
Reduce exposed access
Review accounts, permissions, authentication, unused software, and public interfaces. Remove access that no longer serves a business need. Agree what the team receives if the supplier relationship ends.
Keep important software supported and test updates. Inventory dependencies so abandoned components are not silently left in production. Keep the next round of work small enough to assess clearly.
- A written brief
- Named responsibilities
- Agreed review points




