Map the information flow
Inventory data sources, permissions, retention and external transfers. Identify sensitive information before connecting tools.
Priority focus
Good data. Clear control.
Before a pilot, establish what information is used, where it goes, who can access it and how errors or incidents will be handled.
Set access and operating controls
Specify authorised users, approved tools, logging, review and incident ownership. Confirm supplier handling and deletion terms.
Prove the fallback works
Test incorrect outputs, unavailable services and revoked access. Document how the team pauses the system and restores service.