Understand the decision

A password manager can help people create and manage unique credentials. For a business team, choose an approved tool and explain how individual and shared business access should be handled. Start onboarding with the services a colleague actually needs, not a pile of unused accounts. Clarify who administers the tool, how access is recovered and what happens when employment or a contract ends. Never use a public profile document as a credential directory.

A practical workflow

Prepare a practical joining checklist: activate the approved account, learn the recovery process, receive only the required access and test a normal work task. Ask colleagues to flag credentials previously stored in spreadsheets or chat so those can be moved through the approved process. Avoid copying secrets into the onboarding record. Repeat the same discipline during offboarding by reviewing access assignments and business ownership, rather than assuming that removing one person from a chat group removes their account access.

Imagine this

Hypothetical example

A contractor joins a campaign project. They receive access to the required publishing service through the company’s approved credential process, with recovery and support explained. When the contract ends, the account owner reviews the access assignment and confirms the business retains control of its assets.

Make it practical.

Use this checklist as you read. Checks are not stored.

References & further reading

Further reading: CISA: Secure Our World ↗

Published by Tap Tap Go. Product availability and eligibility vary by programme and market. About our stories.