Business Document Exposure Review Checklist

Could your website, old domains or public sharing links be exposing documents? Use this checklist to identify, classify and remediate files that may be publicly discoverable.

Scope

• □ List current domains
• □ List old and historic domains
• □ List subdomains
• □ List website hosts
• □ List cloud-storage platforms

Search

• □ Search the domain with site:
• □ Search for PDF documents (filetype:pdf)
• □ Search for Word files (filetype:docx, filetype:doc)
• □ Search for spreadsheets (filetype:xlsx, filetype:xls)
• □ Search for presentations (filetype:pptx)
• □ Search for known internal phrases ("confidential", "internal use")

Cloud Sharing

• □ Review SharePoint sharing links
• □ Review OneDrive sharing links
• □ Review Google Drive sharing settings
• □ Review other file-sharing services

Document Content

• □ Check for personal data
• □ Check for confidential information
• □ Check for credentials or API keys
• □ Check metadata (author name, company, revisions)
• □ Check comments and tracked changes
• □ Check hidden worksheets and rows
• □ Check presentation speaker notes

Response

• □ Record the URL, date and responsible system
• □ Restrict or remove the source file
• □ Check for duplicate copies
• □ Request search-result removal where appropriate
• □ Assess personal-data implications
• □ Replace exposed credentials

Verify

• □ Test direct access is blocked
• □ Check sharing permissions are corrected
• □ Review search-result status
• □ Record the decision

Prevent

• □ Assign named document owners
• □ Use approved redaction — not visual covering
• □ Separate public and private document storage
• □ Review publishing permissions
• □ Schedule the next check