Monthly Access Review Checklist

Yachts change people constantly. Crew rotate, contractors come aboard, charter guests bring devices, shipyards add temporary accounts, vendors request support, owners change assistants, and management-company staff move roles.

Access control fails when nobody removes yesterday's trust.

The risk is rarely dramatic at first. A former crew member still has shared-drive access. A shipyard account still works after launch. A vendor VPN profile survives a refit. A temporary purser still has guest data. An old admin password is known by people who have not worked with the yacht for years.

A monthly access review does not need to be complicated. It should answer one question: does each person, device and supplier still need the access they currently have?

Start with the systems that expose the most risk:

• Email and Microsoft 365 or Google Workspace accounts.
• Yacht-management and planned-maintenance platforms.
• Cloud file stores and shared drives.
• Accounting, procurement and purser systems.
• Firewall, VPN and remote-access accounts.
• Wi-Fi controller and network admin accounts.
• CCTV/NVR and access-control systems.
• SatCom management portals.
• AV and owner-dashboard systems.
• PMS, VMS, AMS and OT support accounts.
• Shipyard or refit temporary accounts.

Do not limit the review to crew. Include vendors, shore managers, family office staff, former contractors, relief crew and shared service accounts.

Think of the review as a monthly crew list for digital access. If the person, company or device would not be allowed through the gangway today, it should not automatically keep access to yacht systems.

List people who joined, left or changed roles during the month. A deckhand moving to another yacht may still have access to shared files. A former AV contractor may still have a VPN profile. A temporary purser may still have guest data. A shipyard laptop may still be trusted on the network.

Access should follow role, not memory. If the person no longer has the role, remove or reduce access.

This step should include shore-side changes. Management-company staff, family office assistants, temporary bookkeepers and supplier contacts can carry just as much risk as onboard crew.

Privileged accounts are admin accounts, super-user accounts, firewall administrators, cloud admins, network-controller admins, server admins, CCTV admins, access-control admins and automation support accounts. These should be few, named and protected with MFA where available.

The review should confirm:

• Who has admin rights?
• Why do they need them?
• Is MFA enabled?
• Is the account named, not shared?
• Was it used recently?
• Should it be disabled, reduced or retained?

If an admin account is shared, the review should record why it still exists and what the replacement plan is. Shared admin accounts make it hard to prove who changed what.

Remote access deserves its own check because it is easy to forget. Review VPN users, vendor portals, remote desktop agents, cloud-controller access, SatCom management portals and any cellular or out-of-band support modem.

For each access path, record the owner, purpose, approval route and whether access is disabled by default. If nobody can explain what a remote-access method does, it should not remain active without investigation.

The review should also ask whether any remote-access method was enabled for an urgent support window and never closed. That is one of the most common yacht cyber hygiene failures.

Guest and crew personal devices should normally live on low-trust networks. The monthly review should check whether any personal devices have been allowed into owner office, crew admin, AV control, CCTV, bridge-adjacent or OT networks.

Look for unknown devices, duplicated device names, old charter devices, smart TVs, game consoles, tablets and temporary contractor laptops.

Shared passwords are common on yachts because they are convenient during refit and charter operations. They are also poor evidence. Where shared accounts still exist, record why, who knows the password, when it was last changed, and what replacement plan exists.

Priority targets for cleanup include firewall admin, VPN, cloud storage, CCTV, Wi-Fi controller, NAS, AV processors and management portals.

Where a shared password cannot be removed immediately, rotate it after crew changes, refit periods, supplier changes and charter seasons. Record the exception so it is not forgotten.

The output should be simple:

• Accounts removed.
• Access reduced.
• MFA enabled.
• Passwords rotated.
• Dormant accounts disabled.
• Vendor access confirmed or closed.
• Exceptions accepted by captain or management.
• Follow-up actions assigned.

Keep the record with the SMS, cyber folder or management evidence pack. It may become important during audit, incident response or supplier handover.

The record should be understandable to a captain or manager. Avoid producing a raw export with hundreds of account names and no conclusion. Summarise what changed, what remains risky and who owns the follow-up.

• Crew leavers removed from email, cloud, PMS and onboard systems.
• Role changes reflected in permissions.
• Admin accounts reviewed.
• MFA checked for cloud and remote access.
• Vendor accounts reviewed.
• VPN users reviewed.
• Remote desktop tools checked.
• Shipyard/refit temporary accounts removed.
• Guest and crew device networks checked.
• Shared passwords identified and rotated where needed.
• CCTV/access-control users reviewed.
• Access exceptions recorded.

• Only checking email and ignoring firewall, CCTV and vendor portals.
• Forgetting shipyard accounts after refit.
• Allowing old crew to keep shared-drive access.
• Leaving owner-office access for temporary support users.
• Treating shared passwords as harmless because "everyone knows them."