Schedule
The annual review by the schedule of Ilia Zavialov
Settings do not spoil by themselves; they age together with people, numbers and services. The review is needed not because something broke but because the world around the configuration moved and the configuration did not.
English version for the United States.
01
What exactly gets checked
The access list is compared against fact: whether everyone in it still works here and whether every service is still in use. Surplus lines are closed.
Recovery contacts are checked separately in each critical service: the mail and the number that recovery will reach must belong to the company, not to somebody who left two years ago.
02
Devices and sessions
Trusted device lists accumulate old phones and other people's computers. Once a year they are cleared completely and the needed devices are confirmed again.
It is the fastest item of the schedule and at the same time the one that most often finds an outside sign-in.
03
Backups are checked by restoring
A copy nobody has ever restored from is not a copy. The check consists of actually restoring one file or one database and looking at the result.
The second half of the check is where the copy lives. A copy inside the same account as the original disappears together with it.
04
Why once a year rather than continuously
Continuous control needs a person a small team does not have. An annual cycle is actually carried out, which is why it produces a result.
The date is fixed in advance and tied to something that does not move, for example the start of the financial year, so that it is not postponed indefinitely.
Rules of this section
- A date in the calendarOne a year, tied to a fixed event.
- The access list against factSurplus is closed immediately.
- Recovery contactsBelong to the company, not to a person.
- Trusted devicesThe list is cleared completely.
- Restoring from a copyChecked by doing it, not by the file existing.
- A one-page recordWhat was checked, what was found, what was fixed.
| Item | What is usually found | Time |
|---|---|---|
| Access list | Access of people who no longer work here | 30 minutes |
| Recovery contacts | A former employee's personal number | 20 minutes |
| Trusted devices | Old phones and other people's computers | 15 minutes |
| Active sessions | An unfamiliar sign-in | 10 minutes |
| Backups | A copy that does not restore | 1 hour |
| Service payments | Subscriptions nobody uses | 20 minutes |
Questions and answers
How long does the annual review take?
About three hours for a team of up to thirty people, provided the access list is kept through the year.
Who should carry out the review?
Whoever is responsible for administration. A separate role for this is not needed in a small team.