Just some ideas: Giving and managing access: Have a very clear flowchart for when someone joins/leave a role what their privileges are. Ensure all department

Just some ideas: Giving and managing access: Have a very clear flowchart for when someone joins/leave a role what their privileges are. Ensure all departments sign up to this understanding. Write in all department SOP/flowcharts/guidelines what to do when someone joins/leaves a role. This is your field, and by using their server they're running on it. So ensure they comply. Audit: Run monthly checks to the above have been done. Above should be approved by all dept. heads so just get whoever's in control approval of policy. Use SOX404 style checking of access/other access. This just means taking samples of actions that could be taken, and checking them. 10-15% should be OK, depending on process/function. These are all non-technical checks. Do check in with your compliance/legal function for their perspective of what's needed (and what to avoid keeping on disk - just disregard). They will likely have a lot of insights which are both technical and non-technical.