Account security for a small team
Securing a small team’s accounts comes down to a few rules applied to everyone: one account per person, multifactor authentication on every account that offers it, separate administrator accounts, and access removed the day someone leaves. Name one person to own the job. Government guidance in the UK, Australia, Canada, and the US says much the same, and it is free.
How to secure a small team’s accounts
Every person you add brings a mailbox, a phone, a few shared folders, and logins nobody else knows about. This guide applies the five-step plan for your business accounts to a team of two to 20: the settings to turn on for everyone, the logins people share, and the day someone leaves. The UK’s NCSC sums up the spirit in its guide for small organizations: do not leave security to a single person, because it is everyone’s business.
The risk is ordinary rather than exotic. In the UK government’s Cyber Security Breaches Survey 2025/2026, 46% of small businesses and 42% of micro businesses with employees reported a breach or an attack in the previous 12 months, and phishing was the most common. In Australia, the ASD’s Annual Cyber Threat Report 2025–26 puts the average self-reported cost of a cybercrime for a small business at A$55,400.
What changes when you are more than one
A freelancer secures their own accounts. A team also has to decide who can do what: who holds the administrator role, who can approve a payment, who knows the password of the shared social media account, and who checks that a former employee no longer reads the shared inbox. Canada’s baseline controls ask for one person in a leadership role to be responsible for IT security, and Get Cyber Safe asks for at least one person handling it. Name that person, and give them a list to work from.
Personal devices count too. Cyber Essentials treats a personal laptop or phone that reaches company email or files as part of the business, while a phone used only for calls, texts, or an authenticator app stays out of scope. If your team works from its own devices, the same rules apply to them, starting with software updates and multifactor authentication on every work account they open.
Four rules that hold whatever your tools
The official guides of the four countries differ in their details, but they agree on these points:
- One account per person. Australia’s small business handbook says to create individual accounts for staff wherever possible; Canada’s baseline controls ask to reduce or remove shared accounts.
- Multifactor authentication on every account that offers it, starting with email. For administrators, NIST recommends phishing-resistant methods, such as passkeys and security keys.
- Separate administrator accounts, used only for administration, not for email or browsing. Cyber Essentials in the UK and Canada’s baseline controls both call for it.
- Access reviewed every few months and removed when someone leaves, as the NCSC and CISA advise.
Where to start
| Your situation | Start with |
|---|---|
| Nobody has a list of your accounts or who uses them | The team checklist |
| Your email runs on Microsoft 365 | The Microsoft 365 settings |
| Your email runs on Google Workspace | The Google Workspace settings |
| Several people use one login (info@, a social media page) | Shared logins and inboxes |
| Someone is leaving, or left recently | Closing access when someone leaves |
| A client or a tender asks for a certification | Government guidance and certifications |
| People click on anything | Free training for the team |
A checklist for the whole team
The account security checklist for small teams turns the official guidance into 15 steps you can assign, date, and review, with the source of each.
If your email runs on Microsoft 365
Microsoft 365 has its own baseline protections and administrator roles, and the right settings depend on your plan. The page on locking down Microsoft 365 for a small business covers them.
If your email runs on Google Workspace
Google publishes its own checklist for businesses of up to 100 users. Our guide to the Google Workspace settings that matter sorts it by priority for a small team.
Logins that several people use
The shared inbox and the company’s social media account are where passwords end up on sticky notes. See how to share an inbox or a login without sharing a password.
The day someone leaves
Closing access is easy to forget and hard to do in a hurry. Our checklist for when an employee leaves lists the accounts, devices, and codes to recover.
Certifications and free government guides
Cyber Essentials in the UK, the Essential Eight and its successor in Australia, the baseline controls in Canada, and the resources of CISA, NIST, and the FTC in the US are compared in free cyber security guidance by country.
Training the team
Free options range from a 30-minute module by the UK’s NCSC to a full course from Canada’s Cyber Centre. The page on free security awareness training lists them and suggests a first session.
More on securing your accounts
Each rule above has its own guide: choosing a password manager for the team, switching everyone to passkeys or a second factor, the scams aimed at small firms, and what to do if an account is taken over.