Start the year by removing access
January is the easiest month to clean up accounts: people who left, contractors who finished, apps nobody uses.
Every audit I do finds the same thing: accounts that should have been closed months ago. A contractor from a 2024 project. A former employee’s mailbox that still forwards somewhere. An app connected to Google Workspace by someone who left.
January is quiet, and last year is fresh in everyone’s memory. Use it.
- Export the user list from your email platform, your VPN and your main SaaS tools.
- Send each manager the list of their people and ask one question: who shouldn’t be here?
- Check admin roles separately. There are usually more admins than anyone thinks.
- Review third-party apps with access to mail and files, and remove the ones nobody recognises.
- Disable first, delete a month later. It’s easier to undo.
It takes a day or two for a small company. It closes doors that attackers look for first.