options: Production backups/snapshots, Analytic copies/marts, Archived storage (tapes, cold storage), Third-party processors/partners, Shadow systems/spreadsheets, Don't know
• How do you currently trace data at the column level through transformations and joins? Options: Manual mapping by engineers, Partially automated lineage, No column-level lineage available, Vendor tooling, We rely on sample queries/reports
• Please list any high-risk data domains or example tables/fields we should prioritize for discovery in the POC (e.g., customer identifiers, SSNs, account numbers).

The Moments That Break Trust — Tell Us a Story

• Describe a specific incident where a data request, deletion, or policy enforcement failed — what happened?
• How often do incidents like that occur (estimate)? Options: Multiple times/month, Monthly, Quarterly, Yearly, Rarely
• Which impacts from that incident mattered most? (select all that apply) Options: Regulatory fines/penalties, Operational downtime, Executive escalations, Customer harm/reputational risk, Remediation engineering cost, Legal exposure
• Who typically owns investigation and remediation when these issues appear? Options: Data engineering, Security/InfoSec, Legal/Privacy, Compliance, Business unit, Cross-functional task force
• How long did it take (or would it take) to produce examiner-ready evidence about that incident? Options: Hours, Days, Weeks, Months, Unable to produce

Why You've Stayed With Manual Processes (Even If You Hate Them)

• What's the real reason a spreadsheet or tribal-knowledge approach has persisted here?
• Which of these barriers best describe why automation hasn't scaled for you? (select all that apply) Options: Engineering bandwidth and priorities, CTO's integration concerns, Fear of disrupting pipelines, Data classification uncertainty, Lack of trust in vendor accuracy, Legal/privacy approval delays, Other
• Have you trialed automated discovery or lineage tools before? If yes, what went wrong or what surprised you? Options: No prior trials, Yes — missed assets, Yes — produced inaccurate lineage, Yes — integration caused latency, Yes — stakeholder buy-in failed, Other
• What technical assurances or guardrails would meaningfully reduce CTO resistance to connecting production systems? Options: Read-only connectors, Non-disruptive crawl windows, Limited-scope discovery first, Proof of zero added latency, Detailed rollback plan, Security architecture review
• If you were to adopt automation, what internal change would be hardest for your teams? Options: Shifting ownership from spreadsheets, Trusting automated lineage, Maintaining connectors, Interpreting enforcement evidence, Changing incident response playbooks, Other

If This POC Is Perfect at Day 60, What Will Be on the Table?

• List the top 3 pieces of examiner-ready evidence you must be able to produce at the end of the POC. Options: Complete asset inventory report, Column-level lineage diagrams for scoped domain, Time-stamped enforcement action logs (deletions/masking), Access and connector logs, Policy rule definitions and exceptions, Other
• What minimum catalog coverage would you accept for the scoped domain by day 60? Options: >90%, 75–90%, 50–74%, <50%, Coverage not the primary metric
• For lineage, what level of detail is required to satisfy examiners and legal? (choose one) Options: Column-level end-to-end with code links, Column-level to table-level mapping, Field-level to dataset-level, Process-level lineage only, Unsure — need guidance
• Which enforcement actions must be demonstrable during the POC to convince GC? (select all that apply) Options: Automated deletion with tamper-evident logs, Masking/redaction with audit trail, Retention policy evaluation and flagging, Reconciliation of deletion across downstream copies, Manual remediation playbook with evidence
• Which single high-risk domain should we run first in the POC to prove value (e.g., customer PII, loan accounts, payments)? Options: Customer PII (names, SSNs), Account and transaction data, Loan and underwriting data, Claims and policyholder data, Third-party/shared data, Other
• If you selected a percentage or metric above, please explain why that threshold is meaningful to your regulator or leadership.

Operational Safety: What Keeps Engineering Up at Night?

• What is the single production safety concern engineering will raise to delay the crawl?
• Which access and authentication patterns will we need to support for connectors? (select all that apply) Options: IAM roles/service accounts, Database read-only users, VPC peering/private endpoints, SAML/SSO-backed access, Key-based access to object storage, Other
• Do you require connector designs that are guaranteed non-disruptive or sandboxed? If so, which option best describes your requirement. Options: Read-only non-intrusive connectors required, Sandboxed copy of data acceptable, Limited rate-limited crawls OK, No special requirement
• Who must approve production access and what is the typical approval lead time? Options: CTO/Platform team (days), Security/InfoSec (days), Data Engineering (hours–days), Legal/Privacy (days–weeks), Cross-functional committee (weeks)
• What rollback or mitigation controls would make the team comfortable if something looked wrong during discovery? Options: Immediate stop/cancel crawl, Scoped discovery only (sample data), Pre-approved snapshot windows, Automated rate-limiting and retries, Full audit and rollback plan documented

