Back to Who has access

To keep a copy, print this page or save it as a PDF from your browser.

Salmini Checklist1 page

Data Security · Who has access

Who has access checklist

Who leads Whoever looks after digital security Name

Use it when

someone is joining or leaving, or it's time for the check every three months.

On someone's first day

Their accounts set up with them, with access to what their role needs and no more.
A password manager and two-factor on every account.
Added to the access list, and their devices to the backup list.
An end date for volunteers and short-term staff.

On their last day

Access ended: accounts, shared folders, group chats, admin roles.
Every shared password they knew changed.
Their files moved to the organisation before the account closes.
Their email kept open for two or three months, with a reply saying who to contact.
Laptops, phones, keys and backup drives collected.

Every three months

The access list checked against who’s still with you, and who has admin rights.

Notes

Take care: Do it with them, as a normal part of leaving, so it never feels like suspicion.

Started Done Review again