Find the weakest link before someone exploits it.

Check whether their accounts, sessions, shared links, and connected app access were removed when the work ended.

Map what that role can reach, including users, permissions, email, and recovery settings.

Identify a second authorized person and verify the recovery process before you need it.

Individual accounts give you a way to trace actions and remove one person’s access.

Review the exceptions and what those accounts can reach. An exception on a privileged account deserves particular attention.

Check how the system handles active sessions, app tokens, and recovery methods.

Compare each privilege with the work it supports and agree who reviews it as that work changes.

Inventory remote access, unused portals, and legacy integrations, then verify which still need to be reachable.

Check who can use old sharing links, what they expose, and whether access expires.

Compare the app’s actual permissions with the records and actions its job requires.

Look for copies in email, shared drives, downloads, and vendor systems. Those copies can have different access controls.

Identify who owns the records and check whether there’s a business or retention reason to keep them.

Test the boundary with an ordinary account and check whether it can reach records outside its assigned work.

A record of what each vendor receives helps you identify affected systems and customers faster.

Check whether bulk exports are logged, whether they trigger an alert, and who reviews it.

Assign someone to preserve evidence and coordinate with the people responsible for the investigation, customer communications, and response.

Verify payment changes through a trusted number or another established channel before updating the record.

Review forwarding rules, delegates, and mailbox audit activity.

Give staff a known verification channel and a clear way to report unexpected requests.

Separate the ability to change payment details from the authority to approve the transfer.

Use a consistent way to send invoices and give customers a known way to verify unexpected requests.

Give them one clear reporting route and tell them what information to preserve.

Verify identity separately before sharing records or changing instructions.

Decide who verifies the report, who can speak for the business, and which contact channel customers can trust.

Test a restore of a critical system or dataset and record how long it took and what was missing.

Check whether backups have separate access and protection against deletion.

Decide which work needs to recover first so your team and IT provider can prioritize it.

Compare what the business can tolerate with the age of the last backup you can actually restore.

Keep an approved contact list and alternate communication channel that work outside the affected system.

Name the person or provider with authority, how to reach them, and who covers when they’re unavailable.

Agree in advance who checks access, data integrity, and normal operation before staff rely on it again.

Prioritize by what can be reached, how the business would be affected, and whether the proposed fix can be verified.

Test with two synthetic customer accounts and verify that the underlying system denies the cross-account request.

Treat retrieved documents as untrusted and test whether instructions hidden in them can trigger an action.

Separate drafting from execution and enforce approval in the system that makes the change.

Review what those credentials can read or change and limit each connection to what its job requires.

Identify approved tools and what information staff can share, and check the settings that govern retention and access.

Keep a record of the request, approval, and confirmed result so someone can reconstruct the event.

Give an authorized owner a way to disable that action and verify that routine work still runs.

Rerun a short set of tests for allowed and denied actions after material changes.