
Reduce exposed access
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Keep account ownership with the business.
Keep important software supported and test updates. Inventory dependencies so abandoned components are not silently left in production. End each review with a named next step.
- A written brief
- Named responsibilities
- Agreed review points




