Part 1 — Who Has Access to Your Business?
Access, Authority, and Accountability
The Keys You Cannot See
Small business owners routinely make decisions about who is allowed to enter certain parts of the business and what those people are allowed to do once they are there. An employee may receive a key to the front door because opening the business is part of the job. A manager may know the alarm code. Someone responsible for deposits may have access to the safe. Another employee may be allowed into a storage area that is restricted to everyone else. We make these distinctions because physical access carries authority, and we generally understand that not everyone needs access to everything.
When an employee leaves the company, those physical permissions usually receive attention. Keys are collected. Alarm codes may be changed. Company equipment is returned. The reason is fairly obvious: if the person's responsibility to the business has ended, there is usually no legitimate reason for that person to continue having the same physical access they had while performing the job.
Digital access should be viewed in much the same way, but I believe it is often much harder for a small business owner to see. There may be no physical key to collect and no obvious door to lock. Instead, access may exist across dozens of accounts, applications, devices, and services that have gradually become part of everyday operations.
An employee may have access to company email, accounting software, customer records, shared cloud storage, scheduling systems, payroll, social media accounts, vendor portals, or other applications. A bookkeeper may have access to financial records or banking information. A marketing contractor may have administrative rights to the company website or social media pages. An outside technology provider may be able to remotely access computers or make changes to systems that most employees cannot. In each case, the person has been given some level of authority inside the business, even though that authority may never have been described in those terms.
Most of those permissions were probably granted for a legitimate reason. Someone needed to perform a task, solve a problem, complete a project, or keep the business moving. The question is whether the business still understands who has access, why they have it, what that access allows them to do, and whether they still need it.
That last part is where access can become difficult to manage. Physical keys are usually visible. Digital permissions are not. An employee can change positions without anyone reconsidering the systems they used in the previous role. A contractor can finish a project while their account remains active. Someone can be added as an administrator to solve a short-term problem and still have that authority several years later. The business may continue operating normally, so there may be no obvious reason to question any of it until something happens.
Last week, I discussed cybersecurity as a business continuity issue and asked owners to consider what would happen if something the business depends on suddenly became unavailable. That conversation focused largely on understanding the systems, information, and technology that have become important to daily operations. Once a business begins identifying those dependencies, I believe another management question naturally follows:
Who has the ability to do something inside those systems?
That is a much broader question than asking who knows the password. Access may allow someone to view information, change it, download it, delete it, approve a transaction, transfer money, create another user, modify security settings, communicate publicly in the company's name, or change something that affects how the business operates. In some systems, access may simply allow a person to perform one routine task. In others, it may provide significant authority over a critical part of the company.
Thinking about access in those terms changes the cybersecurity discussion. We are no longer talking only about keeping an unknown attacker outside the business. We are also talking about understanding the authority we deliberately give employees, managers, contractors, vendors, and other people who legitimately need to work inside it.
That is why I do not view access control as simply an information technology responsibility. Technology may provide the tools used to grant, restrict, monitor, or remove access, but the decision about who should be able to do what inside the business is ultimately a management decision.
Access Is Authority
Cybersecurity uses several terms that sound similar but describe different parts of the same process, and I think understanding the difference helps business owners make better decisions about access.
Authentication is the process of verifying identity. In simple terms, the system is asking, Are you really who you say you are? A password, passphrase, one-time code, fingerprint, security key, or another authentication method helps the system decide whether the person attempting to sign in is legitimate.
Authorization comes after identity has been verified. Authorization determines what that authenticated person is allowed to see, use, change, approve, or control once they are inside the system. North Star defines an authorized user as someone who has been authenticated and granted defined permissions to use a system or resource.
That distinction matters because being allowed into a system is not the same thing as being given unrestricted authority within it. A business may have several employees who legitimately need to use the same application, but that does not mean every employee needs the ability to perform every function the application provides.
Consider an accounting platform used by several employees. One person may need to create invoices and record customer payments. Another may enter expenses or reconcile transactions. A manager may need access to financial reports in order to monitor performance. Someone else may process payroll. The owner or controller may need a much broader level of authority, including the ability to change banking information, approve certain payments, create or remove users, adjust permissions, or modify security settings.
