Define the scope before collecting
Specify the applications, sites and teams covered by the review. A shared scope avoids mixing a complete inventory of the organisation with the information that is useful for this audit.
Check the information and who owns it
For each application in scope, identify the information to confirm with the team: use, hosting, exchanges and contacts. The fields you keep must serve the documentation need and remain maintainable.
Make dependencies readable
Prepare views suited to the expected questions: application exchanges, links to infrastructure and interactions with third parties. Base the discussions on the relationships actually recorded.
Keep verifying
A map makes preparation and dialogue easier. On its own, it is not proof of compliance and does not replace the controls, analyses and supporting evidence expected in your approach.
Prepare the review with Carto Sentinel
The 22 Sentinel rules query the map data and make their findings explainable. The Qualité module helps spot missing information. The pre-filled GDPR register must be completed and validated with the people concerned.