On this page
Handoff checklist
Use the Trust page ownership pack and the export guide list as the base packet, then apply the control checklist below.
Name the entity and decision owner
Record the legal entity, jurisdiction, current directors or officers, board resolution and the role that can approve data use. If a formal insolvency or assignment process has started, pause and confirm who controls the estate. Do not infer authority from an administrator password.
Map the archive
List each source system, admin role, period covered, format, linked system, approximate volume if measured, export state and known gap. Mark HR, legal, direct messages, customer material, secrets and other exclusions. Keep the raw archive in its controlled location.
Transfer the evidence
Include founder, employee, contractor and client assignments; earlier licenses; vendor terms; staff notices; privacy reviews; data cards; scan reports; export manifests; board approvals and signatory records. Record the evidence date and the person or role responsible for it.
Change access deliberately
Make an account list by role, not a public list of people and emails. Confirm who is authorized, what each role can open or export, when access changes, and how former administrators are disabled. NIST SP 800-53 AC-2 calls for documented account types, account managers, authorized users and access authorizations, plus approvals for account creation and timely disabling or removal National Institute of Standards and Technology, (opens in a new tab). Use it as a control prompt, not as a claim of certification.
Reconfirm commitments
Read contracts that restrict customer or employee records, earlier licenses or exclusivity, vendor training terms and any change-of-control clause. Mark each source as include, exclude, review or unknown. The new decision owner should not inherit an unexamined promise.
General information, not legal advice.
Handoff record
| Area | Evidence transferred | Acceptance by successor |
|---|---|---|
| Authority | Resolution, appointment or registry record | Role and scope confirmed |
| Systems | Inventory, export manifests and admin roles | Coverage and gaps acknowledged |
| Rights | Assignments, client permissions and earlier licenses | Open title questions assigned |
| Privacy | Notices, masking rules and review references | Exclusions and access limits accepted |
| Security | Account list, revocation log and storage controls | Former access removed where required |
| Approval history | Scope decisions and prior review notes | Next approver named |
Worked fictional example
A fictional company’s founder leaves after the export of its code, support archive and internal documents. The successor receives the native exports, a system inventory and a title folder. The handoff identifies one client integration with unresolved permission and one vendor term that may claim use rights. Those components are marked review and kept out of any sample. The successor also disables the former founder’s admin access and records the change. The archive is preserved, but no license is granted until authority and scope are resolved.
Keep the next step narrow
Use operational data to refine the system map and company wind-down if the change is part of a closure. Counsel should review any change-of-control clause, board authority, employee notice and cross-border transfer question before a license is signed.
A good handoff leaves the successor with fewer mysteries, not just more credentials.
General information, not legal advice.
Sources
- Rightmark: Trust
- Rightmark: Export guides
- National Institute of Standards and Technology: Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5) (opens in a new tab)