Every one of those people may have a legitimate reason to access the accounting system, but the business risk changes depending on what each person is allowed to do after signing in. An employee who can create an invoice has a very different level of authority from someone who can change the bank account where payments are deposited. A person who can review financial reports has a different responsibility from someone who can create another administrator or change the permissions assigned to other users.
This is why access should not be thought of as a simple yes-or-no decision. The more useful question is not merely whether someone should have access to a system, but what that person needs to be able to do once access is granted.
The same principle applies throughout the business. Someone responsible for social media may need permission to create, edit, and schedule posts, but may not need the ability to remove the business owner from the account or transfer control of the page. An employee who reviews a customer schedule may need to see appointments and update their status, but may not need the ability to export the entire customer database. Someone processing payroll may legitimately need access to employee compensation and tax information, while another manager may need only scheduling or attendance information.
Those distinctions become increasingly important as software becomes more capable. Many business applications no longer perform only one task. A single platform may contain customer information, payment information, employee records, financial data, communication tools, administrative controls, and integrations with other systems. Giving someone access to the platform without considering the permissions inside it may provide substantially more authority than the owner intended.
This is where cybersecurity concepts such as need to know, least privilege, and role-based access become useful.
Need-to-know access means that information is made available to the people who actually require it to perform their duties. The principle of least privilege applies the same idea more broadly by limiting users and systems to the minimum level of access necessary to complete their assigned tasks. Role-based access helps put those principles into practice by assigning permissions according to a person's role or responsibilities within the organization rather than giving everyone the same level of authority.
For a small business, none of those concepts has to become overly complicated. The owner does not need to create dozens of permission categories simply because the software allows it. The objective is to make deliberate decisions about authority.
If an employee's job requires the ability to create invoices, give the employee the ability to create invoices. If the job does not require changing banking information, there may be no business reason to provide that permission. If a marketing contractor needs to post content, provide the access necessary to post content without automatically granting ownership-level control over the account. If a manager needs reports in order to make decisions, the manager may not also need authority to change the underlying security settings.
The benefit extends beyond cybersecurity. When people are given the access appropriate to their work, it becomes easier to understand who is responsible for a particular function, who has authority to make certain changes, and where the business has intentionally limited that authority.
That is the business principle underneath these cybersecurity terms.
Access should follow responsibility.
If an employee is responsible for performing a function, that employee should have enough access to perform the work effectively. Giving substantially more access than the job requires does not necessarily improve productivity. It may only expand what can be affected if the account is compromised, the employee makes a mistake, or the authority is misused.
Employees should not have to fight through unnecessary restrictions every time they need to work. Access should match responsibility closely enough that people can perform their jobs effectively without quietly receiving substantially more authority than the work requires.
Trust and Control Are Different Questions
Access can be uncomfortable to discuss because business owners may interpret restrictions as a statement about trust. When someone suggests limiting permissions, reviewing accounts, or removing access that is no longer necessary, the immediate reaction may be, “I trust my employees,” “I have known my bookkeeper for years,” “My nephew manages the website,” or “That contractor has worked with us forever.”
Those relationships matter. Trust matters in every business, particularly in a small business where employees, owners, contractors, and professional advisors may work closely together for many years. Access control, however, is not fundamentally about deciding whether someone is trustworthy. It is about deciding how much authority a person needs to perform a particular responsibility and limiting the consequences if something goes wrong.
That distinction becomes important because cybersecurity incidents do not always begin with someone intentionally trying to harm the business. People make mistakes. Passwords are stolen. Devices are lost. Accounts are compromised. An employee may click a link that appears legitimate, send information to the wrong person, leave a laptop somewhere it should not have been left, or make a change inside a system without realizing what else the change will affect. Someone with legitimate access can also have their credentials stolen, allowing another person to operate inside the business using an account the company already trusts.
North Star's discussion of insider threats reflects this broader reality. An insider threat is not limited to a malicious employee deliberately stealing data or damaging systems. A person with authorized access can create a cybersecurity problem maliciously, negligently, or accidentally. I think the words negligently and accidentally deserve particular attention because they describe situations small businesses are far more likely to encounter than the dramatic image many people associate with an “insider threat.”
