Quarterly Access Recertification and Offboarding Sweep (Retention)

Quarterly Access Recertification and Offboarding Sweep (Retention)

1. 01

   Freeze the identity roster on day one of the review window

   Export every human account, service account, API key, and OAuth grant from the directory and any standalone vault. Treat the export timestamp as the audit artifact so a client compliance reviewer can replay the review.

2. 02

   Reconcile the roster against the agency's active client and staff list

   Flag any identity with no matching open engagement, departed contractor, or expired retainer. Orphaned accounts are the most common finding in agency environments where freelancers cycle every few months.

3. 03

   Pull last-login and last-credential-use data for every identity

   Anything dormant beyond 90 days goes on the removal list unless the client contract names it as a standing integration. Document the exception rather than silently keeping it.

4. 04

   Re-verify privilege level against the current role, not the role at provisioning

   A delivery lead who moved to a different account should not retain admin on the old client's workspace. Downgrade first, delete second, so you keep an audit trail of the change.

5. 05

   Rotate shared secrets and confirm no credential is stored outside the vault

   Search chat history, shared docs, and repo config files for plaintext keys. Rotate anything found and log the rotation date against the client record.

6. 06

   Confirm MFA enrollment and recovery paths for every retained identity

   A single unenrolled admin account defeats the rest of the review. Check that recovery codes are stored somewhere the agency controls, not on the individual's personal device.

7. 07

   Issue the recertification summary to the client sponsor and archive it

   One page: identities reviewed, removed, downgraded, and rotated. This document is what an agency produces when a client's auditor asks who had access during the engagement.