Security & Privacy
A data sprawl audit checklist you can run
Data sprawl is easier to manage when you inspect it in a fixed order. This guide gives three decisions and a worked example for a small team reviewing one cloud account.
01
Step one: list every place data lives
Start with an inventory, not a policy. Export a list of databases, storage buckets, shared drives, analytics tables, backups and third-party exports. For each, record the owner, purpose, creation date and approximate size. Anything without an owner goes into a separate pile because it is the highest-priority question. In the worked example, a six-person product team finds fourteen buckets and discovers that five have no named owner and two hold copies of customer exports from a past migration. The inventory takes an afternoon and already shows where attention should go before any tooling is bought.
02
Step two: classify by sensitivity and growth
Next, mark each location by what it holds and how fast it changes. A simple scale works: public, internal, confidential and regulated, paired with flat, steady or fast-growing. Fast-growing stores with confidential content deserve review first, because they combine exposure and cost. In the example, one unowned bucket holds nightly database dumps that have grown for eighteen months and are readable by a broad internal group. That single finding outranks nine low-risk folders. Write the reason beside each rating so the decision can be reviewed later by someone who was not in the room.
03
Step three: act, verify and schedule the repeat
For every flagged location choose one action: delete, archive, restrict access or assign an owner. Record who approves it and a date. Then verify by checking access settings and size afterwards instead of assuming the change worked. In the example, the team deletes two duplicate exports, restricts the dump bucket to a backup role, and assigns owners to the remaining unknowns. Finally, put a recurring review on the calendar, monthly for fast-growing stores and quarterly for the rest, so the next inventory starts from this one instead of from nothing.