Protect team accounts with clearer access rules

A team account becomes difficult to protect when nobody knows who owns it, who still has access or how to recover it. Start by making those responsibilities visible. Better everyday access habits need both technical controls and a process people can follow.

Build a short access inventory

List the services your team relies on: business email, file storage, customer systems, website administration and payment services. Record the business owner, the administrator and the recovery method for each. Keep this inventory in an approved location; do not turn it into a document containing passwords and recovery codes.

Look for shared logins, former staff accounts and tools registered to a personal email address. Prioritize accounts that can reset other accounts or control sensitive business information.

Use separate identities and a password manager

Give people their own accounts wherever the service allows it. Assign the access required for their work and review administrator privileges separately. When a shared credential is unavoidable, use an approved business password manager with controlled sharing rather than sending the password in a message.

Use strong, unique passwords and an approved password manager. Unique credentials for different services help prevent one exposed password from automatically opening other accounts.

Add multifactor authentication

MFA asks for an additional factor beyond a password. Prefer phishing-resistant methods where available. Ask your IT administrator which supported option fits your services and devices.

Do not approve an unexpected sign-in prompt. Report it using your team's agreed route. Store recovery material securely and separately from the everyday login, with access limited to authorized people. Make sure a lost phone does not leave the business dependent on one person's memory.

Make changes predictable

When someone joins, define which systems they need and who approves each role. When responsibilities change, remove unnecessary access as well as adding new rights. When someone leaves, use a checklist for account removal, shared credential changes where relevant and transfer of business records.

Set an owner and an internal deadline for these actions. A written process that nobody is responsible for completing leaves the same gaps as having no process at all.

Rehearse recovery safely

Choose a non-critical account and review the provider's documented recovery options. Confirm that recovery email addresses and administrator contacts are current. Do not disable protections on a critical service merely to see what happens.

For your next team check, ask three questions: can we identify the owner, can we remove access promptly and can an authorized person recover the account? If an answer is unclear, resolve that gap before adding more tools.

Sources: CISA: Secure Our World — Passwords tip sheet; CISA: Require Multifactor Authentication.