Day Two After Close: The Access Review Nobody Scheduled

Day one after an acquisition close is carefully staged: announcements, org charts, the integration plan's first page. Day two is quieter, and more dangerous, because day two is when everyone assumes the access question was handled.

It was not. The integration plan covers systems, synergies and reporting lines. Nobody's workstream owns the plain question: who, across both companies, can log in to what right now?

The answer is always more people than intended. Administrators from both sides, service accounts nobody remembers creating, employees who left but whose accounts outlived them, vendors whose connections survived the contracts that justified them. Every one of those paths is now inside your combined estate.

TLDR

• Ownership changes overnight; access changes only when someone changes it.

• Review four populations first: admin accounts, service accounts, departed employees, vendor connections.

• Run the review against payroll and contract lists, not against the directories alone.

• Decide per account: keep, re-scope or revoke, with the decision recorded.

• Schedule the review before close so day two has it on the calendar.

Why the review never happens by itself

Post-close, every leader is pointed at the future: integration milestones, customer reassurance, the synergies the deal promised. Access review is backward-looking hygiene with no milestone attached, so it slides. Meanwhile the practical reality of integration, people needing to collaborate across the old boundary, pushes access in the other direction. Permissions accumulate. Nothing gets removed.

NIST's control catalog treats account management as a continuous discipline: accounts are established, modified, reviewed and disabled through a managed process, including review against the organization's actual personnel and needs. A change of ownership is precisely the moment that review matters most, and precisely when it is least likely to be scheduled.

The four populations to review first

• Administrator accounts. Every admin from both organizations now potentially reaches the combined estate. List them, confirm each still needs the scope they hold, and re-scope the rest.
• Service accounts. Non-human accounts run integrations nobody fully documents. Each needs a named owner and a justification, or a date with the disable switch.
• Departed employees. People leave during deals at higher rates, and off-boarding during transition chaos is unreliable. Compare account lists against current payroll on both sides.
• Vendor connections. MSPs, support contracts and integrations from the acquired company's past may no longer have a contract behind them. No current contract, no connection.

The day-two punch list

The working artifact is a simple review record. The rows below are illustrative; the columns are the discipline.

Population	How to find them	Decision per account	Evidence to file
Admin accounts	Directory privilege reports, both companies	Keep, re-scope or revoke	Signed review record with per-account decisions
Service accounts	Authentication logs for non-human accounts	Owner assigned or disable date	Register entry with named owner
Departed employees	Accounts vs. current payroll, both sides	Disable and archive	Off-boarding confirmation
Vendor connections	Firewall, VPN and SaaS integration lists	Confirm contract or disconnect	Contract reference per surviving connection

Two rules make the review real. Run it against ground truth (payroll and contracts), because directories happily list people who no longer exist. And record a decision per account, because 'we looked at it' is not a control.

Schedule it before you need it

The fix is calendar, not heroics. Put the access review in the integration plan with a day-two date and a named owner before close, while the plan is still being negotiated and everything is still on the table.

It slots naturally beside the obligations register in the cyber obligations a buyer inherits on day one and the broader first ninety days of integration.

Frequently asked questions

When should the post-merger access review happen?

Immediately after close, day two by design, because ownership changes instantly while access persists until someone changes it. Schedule it in the integration plan before close so it has a date and an owner.

Which accounts pose the most risk after an acquisition?

Administrator accounts from the acquired company, undocumented service accounts, accounts of people who departed during the transition, and vendor connections whose contracts did not survive the deal.

How do you find accounts that should not exist?

Compare account listings against current payroll and active contracts rather than trusting the directories. Authentication logs reveal service accounts and connections that inventories miss.

Who should run the day-two access review?

A named owner from the acquiring side with authority over both estates, supported by IT from both companies. The decisions are business decisions; IT executes them.

A Defensible Next Step

If a close is coming, put one line in the integration plan now: access review, day two, named owner, four populations. If a close already happened and the review never ran, the best day for it is today. Book a Decision-Clarity Call to stand it up.