Passwords and Access Control Inside Your Company: A Guide

Most company breaches do not start with a brilliant hacker. They start with a shared password, a login nobody switched off, or a guest Wi-Fi network that quietly reaches the servers. Access control is not an IT luxury — it is basic hygiene, like locking the office at night.

Never Share Accounts

A shared login destroys accountability. When five people use one "sales@" account, you cannot tell who sent the invoice, who deleted a file, or who approved a payment. Give every employee their own named account, even when two people do the same job.

Use a Password Manager and Unique Passwords

Reusing one password is the fastest route from a single leaked website to your entire business. A password manager creates and stores long, unique passwords for every tool, so nobody has to remember forty logins or keep them on a sticky note.

• One unique password per service — never reuse.
• Store everything in the approved company password manager, not in chats or email.
• Turn on two-factor authentication (2FA) for email, banking, cloud, and admin accounts.

Apply Least Privilege and Separate Admin Accounts

Give people the minimum access they need to do their work. A designer rarely needs admin rights over the billing system. Start narrow, then widen access only when there is a clear reason. Keep admin accounts apart from daily email accounts, and use them only when the task actually requires it.

Offboard Fast and Tame Guest Access

The day someone leaves, or changes role, is the day their access changes. Disable accounts the same day, move file ownership to a colleague, and collect devices. A dormant login is an open door. For visitors, put guest Wi-Fi on its own network, isolated from internal systems and printers.

Review Access Every Month

Once a month, write a clear list of who can reach what, and ask each manager to confirm it. This is how you catch the "temporary" access granted six months ago that was never removed.

• List every system and who can log in.
• Remove inactive or unknown accounts.
• Confirm admin rights are still justified.
• Check expiry dates for guests and contractors.

Common Mistakes to Avoid

One password reused everywhere, an admin account named "admin" with a simple password, and a person who left a year ago but still has an active login — these mistakes alone can open the door. At Q8DM we see the same patterns in small and large companies alike, and the difference is always the simple routine that gets followed consistently.

Need help organising your company access and training your team on safer habits? The Q8DM team works in software development, design, and training, and can help you build a clear, tight access routine. Start today at https://q8dm.com.