Who has access

Achieng, a field researcher at a health rights group in Kisumu, keeps her interview recordings in the team’s shared drive, next to the newsletter, the budgets and the phone numbers of community members. Everyone on staff can open all of it, and so can two volunteers from last year’s survey. When Achieng asks who actually needs the recordings, the answer is three people. Nobody decided it that way. Access piled up, one shared folder at a time.

Whoever gets into one of those accounts, or picks up one of those laptops, can see all of it. Even a strong account password doesn’t protect what’s on a laptop or a backup drive that isn’t encrypted (SAFETAG). People who’ve left, volunteers from a past project and partners can keep access long after they need it (SIIRF). Your risk assessment shows what matters most; this guide is about who can reach it.

Sort what you hold by how sensitive it is

Sensitive information is anything that could hurt people, or your work, if the wrong person saw it. A simple scale helps everyone treat it the same way. Holistic Security suggests three levels (Holistic Security):

• Secret: only named people can see it, such as interview recordings or case files.
• Confidential: not for the public, but anyone on staff can see it, such as meeting notes.
• Public: fine for anyone to see, such as a published report.

Agree as a team what goes where, because people don’t always see the same things as sensitive (SAFETAG). Three things to watch:

• Combinations. Details that seem harmless alone can identify someone together: an issue and a town, or a place, a date and an activity (SAFETAG).
• Change over time. Material for a report can be secret while you gather it and public once it’s published (Holistic Security).
• The people you serve. Their personal details need the most care: know what you hold about them, limit who can see it and collect only what you need (SIIRF). The law often adds duties. Kenya’s, Uganda’s and South Africa’s data protection laws, for example, all give health details extra protection.

Who should see what

For each kind of information, ask who needs it to do their job, and give access to them alone (SAFETAG; SIIRF). Name people rather than “everyone”.

• Staff: set up shared folders by who needs them, so a new colleague gets the right ones on their first day (NDI). Sharing files and cloud storage covers folders and links.
• Volunteers and short-term staff: only what they need, for as long as they need it (SIIRF).
• Partners: only what you’ve agreed to share, with a note of what you shared and why (SIIRF).

The access list

The access list is a one-page record of who can open what. For each kind of information, or each shared folder and account, it notes how sensitive it is, where it lives, who has access and who needs it (SAFETAG). Wherever “has access” and “needs access” differ, you’ve found something to fix (SAFETAG). Deleting data safely adds one more column: how long you keep it.

Keep the list somewhere safe and encrypted: it’s a map of what matters most and where to find it (SAFETAG).

Admin rights

Admin rights let someone reach everything in an account or on a device, change its settings and add or remove people. Whoever holds them can undo everything else in this guide, so:

• Keep them to a few named people, and at least two, so one person leaving or getting locked out doesn’t lock out the organisation (Access Now; SIIRF).
• Do everyday work in an ordinary account, and use the admin one only when you need it (SAFETAG). Phones and laptops shows how on a laptop.
• Keep the top admin account in the organisation’s hands. If an outside IT provider set up your email or drive and still holds it, that gives an outsider control of your systems (Access Now). Email security covers this for your email.
• Check the list of admins against who should have them, and suspend accounts nobody uses (Access Now).

Social media Pages have their own version, called full control: see Social media accounts.

Joining and leaving

Joining and leaving are the two moments when access changes most, so give each a short checklist and use it every time (NDI; SIIRF).

On someone’s first day

• set up their accounts with them, with access to what their role needs and no more
• set up the team’s basics on every account: a password manager and two-factor authentication
• add them to the access list, and their laptop and phone to the backup list
• for volunteers and short-term staff, set an end date for their access when you give it (SIIRF)

On their last day

• end their access to accounts, shared folders, group chats and admin roles (SIIRF)
• change every shared password they knew (Shared accounts)
• move the files they own to the organisation before their account is closed, since deleting an account can delete its files (Access Now)
• keep their email open for two or three months with a reply that says who to contact, then close it (Access Now)
• collect laptops, phones, keys and any backup drive; Deleting data safely covers wiping a device before it’s used again

Do it with them, as a normal part of leaving, so it never feels like suspicion.

Bringing your team with you

1. Map it together once. Run the exercise in “Teach it to your team” below, then write the result up as your access list.
2. Start with your own access and the director’s, so the review isn’t about anyone in particular.
3. Fix the biggest gap first, such as an old account still open, a volunteer who can see everything or a folder open to anyone with the link (SIIRF).
4. Sit one to one with whoever runs each account, such as the finance officer for the bank and whoever posts for the organisation on social media, and check who’s in it.
5. Keep a chat for questions. “Should the new volunteer see this folder?” is easier to ask than to guess.
6. Use the two checklists every time someone joins or leaves.
7. Check the list every three months against who’s still with you and who has admin rights (SIIRF; Checklists and audits).

If it’s already happened

If someone who left still has access, or a folder turns out to be open to people who shouldn’t see it:

• remove the access, and change any shared passwords they knew (Shared accounts)
• check what they could open and, where your service keeps a record, whether anything was opened or downloaded (SIIRF)
• if personal details may have got out, follow SIIRF’s Data Breaches playbook: stop the leak, work out whose data it was and put their safety first
• if an account has been taken over, go to Account taken over

No one needs to be blamed: access builds up as people come and go.

Teach it to your team

This takes about 30 minutes. It’s a shorter version of SAFETAG’s hour-long Sensitive Data activity (CC BY-SA 3.0), which builds on LevelUp’s Backup Matrix.

• Prepare: sticky notes, pens and a wall or a large sheet of paper. Across the top, write the places your information lives: laptops, phones, email, the shared drive, USB sticks, paper. Down the side, write Secret, Confidential and Public.
• Exercise: everyone writes one kind of information per note (case files, budgets, contact lists) and puts it under the place it lives, at the level they think it belongs. Where people disagree, talk it through. Then take the column with the most Secret notes and ask: what if this were lost? What if someone hostile had it? Is there a backup? Who can open it, and who needs to?
• Three questions: What makes information secret rather than confidential? Who should get into a folder, and for how long? What happens to someone’s access on their last day?
• Afterwards: type the result up as your access list and destroy the notes (SAFETAG). Follow up one to one with whoever runs each account, and keep answering questions in the team chat.