Credential vault import hygiene

Overview

Imports from spreadsheets, LastPass exports, or prior MSP dumps land with weak entropy, duplicated entries, and wrong URLs.

Process

1. Normalize naming (client - system - account purpose) before import automation.
2. Deduplicate by target + username; merge metadata carefully.
3. Rotate passwords on import for privileged accounts—even if “known good”—limits lateral blast if export leaked earlier.
4. Attach linked assets (firewall, hypervisor) in vault structure day one.

Security

Work on offline workstation for large sensitive CSV transforms; shred temp files; forbid Slack paste of secrets.

QA

Spot-check 10% entries with technicians onsite; verify TOTP seeds imported where applicable.

Governance

Define retention: stale credentials after decom still sitting = audit fail; quarterly orphan review.