Use this guide if you have staff, contractors or regular helpers who use business email, apps or shared files. Old accounts left open are one of the most common security gaps in small firms. Have a list of the tools you use and admin access to each.
Step by step
List every system and who can grant access
Write down each tool that holds business data, including email, file storage, accounts, bookings, social media and supplier portals. Note who has admin rights for each. This becomes your master access list.
Define access by role
For each role, such as office, site team or bookkeeper, decide which tools and permission levels they need. Keep admin rights to as few people as possible. Write this down so decisions are consistent.
Create a joiner checklist
List the accounts to create, the devices to issue and the security steps to complete, such as setting up two-step verification and the password manager. Include a short briefing on phishing and where files are saved.
Create a leaver checklist
List every account to disable or remove, shared passwords to change, devices to collect and email forwarding to set up. Decide what happens to their files and mailbox so customer history is not lost.
Run the leaver steps on the last day
Disable access at the end of the person's final working day, or immediately if the departure is sudden. Transfer ownership of files and shared documents. Record the date each step was completed.
Review access regularly
Every few months, compare your master access list with each system's user list. Remove anyone who should not be there and downgrade permissions that are no longer needed. Check paid seats at the same time.
Ready-to-use checklist
- Master list of systems and admins
- Access defined per role
- Joiner checklist written
- Leaver checklist written
- Two-step verification set for every user
- Shared passwords stored in a password manager
- Devices recorded against each person
- Quarterly access review in the calendar
Practical tips
- Disable rather than delete accounts at first, so you can recover data if something was missed.
- Use shared mailboxes or group addresses for things like enquiries, so a role's email does not depend on one person.
- Keep contractor access time-limited and review it when their job ends.
Common problems
A leaver still knows a shared password.
Change it straight away and store the new one in the password manager. Where possible, replace shared logins with individual accounts so this does not recur.
We cannot remove someone because files are in their personal account.
Ask them to transfer ownership or share the files to a business account before they go. In future, require business work to be saved only in business-owned storage.
We do not know who has admin rights.
Check each system's user list for admin roles. Reduce to at least two trusted admins per system so you are not locked out if one person is unavailable.