A practical sequence.
FIRST MONTH
Register accounts to the business, with a second administrator Enable a second authentication step everywhere Set billing alerts at two thresholds Record what you use, who owns it, and what data it holds
SECOND MONTH
Review permissions and remove what is unnecessary Check what is publicly accessible and close it Establish exports or backups for anything critical Verify one export is actually usable
THIRD MONTH
Review the first bills line by line Right-size anything over-provisioned Cancel anything unused Diarise renewals and notice periods Test recovering access to a critical account
THEN, ONGOING
Monthly: cost, running resources, access, notices
Annually: the full review
WHAT THAT ACHIEVES
Most of the control available, before problems accumulate.
WHAT IT PREVENTS
Sprawl, surprise bills, exposed data, and accounts nobody can recover.
WHAT IT COSTS
A few hours, spread over three months.
WHAT TO DOCUMENT
All of it, as you go.
