Start with the role
List the systems, customer information and records the person genuinely needs. Separate essential access from convenient access before accounts are created.
Data security
Give people the access they need—and no more.
A distributed team does not require relaxed security. Clear permissions, managed systems and consistent offboarding reduce risk wherever a person works.
Protect every login
- Create individual accounts rather than shared credentials
- Use a password manager
- Require multi-factor authentication
- Remove dormant accounts and review permissions regularly
Set device expectations
Decide whether work must occur on a managed device, through a cloud desktop or under a documented personal-device standard. Apply updates, screen locks, encryption and malware protection consistently.
Handle information deliberately
Document where files may be stored, which communication tools are approved, what may be downloaded and how confidential information should be discussed or transferred.
Plan offboarding early
Keep an access register. On the final day, disable accounts, rotate shared secrets, recover business records and equipment, and confirm continuing confidentiality obligations.
Review the real risk
Security should reflect the information and systems involved. Businesses handling regulated, health, financial or highly sensitive data should obtain specialist security and privacy advice.
These practical controls are general guidance, not a security certification or substitute for advice tailored to your systems and obligations.