Security Basics: A Practical Checklist for Small Teams Handling Shared Accounts
Most security incidents at small organizations do not begin with sophisticated attacks. They begin with ordinary habits: a shared password passed around in a chat thread, an account nobody remembers creating, or a former contractor who still has access to a folder. This article focuses on a narrow but high-value area, the accounts and credentials that a small team relies on every day. It covers general methods for getting control of them, along with questions to put to any vendor before you commit your data to its platform. The goal is not to promise any particular outcome, but to give you a repeatable way to think about risk.
Start with an inventory of accounts, not tools
Before buying anything or changing settings, write down every account that touches company business. Include email, file storage, code repositories, payment dashboards, social media profiles, domain registrars, and any admin consoles. Many teams discover at this stage that they have accounts registered to personal email addresses or to an employee who has since left.
For each account, record four things: who owns it, who currently has access, what recovery method is set up, and what would happen if the account were locked or lost. The last question is the most revealing. If the honest answer is that nobody knows, that account is your first priority. An inventory is a living document, so assign someone to review it on a regular schedule rather than treating it as a one-time exercise.
Separate individual identities from shared credentials
Shared logins are convenient and difficult to secure. When five people use the same password, you cannot tell who did what, you cannot revoke one person's access without changing the password for everyone, and the password tends to be written down in places it should never be. Whenever a platform allows it, give each person their own account with their own credentials and assign permissions by role.
Where a shared account is unavoidable, such as a legacy administrative login, store its credentials in a dedicated password manager with access limited to the people who genuinely need it. Rotate the credential when someone with access leaves. Keep a short written note of who holds access so that offboarding does not depend on memory.
Build sign-in habits that hold up under pressure
Good habits matter most when someone is rushed. Use unique passwords for each service so that one leaked credential does not open every door. Prefer a password manager to memorized strings, and enable multi-factor authentication on every account that offers it, choosing app-based or hardware methods over text messages where the option exists.
Teach staff to recognize the typical pattern of a phishing attempt: an urgent request, a link that asks for a login, a sender who pressures you to skip normal verification. A useful team rule is that any request involving money, credentials, or access changes gets confirmed through a second channel, such as a phone call to a known number or a message in an existing thread, before anyone acts.
Ask vendors specific questions before trusting them
When evaluating a provider for storing business data or running important accounts, a short list of direct questions will tell you more than marketing language. Ask how accounts are protected and whether multi-factor authentication is supported and enforceable for all users. Ask who within the company can access your data and under what circumstances, and how access is logged. Ask how you would export your data if you decided to leave.
Ask about recovery as well. What happens if an administrator loses access? Is there a documented process, and how long does it take? Request written answers for anything that matters to your operations. If a vendor cannot or will not explain these points clearly, treat that as information in its own right. Do not assume that a feature exists because it sounds standard; confirm it in the vendor's own documentation or contract.
A simple checklist for the next thirty days
Week one: complete the account inventory and identify every shared credential. Week two: enable multi-factor authentication on email, file storage, and any financial or administrative accounts, and remove access for anyone who no longer needs it. Week three: move shared credentials into a managed password store and set a rule that every new service gets a unique login tied to a named person. Week four: review vendor answers to the questions above, write down what you learned, and schedule the next review.
Security basics are not glamorous, but they are cumulative. A small team that knows what accounts it has, who controls them, and how to recover from a lockout is far better positioned than one that relies on hope. Revisit the checklist each quarter, and treat every new tool or account as an opportunity to apply the same discipline from the start.