Who Can See Your Most Sensitive Data Right Now?

Here is a question that sounds simple and usually is not: who can see your most sensitive data today?

Not who should be able to. Not who was approved once. Who holds working access right now, including the service accounts nobody owns and the vendor whose contract ended in March.

If the honest answer is "we would need a week to find out," you have learned something useful. The gap between the question and the evidence is the finding.

TLDR

• Pick one critical data set and answer for it completely before widening scope.

• Count people, service accounts and vendors - all three carry access.

• Every entry needs an owner and a last-reviewed date.

• Stale access is normal; invisible access is the problem.

• Visibility is a precondition for every other control on that data.

Three kinds of access

People are the easy part: employees and contractors with logins. Service accounts are harder: the automated connections between systems that run with broad rights and no human watching. Vendors are hardest: support access, integrations and former partners whose access outlived the relationship.

Least-privilege guidance in NIST SP 800-53 Rev. 5 (AC-6) expects access to be limited to what each user or process needs - and expects the organization to know what that is. You cannot limit what you cannot see.

The one-page visibility report

For one critical data set, the answer fits on a page. The example below is illustrative.

Access holder (illustrative)	Count	Owner	Last reviewed
Employees with read access	34	Data owner, Sales Ops	45 days ago
Employees with write access	6	Data owner, Sales Ops	45 days ago
Service accounts	11	3 unassigned	Unknown
External vendors	2	1 contract ended	Over a year ago

In this example the people look managed and the non-human access does not. That pattern is common, and it is where incidents begin.

Why service accounts drift

Service accounts get created for a project, granted broad rights to make the errors stop, and forgotten. No manager reviews them because no manager feels responsible. Assigning each one an owner - a person who must periodically say yes, this is still needed - is the single fastest fix.

Visibility before everything else

Encryption, monitoring and retention rules all assume you know where the data lives and who touches it. The visibility report is not a compliance artifact; it is the map every other control depends on. For protecting the customer data itself, see how to protect sensitive customer data.

Frequently asked questions

How often should access be reviewed?

Quarterly for sensitive data sets, with automatic expiry for accounts unused for a set period such as 90 days.

What counts as most sensitive?

The data whose exposure would trigger your worst day: customer records, payment data, health information, core designs. Choose one and start there.

Who should own the report?

The business owner of the data, with the security team assembling it. Ownership of the risk belongs to the business.

Is unknown access really that common?

Yes. Most organizations discover unowned service accounts and lapsed vendor access the first time they look. Finding them is the point of the exercise, not an embarrassment.

A Defensible Next Step

Ask for the one-page access report for your single most sensitive data set, with owners and review dates. If assembling it takes more than a few days, that delay is itself the answer. Book a Decision-Clarity Call if you would like help building it.