Start by splitting the portfolio into four buckets: clearly in scope now, in scope but covered by a transition rule, likely out of scope with rationale, and uncertain items needing legal review. This avoids wasting engineering time on assets that are archived or otherwise excluded while leaving real blockers unresolved.
Risk rank the in-scope items by user harm, revenue impact, procurement exposure, complaint likelihood, and the amount of design or vendor dependency involved. Self service terminals, payment flows, and customer account functions often move to the front of the queue.