Decisions, Communication, and What ‘Good’ Governance Looks Like

• What would make you feel this POC is a partnership, not just a vendor trial?
• Which stakeholders need to be included in weekly POC updates? (select all that should be present) Options: CDO/POC Sponsor, GC/Privacy Rep, CTO/Platform Lead, Data Engineering Lead, Security/InfoSec, Compliance Officer, Business Unit Owner, Other
• What cadence and format do you prefer for status—standups, weekly demos, or asynchronous reports? Options: Daily standup, Twice-weekly sync, Weekly demo & report, Biweekly summary, Asynchronous written reports only
• After a successful POC, what immediate decision will leadership need to make? Options: Proceed to enterprise license, Expand domain-by-domain for 6 months, Pilot a second domain, Pause for security/legal review, Undecided
• What contractual/commercial or legal conditions absolutely must be in place before you can start connectors into production? Options: Standard SaaS contract, Data processing agreement (DPA), Security questionnaire passed, Limited liability/indemnity clauses, Specific SLAs/uptime guarantees, Other
• Realistically, when could your team be ready to start the first non-disruptive crawl if approvals align? Options: Immediately (within 1 week), 2–4 weeks, 1–2 months, More than 2 months, Unknown

Quick Introductions — Who's In The Room?

• Who are the people we should loop into the POC conversation (name, role, and primary decision authority)?
• What's the single business event that kicked off this evaluation (regulatory finding, audit, merger, other)? Options: Regulatory examination finding, Internal audit gap, Merger / acquisition, Project to modernize governance, Other
• Which executive sponsors will sign off on the POC outcome (select all that apply)? Options: Chief Data Officer (CDO), General Counsel (GC), Chief Technology Officer (CTO), Head of Privacy, Head of Security, Business Unit Leader, Other
• What is your ideal target date to start the 60-day POC? Options: Immediately (within 2 weeks), In 2–4 weeks, In 1–2 months, Later than 2 months, Unsure
• Do you currently have an existing data inventory or catalog that we should import or compare against? Options: Yes — actively maintained catalog, Yes — a static spreadsheet, Partial / fragmented inventories, No formal inventory exists, Unsure

If an Examiner Called Right Now, Would You Panic?

• If an examiner demanded a complete list of systems processing customer personal information with proof within 48 hours, could you comply? Options: Yes — confidently, Partially — some systems only, No — would need weeks or months, Unsure
• Which systems would you be able to produce immediately (select all that you can provide today)? Options: Core banking databases, Customer relationship management (CRM), Data warehouse / lake, Analytics platforms (BI tools), Cloud object storage (S3/GCS), Third-party processors, Other
• Estimate how complete your current inventory feels as a percentage of systems that actually touch customer personal data. Options: 0–20%, 21–50%, 51–75%, 76–90%, 91–100%, Don't know
• When was your authoritative inventory or catalog last updated? Options: Within last week, Within last month, Within last quarter, Longer than 6 months, Never formally updated
• If you selected Partial or No above, what’s the main barrier to being able to produce a full inventory quickly? Options: Lack of automated discovery, Siloed teams, Security/access restrictions, Manual processes are too slow, Unclear ownership, Other

Where Does Customer Data Hide That Nobody Talks About?

• Which systems do you suspect hold customer personal information but are not in any official inventory? Options: Ad-hoc analytics clusters, Legacy departmental databases, Shared file shares, Backups and archives, Third-party SaaS exports, Shadow cloud buckets, Unknown/Other
• Tell us about the most surprising place you found customer data—how was it discovered and how long has it been there?
• How frequently do new 'shadow' systems or ad-hoc pipelines appear without central registration? Options: Daily, Weekly, Monthly, Quarterly, Rarely
• When a new system is found, what usually happens next? Options: Added to central catalog, Left undocumented, Handled by local team, Escalated to governance, Other
• Who typically discovers these hidden systems (analytics team, devops, auditors, vendor, other)? Options: Analytics / data scientists, Data engineering, IT / DevOps, Internal audit / compliance, External auditor / examiner, Other

Which Pipelines Break the Chain of Evidence?

• Which transformation types most often prevent you from showing clear column-level lineage end-to-end? Options: Ad-hoc Python/Scala jobs, Spark/Databricks jobs, SQL-based ETL (stored procedures), dbt transformations, Real-time streaming (Kafka)
• For those pipeline types, where is lineage most often lost (at extraction, transformation, enrichment, or aggregation)? Options: Extraction (source mapping), Transformation (field-level changes), Enrichment (third-party joins), Aggregation/rollups, I/O to downstream stores, Unsure
• Give an example of a report or dashboard that you cannot trace back to source columns—what system produced it and why is tracing difficult?
• How many distinct ETL/processing jobs do you estimate touch customer PII weekly? Options: 0–10, 11–50, 51–200, 201–500, 500+
• When lineage gaps are found, how are they currently investigated and how long does a typical investigation take? Options: Automated logs, Manual developer interviews, Code reviews, Ad-hoc query tracing, We rarely investigate

When Retention or Deletion Is Required, What Actually Happens?

