Asset decommissioning is the controlled retirement of systems, storage, software services, and integrations that are no longer needed. It involves identifying each asset, deciding whether it should be archived or shut down, and verifying that it is no longer accessible or operating.
In cybersecurity, incomplete decommissioning can leave forgotten accounts, exposed data, active credentials, or vendor connections behind. During a project or organization shutdown, defenders should inventory assets, revoke access, rotate secrets, preserve required records securely, and confirm that services have been disabled or removed. This helps prevent abandoned environments from becoming overlooked entry points.