Last reviewed 31 October 2026
Why an audit, and why monthly
The first four steps of the digital lockdown are one-time fixes: freeze, limits, keys, unsharing. This step is the maintenance that keeps them true. Accounts drift. You connect a new app, a service adds a device, a forwarding rule appears, a small charge posts that you meant to look at. None of it announces itself.
Monthly is the right rhythm for the same reason supply rotation is monthly-ish: short enough that the lookback window is small and your memory still works (“was that me?”), long enough that you'll actually do it. Pick a standing day — the same day you check your stored water is a good anchor — and treat 30 to 60 days back as the review window.
The checklist: what to review
Sign-ins and devices. For your email provider, Apple/Google account, banks, and brokerages: open the device and session list. Everything on it should be a device you can name. Remove anything you can't. A session you don't recognize is the audit finding that matters most.
Password and 2FA changes. Your email and bank activity logs will show password resets and two-factor changes. Every one of them should be one you remember making.
Email filters and forwarding. The quietest attack there is: a rule that silently forwards your mail — or forwards only messages containing words like “bank” or “password reset” — to someone else. Open your mail settings, read every filter and the forwarding address field. Expected number of surprises: zero.
Connected apps. Every account accumulates third-party apps you granted access to once — a coupon tool from 2022, a game, a “sign in with Google” you don't recall. Revoke anything you don't actively use. Access you don't remember granting is access you aren't monitoring.
New accounts and changes at your financial institutions. Review contact-info changes (email, phone, address) on bank and brokerage accounts — a changed email is how statements stop reaching you. Confirm the login history looks like your life.
Charges, including tiny ones. Scan 30–60 days of bank and card activity, and pay special attention to small unfamiliar charges — a dollar or less is the classic test charge on a stolen number. A charge you can't identify gets a call to the issuer, not a shrug.
Your sharing baseline. Compare what's currently link-shared in your cloud drives against the deliberate list you made when you unshared everything. Anything new and not on the list gets locked or explained.
Your identity accounts — claim them before someone else does. If you haven't already, create your own logins at annualcreditreport.com, the Social Security Administration, the IRS, and USPS Informed Delivery. An account in your name, held by you, is an account a thief can't register first.
The router. The box that runs your home network has an admin password, and if it's still the one printed on the sticker, change it. It also gets firmware updates — check while you're in there.
The honest split: what an AI can and can't check
If you work with an AI assistant, it can do real parts of this: inventory your shared files against the baseline, scan the services it's connected to, and bring you the checklist with last month's answers attached. Use it for the inventory work.
But be clear-eyed about the boundary: your assistant probably cannot see your email filters, your bank's device list, or your brokerage's session history — those live behind settings pages no integration exposes. That's a roughly twenty-minute manual pass, and it's yours. Anyone (or any tool) claiming your audit is fully automated is skipping the pages where the quiet attacks live.
Make it a standing appointment
Write down, in one place: the audit date, the window you reviewed, and any flags and what you did about them. Three lines is enough. Next month's audit then starts from evidence instead of vibes — and on the month you find nothing, the note still earns its keep, because “checked, clean” is a finding too.
The storm connection
Preparedness was never a purchase; it's a cadence. Kits get checked, water gets rotated, batteries get tested — and now accounts get audited, on the same calendar, for the same reason: the failure you're preventing is the one that happens quietly, months before the emergency that exposes it.
Sources: Federal Trade Commission — consumer.ftc.gov · Cybersecurity and Infrastructure Security Agency — cisa.gov (account and router security basics)