
Reduce exposed access
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Check who owns the final assets and source files.
Keep important software supported and test updates. Inventory dependencies so abandoned components are not silently left in production. End each review with a named next step.
- A written brief
- Named responsibilities
- Agreed review points