A disgruntled employee intentionally taking customer records before leaving the company is certainly a risk, but so is an experienced employee sending a confidential attachment to the wrong email address. A trusted manager can reuse the same password across several services and unknowingly expose a business account when one of those other services is compromised. A longtime employee can lose a laptop containing customer information. A well-meaning person with administrator privileges can change a system setting in an attempt to solve one problem and accidentally create another. None of those situations requires dishonesty, and none of them means the business was wrong to trust the individual.
What changes the potential impact is the amount of access the person or account possesses. If an employee accidentally opens a malicious attachment, the consequences may be very different depending on whether that account can access only the files required for the employee's job or whether it can reach nearly everything the company maintains. If a contractor's credentials are compromised, the damage may depend on whether the contractor was given access only to the website being maintained or was also given administrator rights to email, cloud storage, customer information, or other systems simply because doing so was convenient at the time.
This is why unnecessary access matters even when every person involved is trustworthy. Limiting access does not eliminate mistakes, stolen credentials, or poor decisions, but it can limit how far the consequences travel when one of those things occurs. In that sense, access control is not simply about preventing an employee from doing something wrong. It is also about preventing one compromised account, lost device, mistaken action, or stolen password from affecting more of the business than necessary.
I think ordinary financial controls provide a useful comparison because most business owners already accept this principle in other areas of management. An owner may completely trust an employee and still require receipts for business purchases. The owner may have worked with the same bookkeeper for fifteen years and still reconcile bank statements. A manager may be trusted to purchase routine supplies but not have authority to borrow money in the company's name, change banking information, or sign a major contract without additional approval.
Those controls do not automatically suggest that the employee, manager, or bookkeeper is dishonest. They establish boundaries around responsibility and authority. They also protect everyone involved. If a question later arises about a payment, purchase, change, or approval, the business has a clearer understanding of who had the authority to perform the action and what controls were supposed to apply.
Cybersecurity access controls serve much the same purpose. Giving someone only the access required for the work does not mean the company distrusts that person. It means the company has decided what authority belongs to the position and has created reasonable boundaries around it. Those boundaries can protect the business from fraud, but they can also protect it from mistakes, compromised credentials, misunderstanding, and situations where an employee is blamed for an action that could have been performed by several people using the same unrestricted account.
They can also protect the employee. If a person's account is limited to the systems and functions necessary for the job, there is less opportunity for someone who compromises that account to use it elsewhere in the business. Clear access boundaries also make it easier to determine whether an activity actually falls within that employee's normal responsibilities.
For that reason, I do not think the right access-control question is, Do I trust this person? A business can trust someone and still decide that the person's job does not require unrestricted authority.
The better question is whether the business needs that level of access to exist.
When access decisions are based on business need rather than personal relationships, the discussion becomes much easier. The owner is no longer making a judgment about someone's character. The owner is defining the authority required to perform the work, deciding what should remain outside that authority, and reducing unnecessary exposure for both the individual and the business.
Access Accumulates Quietly
Digital access is easy to overlook because it usually does not appear all at once. Most businesses do not sit down one morning and decide to give an employee access to ten different systems. Instead, permissions are added gradually as the employee's responsibilities change and the business finds new ways to use technology.
An employee may begin with nothing more than company email. A few weeks later, someone adds that employee to a shared drive because they need access to a particular document or folder. Later, they may receive access to scheduling software because they are helping coordinate appointments. Six months after that, they begin assisting with social media and are added to another platform. Eventually, they are promoted, take on additional responsibilities, and receive access to reports, payroll information, accounting functions, customer records, or administrative settings.
Every one of those decisions may have made perfect sense at the time. The employee needed access to perform a legitimate task, and someone granted it so the work could get done. In a growing small business, that is often how access develops. Responsibilities evolve, people step into new roles, and owners make practical decisions based on what the business needs at that moment.
