How to control internal access while preparing records for licensing

Why internal access is the part owners forget

Most owners think about what the buyer will see. Fewer think about who inside the company will see the records while they are being gathered. Exports pull email, chat, tickets and finance files into one place, and a folder that is readable by the whole company is a leak waiting to happen.

The controls below apply whether the company hands over files from its own storage, as SourceX expects for large deliveries, or ships on encrypted drives. Because SourceX does not hold multi-terabyte datasets, working copies live in the company's own environment, and protecting them is the company's job.

Partners are not part of this. A partner introduces the company and never exports, uploads or describes confidential records.

What do you need in place first?

Before the first export, confirm these prerequisites:

• A written decision from the authorized sponsor (owner, CEO, CFO or authorized representative) that the project is going ahead to the inventory stage.
• Agreed scope: which systems, which date range, which exclusions.
• A named project lead who is not the person running the exports.
• The redaction and de-identification requirements, which are agreed with the company before any work begins.
• A list of who in IT can run exports for each system.

Step-by-step controls

1. Name the handler group. Pick the smallest group that can do the work, usually one IT administrator per system plus a reviewer. Write the names down. Anyone else asking for access goes through the project lead.
2. Use least privilege. Give each handler access only to the systems they must export from, only for the project window. Remove the access when their task ends, not when the project ends.
3. Build one staging area. Create a single restricted location for working copies, separate from shared drives and personal folders. No one uploads to it from a laptop's local disk unless the policy says so.
4. Separate duties. The person who exports should not be the person who approves what leaves the staging area. Two sets of eyes catch mistakes.
5. Log every access. Turn on audit logging for the staging area and export tools. Keep the logs for the length of the project and the agreed term in the contract.
6. Block copies. Disable downloads to personal devices and personal email forwarding for the staging area. If the company already has data loss prevention tooling, apply it here.
7. Review a sample. Run the agreed rules on a small slice and have a named reviewer sign off before scaling up.
8. Record the handover. When files go to the buyer or are made available in the seller's own storage, write down what was handed over, when, by whom and how it was verified. The delivery manifest template is a starting point.
9. Delete working copies. After handover is confirmed, delete the staging area and any local copies, and record the deletion with a date and an approver. Keep only what the agreement says the company must keep.

Who gets access to what?

What mistakes cause leaks?

Do formal security rules apply?

It depends on the industry. Companies that are financial institutions covered by the FTC's Safeguards Rule must maintain a written information security program, as explained in the FTC's guide to the Safeguards Rule. A licensing project is a good moment to check that the staging area fits that program. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Other contracts, such as client security addenda, may also limit who can handle certain records. Check them before the export starts. The stakeholder objection map lists the concerns different teams usually raise, and the guide on notifying outside parties covers who outside the company should know.

Example: a 140-person engineering firm

Illustrative and fictional. A 140-person engineering services firm decides to explore a license of project records. The CFO names an IT manager as project lead and asks the systems administrator to export from the ticketing tool and the document store only. A restricted folder is created with a reviewer holding read-only rights. The first sample is checked against the agreed rules, and a second reviewer in finance signs off. After handover, the folder is deleted and the deletion is recorded.

Nothing in this example is a benchmark; it simply shows how few people need to be involved.

What if the project is already under way?

Pause new exports, list who has touched what, move any stray files into a staging area and delete the rest. Tell counsel if sensitive material was exposed internally. Then restart with the controls above. A pause is cheaper than a leak.

What to tell the IT team

Keep the briefing short and specific, and put it in writing so the scope is not renegotiated verbally.

When do the controls start and stop?

Next step

If an owner you know wants to explore licensing but worries about how the project is run internally, point them to the portfolio reputational risk guide and the finance workflow assessment guide. Then register as a partner and make the introduction. The referral FAQ explains the rest.