Understand the decision

Choose the accounts that publish content, manage enquiries or hold sensitive business documents. Export or inspect their authorised users using available service controls. For each person, ask who they are, what task they perform and whether the level of access still matches that task. A familiar name is not sufficient justification. Former contractors, duplicate accounts and temporary campaign users deserve the same review as new joiners.

A practical workflow

Classify each access entry as retain, reduce, remove or investigate. Confirm unclear cases with the responsible owner before making changes that could interrupt legitimate work. Record the decision and completion date without storing credentials. Test that the remaining team can still perform essential tasks. When a recurring access problem appears, fix the handover process that created it. The review should end with accountable actions, not a spreadsheet that lists the same unresolved permissions every quarter.

Imagine this

Hypothetical example

A company finds an event agency still has editing access to a profile months after its campaign ended. The owner confirms the work is complete, removes access and updates the contractor offboarding checklist. Current staff test their normal publishing tasks to confirm the change caused no disruption.

Make it practical.

Use this checklist as you read. Checks are not stored.

References & further reading

Further reading: CISA: Secure Our World ↗

Published by Tap Tap Go. Product availability and eligibility vary by programme and market. About our stories.