in order

These guides add up to something like a hundred specific things to go and look at, most of them described as taking an afternoon. That is a year of afternoons.

Nobody has a year of afternoons. So this is the order to do them in, and the ones you can skip.

Two rules decide the order. Cheapest first, where cheap means minutes of work. And reversible before structural, because the things you can undo should be tried before the things you cannot.

the first sitting

Eleven things. One or two cost a little (a licence, a hardware key), the rest cost nothing, and none of them is a project.

Count your super admins. If the answer is one, stop reading and fix that. The founder departure guide.

Check whose name is on the domain registrar and the DNS. Whose name, which matters more than who has the password. Same guide.

Add a second super admin that is not a person, with its key somewhere physical that two people know about. Same guide.

Turn on the activity rule for admin grants, which is free on Business editions and emails you when somebody becomes an admin. The log export guide.

Open the domain-wide delegation list. In the Workspace admin console: Security, Access and data control, API controls, then domain-wide delegation. Read every entry and find its owner. The service accounts guide.

Open the list of apps connected to your directory and download it. That is your OAuth grant surface as a spreadsheet. The three lists guide calls it the fourth list.

Open your CRM’s export log. Ninety days, anything over a thousand records. The CRM export guide.

Count the accounts in your directory that are not people who work for you. Guests, externals, anything on a domain that is not yours. The contractors guide.

Check the default permission for members on your code host, and set it as low as your teams can work with. The GitHub guide.

Look at one long-tenured employee’s groups and ask, for each, why they are in it. The stayers essay.

Put four dates in the calendar for the quarterly log export, with a named owner and a named deputy. The log export guide.

Eleven items. They will not fit in an hour, because the CRM export log and the external account count each take longer than that. Call it a morning. If you do nothing else from this site, do these, and you will have closed the failures that are both most likely and most expensive.

Four of them exist because a single person holds something nobody else can recover. Most of these guides are about accumulation. A real share of the risk turns out to be about concentration, which is the opposite shape and has the opposite fix.

the order, at a glance

1. 1first sittingSuper admins, registrar, break-glass, admin alert, delegation list, app list, CRM exports, externals, code host default, one stayer, four calendar dates.
2. 2first monthGrant reviews, external sweep, service account audit, vault report, offboarding order, hostile departure page.
3. 3first quarterBlast radius page, reconstruction page, SSO/SCIM/log table, ownership sheet, reorg diff, day-one defaults.
4. 4skip, unless it appliesAcquisitions, indexes, impersonation, anything above your plan.

the first month

Now the ones that need a morning each.

The stayers diagnostic, in full. Your longest-serving employee, everything they can reach, and why. The stayers essay. It is one of the most productive hours on this site, and it sits here only because it takes longer.

The application grant review, working from the list you downloaded. What is it, who installed it, what scopes, do you still use it. Then the same on your code host and on your CRM. The Salesforce connected apps guide and the GitHub guide.

The external account sweep. Everything not on your domain, sorted by last sign-in. Anything silent for 180 days comes out. Anything with admin rights gets reviewed regardless. The contractors guide.

The service account audit. Everything with a credential and no person. Last authentication, scope, owner. The service accounts guide.

The vault report habit, which is one line added to your leaver checklist: pull the password manager usage report before removing the account. The shared vaults guide.

The offboarding order. Suspend, sign out, reset the password, revoke grants. The token guide and the hostile departure guide.

Write the hostile departure sequence down before you need it, and settle the timing question with somebody who knows your employment law. The hostile departure guide.

the first quarter

Things that are projects more than tasks.

The blast radius page. Your ten most-privileged identities and what each can reach. The blast radius guide.

The reconstruction page. Ten questions, which you can answer, how far back. The super admin guide.

Those two together are your quarterly pack. Two pages, produced four times a year, answering how bad it would be and how much of it you could prove. Most of the rest of this site feeds one of those two pages.

The three-column table. Every tool: SSO, provisioning, audit log. The SSO tax guide. It takes an afternoon and it will change what you buy.

The ownership sheet. Two roles, one named human per system, one owner per artifact. The ownership guide.

The reorg diff, on the restructure you already had. The reorg guide.

The day-one defaults, which have the most leverage of anything here, because you set them once and they apply to people you have not hired yet. The day one guide.

what to skip

Every guide here adds to the pile. This section takes things off it.

Skip the acquisition audit unless you have acquired somebody. The acquisition guide matters a lot after a deal and not at all before one.

Skip the index test until you have an index. The replicated permissions guide matters if somebody has pointed a search product or a vector database at your files, and not at all if nobody has.

Skip the impersonation review if you do not sell software with a support tool. The customer access guide is written for a specific shape of company.

And skip anything that needs a plan you do not have. Several guides describe controls that live on tiers above yours. The right response is the one in the super admin guide: write down that you cannot do it, date it, and move on. No upgrade, and no guilt.

the four ideas underneath all of it

If you remember nothing procedural, these are the ones that transfer.

Access accumulates and nothing removes it, because every system reacts to hiring and leaving, and almost nothing reacts to changing jobs. That is the stayers essay and the reorg guide, and it is the founding observation.

Adding somebody to a container gives them its history, so much of what anyone holds was inherited on their first morning. The day one guide.

A credential is knowledge. You can revoke access. You cannot revoke knowledge, which is why rotating and revoking are different verbs. The token, service accounts and shared vaults guides.

And the questions that matter are about consequence and about proof. How bad would it be, and how much of it could you show? The blast radius and super admin guides.

Almost everything else here is one of those four wearing different clothes.

where the guides argue with each other

One place, worth naming.

The ownership guide says write ownership down. The switch-off guide says writing things down is exactly what will not work for configuration nobody understands. Read a fortnight apart, that looks like a contradiction. It is the same instrument aimed at two different objects, and the deciding question is whether anybody knows the answer. If somebody does, record it. If nobody does, switch it off and find out.

the last thing

Nobody is coming to do this for you. There is no security team arriving, the fractional version does not fit your budget, and the tooling that would automate most of it is priced for companies with ten times your headcount.

What there is instead is a person who has another job, an hour a quarter, and a list.

That is less bleak than it sounds. A company of sixty people can hold its entire access surface in one head and one spreadsheet, which no company of six thousand can do at any price. Almost everything on this site is easier for you than for them. It is only that nobody is going to make you do it, and nothing will break loudly enough to force it until the day it breaks all at once.

The list is above. Start at the top.