IT & Technology Guide

Published: 2026-10-30 · Reviewed: 2026-11-04

Access Control: Who Gets What

Every business has the same quiet problem: people accumulate access. The new starter gets email, the shared drive, the accounting system, the CRM, the admin panel, and five years later they’ve changed roles twice, but nobody ever took anything away. Multiply that by every employee and you have a business where far more people can see and change things than should be able to.

Access control is the unglamorous discipline of deciding who gets what, writing it down, and taking it back when it’s no longer needed. It’s the single most effective security measure a small business can take, and it costs nothing but consistency.

Why This Matters

Most security incidents in small businesses aren’t sophisticated attacks. They’re someone logging in with credentials they shouldn’t still have, or seeing data they have no business seeing, or a former employee’s account being used months after they left. Every one of these is an access control failure.

There’s also the trust angle. If you handle customer data, financial records, or employee information, your clients and staff assume you’re controlling who can see it. “Everyone in the office has the admin password” is a breach of that trust waiting to become an incident.

And practically: when something goes wrong, the first question is always “who had access?” If you can answer it from a record, you investigate in hours. If you can’t, you investigate in weeks, or never find out.

Key Concepts

Least privilege. Everyone gets the minimum access they need to do their job, nothing more. The marketing assistant doesn’t need the payroll system. The contractor doesn’t need the full customer database. This isn’t about distrust; it’s about limiting damage. If an account is compromised, least privilege limits what the attacker can reach.

Access request and approval. Access should be granted through a simple process: the person (or their manager) requests it, someone with authority approves it, and the grant is recorded with a date. No informal “can you just give me access to that?” over chat. The record is the point, it’s what makes access reviewable later.

The joiner-mover-leaver cycle. People join, change roles, and leave. Each transition needs an access action: joiners get set up, movers get adjusted (new access added, old access removed, the removal is the part everyone forgets), leavers get revoked, promptly. A checklist for each transition makes this reliable.

Shared accounts are a problem. “We all use the same login for the supplier portal” means you can’t tell who did what, and when someone leaves you have to change the password everywhere. Individual accounts are better. Where shared accounts are unavoidable, document who knows the credentials and change them when anyone on the list leaves.

Passwords and authentication. Access control assumes the front door works. Use unique passwords, enable multi-factor authentication wherever it’s offered (especially email, email is the master key to everything else), and have a process for password resets that’s logged, not improvised.

Regular reviews. Access drifts. Review who has access to what at least twice a year. Compare the access list against the current staff list and current roles. Remove what doesn’t belong. This review is where you catch the accumulated excess.

Practical Steps

1. List your systems and who can access them. Start with the important ones: email admin, accounting, payroll, CRM, cloud storage, anything holding customer data. For each, list who has access and at what level. This audit is step zero, you can’t control what you haven’t mapped.

2. Introduce the access request form. From today, every grant of access goes through the form: name, system, level of access, business reason, approver, date granted. Keep the completed forms. This one habit transforms access from invisible to visible.

3. Build the joiner checklist. New starter: create accounts, grant role-appropriate access, issue devices, brief on password and security basics. Use a checklist so it’s the same every time and nothing is missed. Get it done on day one, people locked out of systems on their first day is a bad start.

4. Build the leaver process. This is the one that matters most. When someone leaves: disable accounts the same day (or immediately for dismissals), revoke system access, collect devices, change shared passwords they knew, remove them from mailing lists and groups. Write it as a checklist and assign an owner. Same-day revocation is the standard to aim for.

5. Handle role changes. When someone moves teams or gets promoted, review their access: add what’s needed for the new role, remove what’s no longer needed. The removal half is critical, it’s how access accumulates.

6. Enable multi-factor authentication. Start with email and any system holding customer or financial data. MFA is the highest-value security control available to small businesses, it defeats the most common account-takeover attacks even when passwords are stolen.

7. Review access twice a year. Pull the access records, compare against current staff and roles, and clean up. Ask of every grant: does this person still need this? Document the review. It takes an afternoon and it’s the difference between controlled access and accumulated access.

Common Mistakes

Granting access informally. “Just give them the login” bypasses the request, the approval, and the record. Every informal grant is a future mystery, nobody will remember why that person has access or who approved it.

Forgetting leavers. The single most common access failure. Audit your accounts against your payroll or staff list regularly. Every active account should map to a current person with a current reason.

Admin rights for everyone. Making every user a local admin “so they can install things” removes the barrier between a compromised account and full system control. Standard accounts for daily work; admin rights only where genuinely needed.

Never reviewing. Access granted in 2023 for a project that ended in 2024 is still there in 2026 unless someone reviews. The twice-yearly review is non-negotiable.

Shared passwords that never change. The Wi-Fi password from 2021 known by forty people including twelve who’ve left. Change shared credentials when anyone with knowledge of them leaves, and on a schedule regardless.

No record of who approved what. When the auditor, the client, or the investigator asks “who authorised this access?”, “I think Dave said it was fine” is not an answer. The approval on the form is the answer.

Treating access control as IT’s job alone. Managers need to tell IT when their team members change roles or leave. IT can’t revoke access it doesn’t know about. Make managers responsible for notifying, and IT responsible for acting.

Relevant Templates