Access Reviews: Find the Ex-Staff Account Before the Attacker Does

The account you need to find is often not the one that looks suspicious. It is the old account nobody remembers, the shared password that was never changed, or the browser session that remained open after a staff member left.

A 20-person organisation does not need a complicated identity-management programme to reduce this risk. It needs a named owner for each important system, a short access register, and a routine that connects staff changes to technical changes.

Start with the systems that matter

Make one list before reviewing individual users. Include the systems that can move money, expose personal information, publish in the organisation’s name, or stop daily work:

• email and the identity account used to reset other services;
• banking and mobile-money administration;
• accounting, payroll, or finance software;
• cloud storage and shared working files;
• social media pages and advertising accounts;
• donor, beneficiary, student, or customer records; and
• website hosting, domain registration, DNS, and developer tools.

The list is the organisation’s access boundary. If a service can reset another account, approve a payment, download a donor list, or change the public website, it belongs in the review. NIST’s account-management control treats account creation, modification, disabling, removal, review, and shared authenticators as connected management tasks, not separate housekeeping.

Build a register that can be checked in ten minutes

For each system, record:

• System and owner: the service, its business purpose, and the person accountable for the access decision.
• Current users: named accounts, role or permission level, and whether the user is staff, contractor, volunteer, or service provider.
• Last review: the date the owner last checked that access was still necessary.
• Security status: MFA enabled or not, plus any privileged or shared account.
• Recovery contact: an organisation-controlled email address or phone route, not only one employee’s personal contact.

Do not store passwords or recovery codes in an ordinary spreadsheet. The register should point to the controlled place where secrets are held, while recording enough information for an authorised reviewer to find the right owner and recovery route.

The Information Commissioner’s Office access-control guidance recommends reviewing and adjusting access when staff change role or leave, and keeping records that demonstrate the review. The same discipline is useful for an SME, NGO, or school even when no external auditor is asking for it.

Run the joiner, mover, leaver routine

When someone joins

Give the person a named account, approve access against their role, and enable MFA before they begin using sensitive systems. Give access to the shared folder, finance function, social page, or donor record they actually need; do not copy another person’s entire permission set without checking it.

When someone moves role

Compare the old role with the new one. Add what the new work requires, then remove what the old work no longer justifies. Check group memberships, administrator rights, shared drives, connected applications, and recovery contacts. The common mover failure is additive access: every new responsibility is added, but nothing is taken away.

When someone leaves

Use the departure notice to trigger a same-day access checklist. Disable or suspend the named account according to the provider’s procedure, then separately:

1. revoke active sessions and connected applications;
2. remove group memberships and administrator rights;
3. change shared passwords and shared-account authenticators;
4. revoke or replace API keys, access tokens, app passwords, and SSH keys;
5. transfer ownership of files, social pages, domains, and other work assets;
6. remove the person’s recovery email, phone number, and registered devices; and
7. record who completed the check and when.

Deleting an account is not the same as closing every route into the organisation. NIST specifically includes a process for changing shared authenticators when a person leaves a group. CISA also recommends reducing unnecessary accounts, using role-based access, and monitoring privileged access.

Make monthly review and quarterly sign-off routine

Once a month, the system owner should review the register and answer four questions:

1. Is every listed user still with the organisation or an approved provider?
2. Does each person still need the recorded role?
3. Are privileged accounts, shared credentials, and recovery contacts visible?
4. Is MFA enabled for the systems that support it, especially email, finance, hosting, and administration?

Once a quarter, the owner signs and dates the review. The sign-off is not a ceremony. It creates a small piece of evidence that the organisation knows who can access money, records, communications, and public channels. Keep the previous version so a role change can be explained rather than guessed.

CISA recommends MFA for business accounts because it adds a second verification step. In an access review, record whether MFA is enabled; do not treat the word “MFA” in a policy as proof that the setting is active.

Fix the single-administrator problem before it becomes an emergency

Small organisations often have one person who holds the hosting account, bank administration, social-page ownership, domain registration, cloud controls, and recovery phone. That arrangement may have grown from trust and speed. It still creates a continuity risk.

Plan the handover while the administrator is available:

• create a second named administrator where the service supports it;
• move recovery email and phone details to an organisation-controlled route;
• store recovery codes and emergency credentials in a controlled secret store;
• write down the provider, account owner, billing contact, and recovery steps; and
• test a two-person recovery route without sharing one personal password.

If one person currently has everything, do not remove their access first and hope the organisation can recover later. Add and test the second route, document the change, and only then reduce the single person’s control. For banking and mobile-money platforms, follow the provider’s approval and mandate process as well.

The review is small; the blind spot is not

Access review is not a general cyber-awareness campaign. It is a recurring operating control. It tells an owner which people, roles, secrets, sessions, tokens, and recovery paths can still reach the systems that hold money, customer information, donor records, and the organisation’s public voice.

Start with the eight-system list. Give each system an owner. Run the monthly check. Obtain the quarterly sign-off. When a person joins, moves, or leaves, update the technical access at the same time as the personnel record. That short routine is enough to find yesterday’s access before somebody else finds it first.