Social media management checklist for access, handover and exit

What to take away

A social media management checklist for access and exit helps a team prove that account controls happened when people joined, changed roles and left. Adapt it to each platform and risk level, and give every item an owner, evidence location and review date.

Check who may add administrators

Record every administrator grant, because the platform click is not the complete control. LinkedIn's instructions for adding Page administrators state that a super admin performs the action and selects a required role. The checklist should capture the request, approver, person, role, purpose, grant date, review date and later removal.

Accounts and access

Map each account to its platform's current access model. Use the label shown in the account's current settings.

Facebook Pages may use Facebook access with full or partial control or task access. Where classic Page roles remain, record Admin, Editor, Moderator, Advertiser, or Analyst.

Choose each role from the actual tasks required, then record who approved it and when it expires or will be reviewed. Do not grant full administration only because a narrower role is unfamiliar.

Record connected account permissions for scheduling tools such as Hootsuite, Buffer, Sprout Social, Later, and Sprinklr, and revoke them during offboarding. Scheduling tools hold logins too, so native scheduling versus calendar tools is also an access decision.

Protect the administrator and recovery accounts most. CISA lists unenforced multifactor authentication among common weak security controls, and says MFA can help prevent account takeovers. Record which accounts have it enabled, and who holds the recovery method for each. Keep that record beside the account inventory.

Remove access when someone leaves

Treat every departure, role change and vendor exit as an access event with a named owner. CISA's advisory on a former employee's compromised account says organizations should ensure accounts of offboarded employees are removed and can no longer access the network. Apply the same discipline to platform roles.

Create an Access and Handover Register with one entry per platform account. Record the account identifier, organization owner, incoming and outgoing people, role, recovery and billing control, connected tools, file location, open approvals and queues, transfer date, and evidence of removal.

Transfer the content calendar; approved posts and source assets with captions and metadata; ad-account and analytics access; domain and link-shortener ownership; and relevant password-manager entries. Never put passwords in the register.

Retain organization ownership and recovery control throughout. Ask a vendor to define tools, subcontractors, coverage hours, records and exit duties before work starts, and test an urgent correction, escalation, export and access removal.

Put the export format and delivery, ownership of work and files, subcontractor disclosure, coverage hours, return or deletion of records, and access-revocation owner in the exit terms. Creators need the same treatment, including a record of payment, experience, claims, disclosure, rights and amplification.

After an incident, review connected access

Define severity, decision owner, evidence and response target before an incident happens. Preserve the incident record, and review connected access before posting resumes.

For a suspected takeover, use the platform's account-recovery and compromised-account reporting flow; report suspected internet-enabled crime to the FBI's Internet Crime Complaint Center (IC3). Keep sensitive information out of public threads. List every queue, shift, language, backup and handoff, since bilingual workflows add one more handoff.

The monthly and weekly rhythm

Monthly items are the account inventory, ownership and role reviews, access removals, record sampling and the continuity test. Weekly items are queue inspection, overdue removals, tool renewals and the comparison with audience and business results. Assign every change an owner and due date.

Sample the records during the weekly review and correct controls that people routinely skip. Publishing and measurement checks belong in the organic growth checklist, so the access record stays short and gets used.

Run a monthly continuity test

Ask a trained backup to locate the account register, approved files, escalation contacts and current queues without help from the primary manager. Fix anything stored only in a private inbox or understood by one person. Run it every month and write down what failed.

Common questions

Who maintains the access checklist?

A workflow owner maintains it while account, content, privacy, security, service and business owners approve their parts.

How often should access be reviewed?

Review people, agencies, tools and integrations monthly, and check overdue removals and tool renewals weekly.

How should checklist compliance be tested?

Sample completed records and ask a trained backup to locate accounts, approvals, queues, files and escalation contacts.