Skip to content
IT-Checklist

Identity & access: checklist and advice

Last updated: · IT-Checklist editorial team · All changes

In most break-ins at small businesses, the attacker simply logs in with a valid password. That password leaked from another service, was guessed or was caught with a phishing email. A technical flaw is usually not needed. Get your accounts right and you close the door attackers use most.

This topic covers who can get into your systems, how they prove who they are and how you remove access when someone leaves. Most of these measures are free. You can set them up in an afternoon.

Check where your business stands on identity & access

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

A hijacked email account is worth a lot to an attacker. From there they can reset passwords for other services, intercept supplier invoices and send payment requests in your company's name. Customers and suppliers trust a message that really comes from your address.

With shared accounts and forgotten access for former staff, it is almost impossible to find out afterwards what happened. You don't know who did what. You also can't lock out one specific person.

The 12 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We use multi-factor authentication (MFA) on all important accounts (email, accounting, cloud).

    Do first

    Enable MFA on at least your email, banking and cloud environment. This is the single most important measure against account takeover.

  2. We use a password manager and no reused or weak passwords.

    Important

    Choose a password manager (e.g. Bitwarden or 1Password) and let it generate unique passwords for every service.

  3. Every employee has their own account; no accounts are shared.

    Important

    Shared accounts make it impossible to see who did what and are hard to secure. Give everyone a personal account.

  4. When someone leaves the company, all access is revoked the same day.

    Important

    Create an offboarding checklist: block accounts, change passwords of shared systems, retrieve company data.

  5. Employees only have access to the systems and data they need for their job.

    Recommended

    Apply the principle of least privilege: minimal rights by default, admin rights only where truly needed.

  6. We have an up-to-date overview of all accounts, licences and who has access to what.

    Recommended

    Keep a simple overview (spreadsheet or tool) of all services, accounts and permissions. Review it quarterly.

  7. Administrator accounts are only used for admin tasks, not for daily work such as email and browsing.

    Important

    Give administrators two accounts: a regular account for daily work and a separate admin account. Malware arriving via email then has no admin rights.

  8. Access rights are reviewed at least once a year: who still needs access and who no longer does?

    Recommended

    Schedule an annual clean-up: review all accounts and permissions and revoke what is no longer needed. Former employees and old vendor access are a classic leak.

  9. Default passwords of new software, devices and online services are changed immediately upon first use.

    Recommended

    Default passwords (admin/admin, 12345) appear in public lists that attackers try automatically. Always change them before anything goes into use.

  10. We receive alerts on suspicious sign-in attempts (e.g. logins from abroad or outside working hours).

    Recommended

    Enable security alerts in Microsoft 365/Google Workspace and occasionally check the sign-in history. That way you spot an account takeover early instead of too late.

  11. We periodically review which apps and add-ins have been granted access via 'Sign in with Google/Microsoft' and revoke unused access.

    Recommended

    Check the security settings of Microsoft 365/Google Workspace to see which apps have access to your mail, calendar and files. A forgotten connection to a discontinued service is an unnecessary leak.

  12. Where possible, we use passkeys or hardware security keys instead of just a password.

    Recommended

    Passkeys and physical keys (e.g. YubiKey) are harder to phish than a password with an SMS code. Enable them for your most important accounts, starting with email.

Where to start

  • Turn on multi-factor authentication (MFA) today for your email, accounting software, bank and cloud storage. An authenticator app or passkey is better than text messages.
  • Pick one password manager for the whole company. Let it create a long, unique password for every service.
  • List every account and who has access. Go through that list whenever someone leaves.
  • Use a separate admin account for admin work only. Don't read email or browse the web with it.

Common mistakes

  • Turning on MFA for the main account and forgetting that old accounts, shared mailboxes or a second admin can still sign in without it.
  • Resetting a password or linking a new MFA device after one phone call or chat message, without checking who is asking.
  • Never reviewing which apps were once given access through 'Sign in with Google or Microsoft'.

Official sources

Read next

All topics in the checklist