
Reduce exposed access
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Keep account ownership with the business.
Keep important software supported and test updates. Inventory dependencies so abandoned components are not silently left in production. Leave the team with a decision, an owner, and a review date.
- A written brief
- Named responsibilities
- Agreed review points