• Have you ever been unable to prove that a deletion or retention policy was enforced across downstream copies (backups, analytics, exports)? Options: Yes — known gaps, Partial — some systems proven, No — we can prove it, Unsure
• Which downstream copies are the hardest to control or attest to (select all that apply)? Options: Backups / snapshots, Data lake analytics, BI/visualization layer, Third-party processors, Local developer copies, Other
• Walk me through the last time a retention or deletion request required cross-system confirmation—what went well and what broke?
• How do you currently record and timestamp enforcement actions (deletions, masks, retention purges)? Options: Automated logs with audit trail, Manual change tickets, No consistent tracking, Ad-hoc emails and attachments, Other
• What kind of examiner-ready evidence would satisfy you that a deletion request was enforced end-to-end? Options: Immutable logs with timestamps, Before/after snapshots, Automated attestations tied to IDs, Signed legal attestations, Other

What Would Passing the Examiner Actually Feel Like?

• What concrete evidence would make the CDO and GC comfortable that an examiner's request is satisfied? Options: Full asset catalog with timestamps, Column-level lineage diagrams to sources, Automated enforcement logs for deletions/masking, Exportable examiner report package, Signed attestation from responsible owners, Other
• Of the evidence types above, which three are highest priority for your examiners or legal team? Options: Catalog completeness, Column-level lineage, Enforcement logs, Snapshots/audit trail, Signed attestations, Other
• What acceptance thresholds would you set for a successful 60-day POC (catalog coverage percentage, lineage depth in hops, number of enforcement actions validated)?
• Who will validate and sign off the POC acceptance criteria from the business, legal, and engineering perspectives (roles only)?
• If we delivered an examiner-ready evidence bundle at the end of the POC, how would you like it packaged for review? Options: Searchable web report, PDF export per asset, CSV logs and snapshots, Combined legal attestation package, Other

What Would the CTO Need to See to Say Yes?

• What's the single integration or performance requirement that would cause the CTO to veto the POC? Options: Any added latency is unacceptable, No changes to production pipelines, Read-only access only, No data movement offsite, Requires in-VPC deployment, Other
• Which of the following access patterns are acceptable for your security team? Options: Read-only JDBC/ODBC connectors, Agent-based crawlers inside VPC, API-based metadata collection, Snapshot exports to secure bucket, No external network egress
• Do you have pre-approved deployment patterns (e.g., VPC peering, private link, on-prem appliance) we should follow? Options: Yes — VPC peering/private link, Yes — on-prem appliance allowed, No — need to review with infra/security, Unsure
• What performance SLAs matter—maximum added latency, acceptable crawl windows, and maintenance blackout windows?
• Who in engineering must sign off on connector types and schedule (roles and contact cadence)?

Ready to Run a 60-Day Proof That Actually Proves Something?

• If we scoped a focused POC today, what would be the single biggest risk to completing it within 60 days? Options: Legal/compliance approval delay, Lack of production access, Insufficient engineering support, Integration complexity, Data sensitivity concerns, Other
• Which approvals or contracts must be completed before we begin (select all that apply)? Options: Security review, Legal contract, Data processing agreement, Network access request, Change advisory board (CAB) approval, Other
• What is the earliest realistic start date given current approval timelines? Options: This week, In 2 weeks, In 4–6 weeks, More than 6 weeks, Unknown
• What would you define as a minimally scoped success for the POC—what domain, how many systems, and what evidence must be produced?
• Who will be the day-to-day POC owners on your side (roles for access coordination, engineering coordination, and legal/compliance)?

Small But Critical Details — Constraints, Exceptions, and Non-Starters

• Are there any explicit 'no-go' systems or data types we must never touch during the POC? Options: Customer accounts, Cardholder data (PCI), Health data (PHI), Encrypted vaults, None / no restrictions, Other
• Do you require data to remain strictly in-region or on-premises for regulatory reasons? Options: Yes — on-premises only, Yes — in-country only, No — cloud acceptable, Depends on dataset, Unsure
• What rollback controls or non-disruption guarantees would make your team comfortable (snapshot restores, read-only proofing modes, audit-only scans)? Options: Read-only scans, Audit-only sandbox, Snapshot-based rollback, Staged test runs, Other
• If we encounter a critical issue during crawling, who must be notified and what is the escalation path?
• What is an acceptable cadence for status updates during the POC (daily standups, weekly review, on-demand escalation)? Options: Daily standup, Twice-weekly check-in, Weekly review, Ad-hoc on-demand, Other

Closing the Loop — Real Commitments and Next Steps

• Which of the following would you like from us to make approval easiest (pre-signed connector spec, security whitepaper, sample evidence bundle, references)? Options: Connector technical spec, Security and SOC documentation, Sample examiner evidence bundle, Customer references in banking, Proof-of-concept runbook, Other
• Who will own scheduling and coordination for the POC kickoff from your side (name and role)?
• Before we wrap, what's the single metric or artifact that will make the CDO declare this POC a success?
• Would you like us to draft a scoped POC statement of work based on your answers here and propose a kickoff within two business days? Options: Yes — please draft SOW, Yes — but with an internal review first, Not yet — need more internal alignment, No
• Any other concerns, recent incidents, or institutional histories we should know about that could affect how we run the POC?