A promotion provides a good example of how access can keep expanding without being reconsidered. When an employee moves into a management position, the business may add permissions associated with the new job, but nobody goes back to ask whether everything from the employee's previous position is still necessary. The new access is layered on top of the old access. After several years and several changes in responsibility, that person may have permissions scattered across systems that have little or nothing to do with the work they currently perform.
The same thing happens outside the employee relationship. A contractor may receive administrative access to the company website while completing a redesign. A consultant may be given access to shared files for a temporary project. An accountant may be added to an accounting platform during tax season. A marketing company may receive access to social media and advertising accounts. A technology provider may be given remote access to computers while troubleshooting a problem.
None of those decisions is necessarily a problem. The access may have been entirely appropriate while the work was being performed. The concern is what happens after the work is finished, because temporary access can quietly become permanent access if nobody goes back and removes it.
Over time, businesses change. Employees change jobs. Responsibilities shift. Temporary projects end. Contractors finish their work. Vendors are replaced. Employees leave. Software is replaced. New platforms are adopted while old ones remain active for a while. Each change creates another opportunity for the business's actual access environment to become different from what the owner assumes it is.
The difficulty is that unused access often does not create an obvious problem. A former contractor's account can remain active for two years without anyone noticing because the contractor never signs in. A former employee can still be listed as an administrator on a social media account while the business continues operating normally. An employee may retain access to payroll information after moving into a position that no longer requires it, and nothing happens to draw attention to the permission.
That absence of an immediate problem can make old access appear harmless. The business may reasonably think, They aren't using it, so why does it matter? The concern is that the permission still exists. If the old account is compromised, reused, or accessed later, the system may have no way of knowing that the business no longer intended for that person to have authority. From the system's perspective, an active account with valid credentials is still an active account.
Cybersecurity professionals sometimes refer to the gradual accumulation of unnecessary permissions as access creep. The terminology itself is less important than the business problem it describes. Access tends to expand naturally as people are given new responsibilities, but it rarely contracts with the same consistency unless someone deliberately reviews and removes what is no longer needed.
Periodic review matters because access tends to expand more naturally than it contracts. The immediate question is whether the permissions that exist today can still be tied to a current business reason, not whether the owner can reconstruct every access decision the company has ever made.
Current employees deserve the same attention as former employees and contractors. Someone who has worked for the company for ten years may have accumulated permissions from old roles, temporary projects, and systems they no longer use. A former employee may have one stale account; a longtime employee may have several permissions that simply followed them from job to job.
Finding outdated access during a routine review is not evidence that the business has failed. It is usually evidence that the business changed faster than its permissions did. The point is to recognize that access has a lifecycle and that authority which no longer serves a current responsibility is still authority.
Shared Accounts Trade Convenience for Accountability
Shared accounts are common in small businesses because they are convenient. If several employees perform similar work, it may seem easier to give everyone the same username and password rather than create and manage individual accounts. One set of credentials is easier to remember, new employees can begin using the system immediately, and the business does not have to spend time deciding which person should receive which permissions.
The weakness in that convenience appears when the business needs to know who actually did something. Suppose five employees use the same username and password to access a system and an important setting is changed. The business may be able to see that the shared account made the change, but that does not necessarily identify which employee was using it at the time. If a customer record is deleted, financial information is altered, or a transaction is approved, the same problem appears. The system may know which account performed the action without being able to tell the business which person was behind the account.
This is where the loss of accountability becomes important. If several people use the same credentials, their activity can become indistinguishable from one another. When everything is working normally, that may not seem particularly important. When a mistake occurs, an unusual transaction appears, a customer asks what happened to a record, or the business suspects that an account has been compromised, the ability to determine who performed a particular action can become extremely valuable.
North Star includes the concept of non-repudiation, which deals with the ability to track actions within a system so they can be attributed to the person who performed them. The terminology may sound technical, but the business principle is straightforward. If individuals use their own accounts, the business has a better opportunity to connect activity to a specific person. That makes it easier to understand what happened, correct mistakes, investigate unusual activity, and determine whether a problem came from an employee, a compromised account, or some other source.
Individual accounts can also protect employees by reducing ambiguity. If several people share one username and something goes wrong, everyone who knows the password may immediately become part of the question. If employees use individual accounts, the business has a clearer record of who was actually logged in and what actions were associated with that account. Accountability is not only about finding fault. It is also about avoiding unnecessary suspicion and creating a more accurate record of what happened.
