Make Access Management Part of Everyday IT Operations

Access problems often begin as reasonable shortcuts: a shared administrator account, a temporary permission that remains active, or a former contractor still listed in a project. A manageable access process connects permissions to a named person, a business purpose, and an accountable owner.

Know which systems matter

Create an inventory of business applications, cloud accounts, domains, repositories, and shared storage. Record who owns each service and how an authorised person can recover access. Include tools purchased by individual departments so important accounts are not overlooked during staff changes.

Make secure sign-in the normal path

CISA recommends requiring multifactor authentication. Prioritise sensitive and administrative accounts and choose supported methods appropriate to your environment. Plan enrolment, recovery, and support alongside the technical setting; an employee who loses a device still needs a controlled way to regain access.

Avoid sharing everyday credentials between colleagues. Named accounts make responsibilities easier to trace, and role-based permissions help separate routine tasks from administration. Grant access for the work someone needs to perform and review exceptions explicitly.

Treat role changes as access changes

Create separate checklists for joining, moving teams, and leaving. A role change may require removing old permissions as well as adding new ones. For departures, consider ownership of files, scheduled jobs, integrations, and other work that may be attached to the person's account.

For example, removing a departing colleague from email is not enough if they still own the domain registrar account or an automation token. Service owners should confirm the complete handover.

Review the process with real records

Regularly check inactive accounts, privileged access, and time-limited exceptions. Keep an approved emergency access process and test that the responsible people can follow it. The objective is a clear, maintainable operating routine, with fewer permissions left active simply because nobody remembered to revisit them.