How to use these
Each checklist is designed for a real working session: block an hour, open the relevant admin console, and work through it. Most teams find the first pass uncomfortable, which is normal. The point is to move access decisions out of memory and into a document.
If the pass produces a long list of "not sure" answers, the useful next step is a fixed-fee Systems and Access Cleanup: same categories, but with evidence pulled from your actual environment and a sequenced plan at the end.