The same distinction becomes important when someone leaves the company. Imagine Maria, David, and Chris all work in the same department and each person has an individual account. Maria leaves the company. Her account can be disabled while David and Chris continue working with no change to their own access. The business can remove Maria's authority without disrupting the other employees or requiring anyone else to learn a new password.
Now imagine that Maria, David, and Chris all use the same username and password. When Maria leaves, the business cannot simply disable her individual access because no individual access exists. To truly remove her ability to sign in, someone has to change the shared password and then communicate the new credentials to David, Chris, and everyone else who legitimately uses the account.
That process may happen immediately, but it may also be postponed. The password still works. Everyone is busy. Changing it means notifying several people and possibly updating saved credentials on multiple devices. The business may decide to deal with it later, and later can easily become weeks or months. During that time, the former employee may still know a valid password that provides access to the business.
This is one of the ways shared accounts can quietly work against good access management. What saved the business a few minutes when access was originally created can make removing access much more complicated later.
Shared credentials can create another difficulty when a password itself is compromised. If one employee's computer is infected, credentials are entered into a phishing site, or the password is reused somewhere else and later exposed, the business may know that the shared password is at risk without knowing how it happened. Because several people use the same credentials, it can be much harder to determine which device, action, or user was associated with the original exposure.
The business may also have to change the password for everyone at once, even if only one person's activity created the problem. That can turn a single compromised credential into an interruption for an entire group of employees.
There is also a practical difference in how permissions are managed. With individual accounts, the business can grant, change, or remove access for one person without affecting everyone else. A manager can receive additional authority without automatically giving that authority to every employee in the department. Someone working on a temporary project can receive access for the duration of that work and have it removed afterward. The business has more flexibility because access is connected to the person rather than to a shared set of credentials.
None of this means shared accounts are always avoidable. Some older systems may not support individual users. Certain applications may charge additional fees for every account. A small business may also encounter a device, service, or piece of equipment that simply was not designed with individual credentials in mind.
Small businesses operate within real financial and technical limitations, and the goal is not to pretend those limitations do not exist. The important thing is for the owner to understand the tradeoff being made.
If a shared account has to be used, the business should recognize that it is giving up some ability to identify who performed specific actions and making individual access harder to remove. That may be an acceptable tradeoff for a low-risk system. It may be much less acceptable for accounting, payroll, banking, customer records, administrative controls, or other systems where knowing who did what is particularly important.
The question, then, is not simply whether shared access is easier. In many cases, it clearly is. The better question is whether the convenience is worth the loss of accountability and control in that particular system.
Convenience has value in a small business, especially when time and staff are limited. Accountability has value too. Good access management means understanding where the business is trading one for the other and making that trade deliberately rather than by default.
Where the Conversation Goes Next
Understanding who has access, why that access exists, and whether it still makes sense gives the business a much clearer picture of its digital authority. But not every account carries the same level of risk. Some users can perform only routine tasks, while others may be able to create accounts, change permissions, move money, reset passwords, or control the systems themselves.
In Part 2, we will look more closely at those higher levels of authority and at the tools used to protect them. That includes administrative access, passwords, multifactor authentication, and the growing use of passkeys. We will also look at why stronger authentication is important, but still does not solve the problem of access that should no longer exist.
References:
America’s SBDC North Star Cybersecurity Program. Definitions Document, FY 2026 Supplemental Training Materials. Definitions used in this article include authentication, authorization, authorized users, insider threats, need-to-know access, non-repudiation, least privilege, and role-based access.
America’s SBDC North Star Cybersecurity Program. Cybersecurity Best Practices, FY 2026 Supplemental Training Materials. Guidance includes reviewing access controls, limiting access according to business need, assigning responsibilities, and protecting business-critical systems.
National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0. Provides the broader risk-management framework underlying the North Star cybersecurity materials.
Part 1 — Who Has Access to Your Business? Access, Authority, and Accountability By Manzel McGhee Jr., ASBC | Abilene SBDC
