
Reduce exposed access
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Keep essential access separate from an individual employee's login.
Keep important software supported and test updates. Inventory dependencies so abandoned components are not silently left in production. Turn the findings into a short list of actions and owners.
- A written brief
- Named responsibilities
- Agreed review points




