Seven kinds of data, four classes of tool, and one simple question: where can each kind of data go without creating unnecessary exposure?
It does not score your organisation and it does not pick a vendor. It makes visible the places where data moves without a written rule, so the conversation is about a rule rather than a tool.