An employee leaves, and a scheduled report stops because it ran through their account. Routine system administration should uncover that dependency before departure. Keep a record of who owns the application’s recurring work, alongside the people authorized to use it. This checklist covers the approvals and maintenance details that otherwise disappear into individual inboxes.
Check Items as You Prepare. Your Checks Stay on This Page.
Define the Administrator’s Authority
For a Virginia services company, an administrator may provision an approved employee account but should not decide the employee’s business authority. Document who requests access, who approves the role and who performs the change. Use separate administrative access where supported and appropriate. Identify emergency access arrangements with the security owner before an outage. Avoid sharing credentials as a substitute for a properly assigned backup administrator.
Keep a Change Record
Record enough information to reconstruct a change without placing passwords or secret values in the log. Include the business reason and the evidence of approval.
| Item | What to Record |
|---|---|
| Request | Add a project coordinator to the approved operating group. |
| Approval | Manager and data owner approval where required by the access model. |
| Change | Specific account, role and effective date. |
| Verification | User can perform the intended task and cannot access restricted areas. |
| Review | Temporary access expiration or the next scheduled access review. |
Plan for Departures and Vendor Changes
Connect access removal to the organization’s personnel process and identify accounts that own scheduled jobs or integrations. Removing a person should not unexpectedly stop a business workflow, but preserving their account indefinitely is not a sound handoff. Transfer ownership through the supported product process and review associated tokens or connections. Confirm vendor administrator access remains necessary and has an accountable internal sponsor.
Maintain a Small Operating Calendar
Keep a small calendar of access reviews, vendor changes, and configuration checks. Establish who can reverse a change and where the current support contact is recorded. Test important changes before live use where the product supports a suitable environment.
NIST’s Digital Identity Guidelines revision four was finalized in July 2025. Its September 2026 token-protection report addresses connected access. Ask the technical owner which guidance applies to the application and how its controls will be verified.
Gartner’s October 2026 outlook also highlights AI agent identity. If an agent can update records, include it in the access review with its purpose and accountable owner. Confirm how to revoke its permissions when the workflow ends. A subscription may remain active while the business reason for a particular connection has disappeared.