A nimble organization needs to be ready for growth — and cuts. Sometimes business closure or shutting down a unit is needed, either as part of the evolution of a company, as part of a company’s growth via merger and acquisition, or as the result of restructuring or for some other reason, such as a loss of business from a pandemic. 

If business closure has to be done, do it right. Vital but often overlooked steps enable your organization to make the transition securely, safely and with minimal disruption to the rest of the business. 

It’s important to realize that business closure is a special cybersecurity event in the life of your organization for two reasons. First, the actions for doing it securely span the whole spectrum, including policy, access, partners, compliance and data destruction. Second, everything has to be done quickly and in the right order. That’s why cybersecurity in mergers and acquisitions comes into play, and why a security checklist is your friend. 

How to Navigate A Business Closure

The three parts of secure business closure are assess, disconnect and destroy.

Start with assessment when managing a business unit closure securely.

  • Conduct a detailed inventory of all hardware, software and services, as well as data and intellectual property accessible by employees inside the business unit. 
  • Determine who has access to what. 
  • Create an inventory of certificates, records, service accounts, backup processes and other areas where the business interacts on a data or authentication level with third parties. 
  • Track down all the shadow IT, including cloud services, both authorized and unauthorized. Check for installed apps to find shadow IT services they might access. Capture or delete all the relevant data retained by these services. 
  • Review all of the business unit’s contracts, checking for obligations and agreements. Seek out help from the legal department on this part. 
  • Determine which employees (if any) to retain and reassign, and which (if any) will be removed. 

Cybersecurity Best Practices for Business Closure: Disconnect

With all this data in hand, it’s time to start pulling the plug. Make sure the team thinks through the order of all this, and proceeds quickly but one step at a time. 

  • Make sure the key players know the schedule.
  • Choose a core, small group with privilege access within the business unit. They will help in the decommissioning process. 
  • For all other employees in the unit, revoke access to networks and other assets right away. 
  • Reclaim company devices.
  • Delete company data from online services before closing those accounts. 
  • Terminate any vendor deals that won’t be used in the future. 
  • Consider all related domains and their future, and be careful not to open them up to malicious actors. 
  • Work with the core business unit team to test and seek out remaining loose threads or existing access points. 
  • Terminate all remaining accounts and access. 


After all the permissions are revoked, all accounts closed and all equipment shut down and gathered, it’s time to take the very important step of strategic data destruction to complete the unit or business closure. 

  • If you don’t have a data destruction policy or practice in place, develop one (you should have an updated policy anyway).
  • Pay attention to compliance needs in the destruction or archiving of data and inform everyone on the destruction team of the specifics. 
  • Identify which data-containing hardware will be repurposed and which will be destroyed. Follow best practices in this article for wiping, degaussing and physical destruction, being sure to end up with proper certificates of sanitization and documentation to satisfy compliance requirements. (In many cases this may involve recording video for devices as they’re being destroyed.) 

Stay Focused on People Throughout the Business Closure

Remember a business closure affects everyone involved. It’s not just about hard cybersecurity actions. It’s also about soft people skills. 

Communicate about the closure with honesty, transparency and compassion; do it early and often. Make sure all information relating to the change comes from the appropriate leadership, and not from the ‘grapevine,’ social media or news media. 

Prepare to support affected employees, whether they’re staying or leaving. Support the people remaining with access, training, information and guidance. And support the people leaving with whatever help they need to make the next transition in their lives. Treat everyone as a partner in the closure and transition. 

Note that this is not only good management, but it’s also good cybersecurity. A disgruntled former employee with an ax to grind is not going to benefit your goals to make a safe transition.

Business closure is a special and important cybersecurity event in the life of your organization. Make sure you do it with clear-headed planning, communication and thoroughness. 

More from Risk Management

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging. We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically. For this reason, 75% of organizations…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…