For an organization subject to NIS2, start with systems critical to its services. Reconcile application accounts with both IdP data and personnel or partner records, then have named owners review privileged, external, inactive, and service access. Record the decisions before making changes; pilot removals and test policies in audit mode where available, with an exception and rollback path.