CyberShield Advisory
Who Still Has Access to Former Client Files?
When an engagement ends, the files stay and the access can stay with them. This checklist helps a firm find out who can still open a former client's information.
Why this matters
When a client engagement ends, your firm usually keeps the files, for records, for follow-up work, or because of retention duties. The permissions that let people reach those files can stay too. Over time, a former client's information can be open to former staff, outside experts and old links, long after anyone needs it. This checklist helps you find out. Work through it for one closed matter first.
The checklist
- Internal access. List who can open the matter's folders and mailboxes. Is every name someone who still needs it?
- Former employees. Confirm that people who have left no longer have accounts, group memberships or shared mailbox access.
- Contractors and outside experts. Check whether anyone who helped on the engagement still holds access they no longer need.
- Client contacts. Look for guest accounts for the former client's staff. Remove those who no longer need to see the material.
- Sharing links. Find links created for the matter, especially ones open to anyone who holds them. Remove or expire those that are no longer needed.
- Shared mailboxes and distribution lists. Check whether the matter's email address or group still delivers to people who have moved on.
- Synced and downloaded copies. Ask whether files were synced to laptops, phones or personal storage. Unmanaged copies may be outside your control.
- Chat and collaboration spaces. Review any team or channel created for the engagement and who remains in it.
- Archive access. Where closed matters are archived, confirm that access is narrower than it was during the work.
- Retention and disposal. Check whether your retention rules say how long the files must be kept, and who decides when they are deleted.
- Ownership of the review. Make sure one named person is responsible for doing this at the close of each engagement.
What to do with the results
- Remove access that has no current reason.
- Record what you removed and when, so you can show that you reviewed.
- Add an access review to your engagement close-out routine.
- Revisit the review on a schedule, not only when a matter closes.
Take the next step
Our free Microsoft 365 security assessment asks five quick questions, including who your files can be shared with, and shows where a firm like yours can start. It is a short check, not a full review of your settings.