Where: /app/estate, then /workspace/system/<id> for any system you open

Sample on a risk basis rather than taking the first rows. Deliberately include:

• a supplier-operated system (someone else runs it; the obligations are still the customer's),
• a retired or decommissioned system (its records must survive its retirement),
• every system classified high-risk — the estate is small enough to take all of them.

What each register entry must carry

An owner, a lifecycle state, a risk classification, and enough identity to be traced onward to a risk assessment, a control and evidence.

The question the product cannot answer for you

What would tell you a system is missing from this register? The platform records what the organisation has told it about. Completeness of the register remains an organisational assertion and is verifiable only outside the tool. Treat it as such.