If you deploy
If you deploy it
Report at group level and hold that line. It is the single decision that determines whether the deployment is tolerable.
The Narrowest Thing That Answers the Question
If you are deploying, the configuration decisions that matter. Most defaults collect far more than any purpose requires.
Aggregate Only, and How to Hold That Line
The commitment that makes everything else workable, and the specific requests that erode it.
Retention and Deletion
How long to keep what, which for this category should be far shorter than the defaults, and why.
Who Can See What
Access to the data determines what the programme actually is, regardless of what the policy says it is.
Reviewing Whether It Did Anything
The review that almost never happens, what it should examine, and why the answer is frequently no.
Turning It Off
Ending a deployment properly, which is more than cancelling the licence, and recovering what it cost.