
Reduce exposed access
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Document recurring costs and the person who controls each account.
Keep important software supported and test updates. Inventory dependencies so abandoned components are not silently left in production. Agree whether the evidence supports keeping, changing, or stopping the approach.
- A written brief
- Named responsibilities
- Agreed review points




