Priority 1
An identified executive sponsor
A decision-maker on the board or executive team, able to arbitrate on scope and budget.
Why: Without one, scoping workshops go in circles and nothing gets decided between meetings.
Before the engagement
Get ready
The elements to gather in advance. The goal is to cut several weeks off the time to the first concrete result.
01Sponsor
02Documentation
03System access
04Secure channel
05Diagnostic
06Decision-makers
Priority 2
Existing documentation gathered
Mapping, diagrams, vendor contracts, application inventory — even partial or outdated.
Why: It avoids starting from zero on what's already known, saving several days from the first workshop.
Priority 3
Read access to key systems
Restricted access to the tools, repositories and dashboards needed for the audit or diagnostic.
Why: The analysis is based on facts, not claims — access determines the quality of the diagnostic.
Priority 4
A secure exchange channel
Proton Mail & Drive for sensitive documents, rather than plain email or unencrypted sharing.
Why: Security and data sovereignty from the preparatory phase, GDPR compliance from day one.
Priority 5
A diagnostic or scoping already started
The site's maturity diagnostic or scoping questionnaire, filled in beforehand.
Why: The first conversation starts on substance rather than discovery questions.
Priority 6
Decision-makers identified for the workshops
CIO, CISO, relevant business leads — who needs to be in the room, and for which decisions.
Why: A workshop without the right people produces meeting notes, not decisions.
Confidentiality from the first exchange
An encrypted channel for sensitive documents
Mapping, contracts, system access: these documents should never travel over unencrypted email. Proton Mail and Proton Drive cover nearly every exchange needed during a scoping engagement — no additional tooling required to get started.
Prerequisites in place?
Let's move on to scoping the need and the first workshop.