Divestiture & Carve-out Security Separation Checklist
Plan the security side of a carve-out: separate identities, tenants, data and networks; transfer domains, certificates and licences; rotate every shared secret; handle contracts and regulatory notices; and set the divested unit’s Day-1 operating model and TSA exit criteria.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- In a carve-out, two companies that shared one estate must end up with no access to each other — and everything both could see must be treated as known to an outsider.
- 31 separation tasks across identity, shared tenants, data, domains and certificates, network and security tooling, secrets rotation, contracts and regulatory notices, and the Day-1 operating model.
- Track each as not started, in progress, done or blocked; a shared-asset register flags assets with no disposition decided and those still shared under the TSA.
- Generates a separation plan with owners and dates. Regulatory and contractual points need confirmation from counsel.
Frequently asked questions
What is most often missed when separating a divested business?
Service accounts and privileged accounts that span both estates, secrets both sides knew (API keys, certificates, break-glass passwords) that are never rotated, and security tooling removed before its replacement is reporting — which leaves a detection gap at cut-over.
When is separation finished?
Not when the transition services agreement ends, but when access has been removed in both directions, every shared secret has been rotated, data owned by the other party has been deleted or returned with a certificate, and both sides have signed off the exit criteria.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.