A nimble organization needs to be ready for growth — and cuts. Sometimes business closure or shutting down a unit is needed, either as part of the evolution of a company, as part of a company’s growth via merger and acquisition, or as the result of restructuring or for some other reason, such as a loss of business from a pandemic. 

If business closure has to be done, do it right. Vital but often overlooked steps enable your organization to make the transition securely, safely and with minimal disruption to the rest of the business. 

It’s important to realize that business closure is a special cybersecurity event in the life of your organization for two reasons. First, the actions for doing it securely span the whole spectrum, including policy, access, partners, compliance and data destruction. Second, everything has to be done quickly and in the right order. That’s why cybersecurity in mergers and acquisitions comes into play, and why a security checklist is your friend. 

How to Navigate A Business Closure

The three parts of secure business closure are assess, disconnect and destroy.

Start with assessment when managing a business unit closure securely.

  • Conduct a detailed inventory of all hardware, software and services, as well as data and intellectual property accessible by employees inside the business unit. 
  • Determine who has access to what. 
  • Create an inventory of certificates, records, service accounts, backup processes and other areas where the business interacts on a data or authentication level with third parties. 
  • Track down all the shadow IT, including cloud services, both authorized and unauthorized. Check for installed apps to find shadow IT services they might access. Capture or delete all the relevant data retained by these services. 
  • Review all of the business unit’s contracts, checking for obligations and agreements. Seek out help from the legal department on this part. 
  • Determine which employees (if any) to retain and reassign, and which (if any) will be removed. 

Cybersecurity Best Practices for Business Closure: Disconnect

With all this data in hand, it’s time to start pulling the plug. Make sure the team thinks through the order of all this, and proceeds quickly but one step at a time. 

  • Make sure the key players know the schedule.
  • Choose a core, small group with privilege access within the business unit. They will help in the decommissioning process. 
  • For all other employees in the unit, revoke access to networks and other assets right away. 
  • Reclaim company devices.
  • Delete company data from online services before closing those accounts. 
  • Terminate any vendor deals that won’t be used in the future. 
  • Consider all related domains and their future, and be careful not to open them up to malicious actors. 
  • Work with the core business unit team to test and seek out remaining loose threads or existing access points. 
  • Terminate all remaining accounts and access. 

Destroy

After all the permissions are revoked, all accounts closed and all equipment shut down and gathered, it’s time to take the very important step of strategic data destruction to complete the unit or business closure. 

  • If you don’t have a data destruction policy or practice in place, develop one (you should have an updated policy anyway).
  • Pay attention to compliance needs in the destruction or archiving of data and inform everyone on the destruction team of the specifics. 
  • Identify which data-containing hardware will be repurposed and which will be destroyed. Follow best practices in this article for wiping, degaussing and physical destruction, being sure to end up with proper certificates of sanitization and documentation to satisfy compliance requirements. (In many cases this may involve recording video for devices as they’re being destroyed.) 

Stay Focused on People Throughout the Business Closure

Remember a business closure affects everyone involved. It’s not just about hard cybersecurity actions. It’s also about soft people skills. 

Communicate about the closure with honesty, transparency and compassion; do it early and often. Make sure all information relating to the change comes from the appropriate leadership, and not from the ‘grapevine,’ social media or news media. 

Prepare to support affected employees, whether they’re staying or leaving. Support the people remaining with access, training, information and guidance. And support the people leaving with whatever help they need to make the next transition in their lives. Treat everyone as a partner in the closure and transition. 

Note that this is not only good management, but it’s also good cybersecurity. A disgruntled former employee with an ax to grind is not going to benefit your goals to make a safe transition.

Business closure is a special and important cybersecurity event in the life of your organization. Make sure you do it with clear-headed planning, communication and thoroughness. 

More from Risk Management

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

How I got started: Ransomware negotiator

4 min read - Specialized roles in cybersecurity are proliferating, which isn’t surprising given the evolving threat landscape and the devastating impact of ransomware on many businesses.Among these roles, ransomware negotiators are becoming more and more crucial. These negotiators operate on the front lines of cyber defense, engaging directly with cyber criminals to mitigate the impact of ransomware attacks on organizations.Ransomware negotiators possess a unique blend of technical expertise, psychological insight and negotiation skills that allow them to navigate the high-stakes environment of ransomware…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today