A nimble organization needs to be ready for growth — and cuts. Sometimes business closure or shutting down a unit is needed, either as part of the evolution of a company, as part of a company’s growth via merger and acquisition, or as the result of restructuring or for some other reason, such as a loss of business from a pandemic. 

If business closure has to be done, do it right. Vital but often overlooked steps enable your organization to make the transition securely, safely and with minimal disruption to the rest of the business. 

It’s important to realize that business closure is a special cybersecurity event in the life of your organization for two reasons. First, the actions for doing it securely span the whole spectrum, including policy, access, partners, compliance and data destruction. Second, everything has to be done quickly and in the right order. That’s why cybersecurity in mergers and acquisitions comes into play, and why a security checklist is your friend. 

How to Navigate A Business Closure

The three parts of secure business closure are assess, disconnect and destroy.

Start with assessment when managing a business unit closure securely.

  • Conduct a detailed inventory of all hardware, software and services, as well as data and intellectual property accessible by employees inside the business unit. 
  • Determine who has access to what. 
  • Create an inventory of certificates, records, service accounts, backup processes and other areas where the business interacts on a data or authentication level with third parties. 
  • Track down all the shadow IT, including cloud services, both authorized and unauthorized. Check for installed apps to find shadow IT services they might access. Capture or delete all the relevant data retained by these services. 
  • Review all of the business unit’s contracts, checking for obligations and agreements. Seek out help from the legal department on this part. 
  • Determine which employees (if any) to retain and reassign, and which (if any) will be removed. 

Cybersecurity Best Practices for Business Closure: Disconnect

With all this data in hand, it’s time to start pulling the plug. Make sure the team thinks through the order of all this, and proceeds quickly but one step at a time. 

  • Make sure the key players know the schedule.
  • Choose a core, small group with privilege access within the business unit. They will help in the decommissioning process. 
  • For all other employees in the unit, revoke access to networks and other assets right away. 
  • Reclaim company devices.
  • Delete company data from online services before closing those accounts. 
  • Terminate any vendor deals that won’t be used in the future. 
  • Consider all related domains and their future, and be careful not to open them up to malicious actors. 
  • Work with the core business unit team to test and seek out remaining loose threads or existing access points. 
  • Terminate all remaining accounts and access. 


After all the permissions are revoked, all accounts closed and all equipment shut down and gathered, it’s time to take the very important step of strategic data destruction to complete the unit or business closure. 

  • If you don’t have a data destruction policy or practice in place, develop one (you should have an updated policy anyway).
  • Pay attention to compliance needs in the destruction or archiving of data and inform everyone on the destruction team of the specifics. 
  • Identify which data-containing hardware will be repurposed and which will be destroyed. Follow best practices in this article for wiping, degaussing and physical destruction, being sure to end up with proper certificates of sanitization and documentation to satisfy compliance requirements. (In many cases this may involve recording video for devices as they’re being destroyed.) 

Stay Focused on People Throughout the Business Closure

Remember a business closure affects everyone involved. It’s not just about hard cybersecurity actions. It’s also about soft people skills. 

Communicate about the closure with honesty, transparency and compassion; do it early and often. Make sure all information relating to the change comes from the appropriate leadership, and not from the ‘grapevine,’ social media or news media. 

Prepare to support affected employees, whether they’re staying or leaving. Support the people remaining with access, training, information and guidance. And support the people leaving with whatever help they need to make the next transition in their lives. Treat everyone as a partner in the closure and transition. 

Note that this is not only good management, but it’s also good cybersecurity. A disgruntled former employee with an ax to grind is not going to benefit your goals to make a safe transition.

Business closure is a special and important cybersecurity event in the life of your organization. Make sure you do it with clear-headed planning, communication and thoroughness. 

More from Risk Management

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…

Container Drift: Where Age isn’t Just a Number

Container orchestration frameworks like Kubernetes have brought about untold technological advances over the past decade. However, they have also enabled new attack vectors for bad actors to leverage. Before safely deploying an application, you must answer the following questions: How long should a container live? Does the container need to write any files during runtime? Determining the container’s lifetime and the context in which it runs is critical, especially when hosting an internet-facing service. What is Container Drift? When deploying…