Security Basics for Small Teams: Auditing Who Can Reach What
Most small teams don't have a security problem they can point to. They have a pile of accounts, shared logins, browser sessions, and old invitations that nobody has revisited in months. A useful starting point is not a tool purchase but an inventory: a plain record of who can reach which systems, through which credentials, and with what level of power. This article walks through a method for building that inventory, deciding what to tighten first, and asking tool providers the questions that reveal how they handle access. It is general guidance, not a substitute for a formal security review, and it makes no claims about any specific product's capabilities.
Start With an Access Inventory, Not a Tool List
Teams often begin security work by asking which software they should buy. A better first question is which accounts currently exist and who controls them. Write down every system that holds company data: email, file storage, code repositories, customer records, payment dashboards, marketing platforms, and any AI assistant that accepts uploaded documents. For each one, record the account owner, every person with login access, and whether the login is individual or shared.
Shared logins deserve special attention. When several people use one account, you lose the ability to tell who did what, and removing a departing employee becomes guesswork. If a shared login cannot be avoided because a vendor limits seats, note it explicitly as a known exception and assign someone to review it on a fixed schedule.
Review Permissions by Role, Then by Exception
Once you know who has access, compare each person's permissions against their current job. Permissions tend to accumulate: someone who helped with a one-time project keeps admin rights, or a contractor's invitation outlives the contract. A practical method is to group people by role, define the minimum access each role needs, and then list the exceptions where someone has more. Every exception should have a reason written beside it.
Pay particular attention to administrative roles that can invite new users, export data, change billing details, or disable security settings. These are the permissions that turn one compromised account into a much larger problem, so they should be the smallest group in your inventory, not the largest.
Handle Credentials and Recovery Deliberately
Authentication is only as strong as the way accounts are recovered. Check how each important account resets passwords, which email address or phone number receives recovery messages, and whether that contact point is itself protected by individual credentials. A recovery path that routes through a forgotten shared mailbox can undo every other precaution.
Store any emergency or backup access codes in a location separate from daily work, and make sure at least two trusted people know where they are. Record which accounts support multi-factor sign-in and which do not. Where a service offers stronger sign-in methods, evaluate them against your team's real workflow rather than adopting them blindly, because a method that locks out the only admin during a busy week creates its own risk.
Ask Vendors Specific Access-Control Questions
Before trusting a tool with company data, ask the provider direct questions and get the answers in writing. Useful ones include: How are user roles defined, and can permissions be limited to specific projects or data sets? How are departing users removed, and what happens to their content? Is there an audit log of administrative actions, and who can read it? How are sessions ended remotely? Where is customer data stored and who at the vendor can access it?
Treat vague answers as information. If a vendor cannot explain its access model in plain language, that gap matters more than any marketing page. Also confirm what the contract says, since product documentation and terms of service do not always match.
A Practical Checklist for This Month
Work through these steps in order. First, list every system holding company data and its account owner. Second, mark each account as individual or shared, and flag every shared login. Third, remove access for anyone who no longer needs it, starting with former contractors and unused invitations. Fourth, confirm that every administrative role is held by the fewest people possible, and that at least two people can perform recovery tasks. Fifth, check each recovery email address and phone number and confirm it is controlled by someone currently on the team. Sixth, send the access questions above to any vendor that handles sensitive information, and file the responses.
Repeat the inventory on a fixed schedule, such as once a quarter, and whenever someone joins, leaves, or changes role. Security basics are mostly routine maintenance. Teams that keep an accurate map of their access rarely face surprises when something goes wrong, and they are far better placed to respond quickly when it does.