C4. Clean Up Footprints
Remove what shouldn’t be findable. Old accounts, old access, old permissions.
In plain language.
C4 is the practice that gets deferred forever, because nothing breaks when you skip it. There is no alert, no complaint, no visible failure — right up until there is.
Three questions cover most of it. Which accounts does the school no longer use? Who still has access who no longer works here? Which passwords are shared — because if more than three people know it, it isn’t a password, it’s an announcement.
This is almost never a trust problem. Nobody is being accused of anything. It’s an offboarding-checklist problem, and it’s the most common finding there is.
What’s different in a school.
Schools turn over constantly — student teachers, coaches, seasonal staff, volunteers, parent helpers, an intern who set up the newsletter account four summers ago. Each one arrives with an urgent access request and leaves without one.
The accumulated result is a set of doors nobody is watching. Not because anyone was careless, but because access is granted in a moment of need and removed in a moment that never comes.
What this looks like in practice.
The same practice, told three ways — so a champion can pick the version they need this week.
The offboarding checklist you already half-have
Most schools have an exit process covering keys, badges, and the laptop. Add three lines: email disabled, student information system access removed, shared drive permissions reviewed. The habit is what matters, not the tool.
Accounts students no longer use
Students inventory their own old accounts — the game from 5th grade, the abandoned social profile, the app they signed up for once. Then they close two. It’s the rare digital-citizenship lesson with a verifiable outcome.
Old email addresses still receiving mail
An abandoned inbox nobody reads is still the password-reset path for accounts that matter. Close it or secure it — and check the forwarding rules on the ones you keep.
Close one thing
Thirty minutes. Nobody finishes this in one sitting, and treating it as a project guarantees it never starts.
- List every school account and service you can name in ten minutes. Stop at ten.
- Cross-check against everyone who left in the last twelve months.
- Remove access for one person who has left. Just one.
- Identify one shared password and replace it with individual accounts.
- Put the next item on next month’s champion agenda — then actually do it next month.
Activities by grade band.
Each fits a single class period and needs no lab, no licence, and no prior technical background from the teacher.
The account inventory. Students list every account they can remember, then check an email address against a breach-notification service. Seeing their own address in a real breach list is the single most memorable moment in the whole model.
Access review, run properly. Give students a fictional staff roster and permission matrix and have them find the over-provisioned accounts. Access review and least privilege are named concepts on both CC and Security+, and this is what the job actually looks like.
Credentials are the front door
Credential abuse was the single largest initial access vector in Verizon’s 2025 analysis at 22% of breaches, and stolen credentials featured in 88% of attacks against basic web applications. Dormant accounts are credentials nobody is monitoring.
Source: Verizon, 2025 Data Breach Investigations Report. Full reference list on the 4C overview.