Answer for the company as it is today, not as it is planned. There are no wrong answers: “No” is as useful an answer as “Yes”.
01 · Inventory Do you have one list of your systems that says where each of them runs?Partly: the list exists, but it is out of date or does not cover everything.
Yes Partly No
02 · Inventory Do you know, for each system, which data it holds?Personal data, customer data, business-critical data. Partly: for the most important systems, not for all.
Yes Partly No
03 · Jurisdiction Can you say, for each supplier in the chain, which country’s law it falls under?Cloud provider, SaaS services and sub-processors. Partly: for the cloud provider, not for the rest.
Yes Partly No
04 · Jurisdiction Can you answer a customer’s supplier questionnaire on data location, access and jurisdiction without asking your provider first?Partly: most questions, but not those on access from countries outside the EU.
Yes Partly No
05 · Lock-in Is your infrastructure described as code, so an environment can be built from a repository?Terraform, OpenTofu or similar. Partly: some of it is code, the rest was clicked in a console.
Yes Partly No
06 · Lock-in Do the systems run on open building blocks that exist at several providers?Kubernetes, PostgreSQL, S3-compatible storage. Partly: the core does, but queues, identity or functions are the provider’s own.
Yes Partly No
07 · Cost Do you know what each system costs a month, and have you compared with another provider within the past year?Partly: you know the bill, but have not compared.
Yes Partly No
08 · AI Do you know which AI tools your developers use, and which models the source code is sent to?Partly: you know the tools the company pays for, not the private subscriptions.
Yes Partly No
09 · AI Do you have a written policy for which data may be sent to which models, and a log that shows it is followed?Partly: the policy exists, the log does not.
Yes Partly No
10 · Exit Do you have an exit plan for your most important system, and has it been tested within the past year?Partly: the plan is written, but has never been run.
Yes Partly No