[{"data":1,"prerenderedAt":180},["ShallowReactive",2],{"publication:en:P078":3},{"meta":4,"copy":17,"relatedArticles":140,"terms":172,"term":173,"resourceParent":174,"glossaryParent":177},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P078","\u002Fblog\u002Fleast-privilege-small-business","article","least privilege checklist for small business","Least privilege checklist for small business access reviews","Least privilege checklist for small business","Review people, suppliers and application access by task, scope and duration. Reduce excess permissions with approval, business testing and a recovery owner.",[13,14],"\u002Fservices\u002Faccess-2fa-audit","\u002Fservices\u002Fsecurity-audit","2026-09-20","2026-10-30",{"intro":18,"sections":19,"checklistTitle":92,"checklist":93,"faq":101,"sources":111,"links":114,"cta":135},"A least privilege checklist for a small business should connect every account and application to an approved task, the required resource scope and an owner who reviews it. Inspect effective access, propose supported reductions, then test business operation and an agreed restricted action. Removing permissions without a recovery and acceptance plan can interrupt the work you are trying to protect.",[20,25,65,74,82,87],{"title":21,"paragraphs":22},"Start with a bounded system and an authorized business owner",[23,24],"Choose one website, email tenant or other defined system for the first review. Agree who can approve access decisions and which business functions must remain available. List staff, suppliers and application identities in scope. Separate routine review from a live compromise: an unexpected administrator or suspicious activity may require an incident process before ordinary role cleanup.","Write the work in concrete verbs: publish content, answer enquiries, reconcile orders or maintain the server. Ask the accountable owner which systems and records the task requires. This is more useful than accepting a broad role because someone is called a developer or manager. Keep unresolved ownership visible, especially where a former supplier controls the only route into an essential service.",{"title":26,"paragraphs":27,"sources":30,"table":34},"Build the effective-access register before making changes",[28,29],"Inspect direct roles, group membership, inheritance, delegated access and relevant shared credentials. Include integrations that can read or write business data without an interactive employee login. A removed staff entry may not remove a separate service account or supplier route. Record where the evidence came from and which systems could not be inspected.","NCSC NZ guidance includes ongoing permission review because responsibilities change and obsolete rights accumulate. Apply that principle to the actual accounts rather than treating its government framework as a worldwide legal requirement. The working register should explain who uses each identity, what it can do, the approved reason and the next decision when the observed capability exceeds the task.",[31],{"label":32,"url":33},"NCSC NZ: least-privilege principles and access review","https:\u002F\u002Fwww.ncsc.govt.nz\u002Fprotect-your-organisation\u002Fleast-privilege\u002F",{"caption":35,"headers":36,"rows":40},"Approved task and effective-access change register",[37,38,39],"Field","Record before changing","Acceptance after changing",[41,45,49,53,57,61],[42,43,44],"Identity and owner","Person, supplier or application and accountable owner.","The intended identity still performs the task.",[46,47,48],"Business task","Approved action and necessary data.","The business owner accepts the actual workflow.",[50,51,52],"Effective capability","Direct, inherited and delegated access.","Supported boundary matches the approved scope.",[54,55,56],"Time and exception","Required duration and unresolved broad rights.","Expiry or review has a named owner.",[58,59,60],"Recovery","Protected administrator and rollback authority.","Recovery remains usable without the affected identity.",[62,63,64],"Evidence","Scope, observation time and test conditions.","Allowed and restricted checks are recorded.",{"title":66,"paragraphs":67,"sources":70},"Choose the narrowest supported change that preserves the task",[68,69],"Compare effective access with a narrower built-in role, resource scope or time-limited arrangement where the platform supports it. Microsoft Entra guidance considers permissions, scope and duration; its privileged-management features have their own availability conditions. Do not assume a named premium feature is present in a small-business subscription or that a custom role is always necessary.","Start with a documented proposal rather than bulk revocation. Identify integration dependencies, the approved change window and the person who can restore the previous supported assignment. If the platform cannot express the desired boundary, record a justified exception and other controls. A transparent limitation is more useful than claiming least privilege from an assignment the system cannot enforce.",[71],{"label":72,"url":73},"Microsoft Entra: least privilege, role scope and review","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Frole-based-access-control\u002Fbest-practices",{"title":75,"paragraphs":76,"example":79},"Test both the legitimate workflow and a safe boundary",[77,78],"Use the agreed identity to complete the approved business task after the change. Then check a harmless operation that should be unavailable, using synthetic records or a test environment where appropriate. Obtain explicit authority for the target and action. Do not probe real customer records or attempt destructive actions merely to produce an impressive access-review result.","Record the expected and observed behavior, scope and relevant session conditions. One tested boundary does not establish every alternative route. If the ordinary workflow fails, pause and trace the missing capability instead of restoring broad administration permanently. Keep rollback as an authorized operational action and document the reason for any temporary exception.",{"title":80,"text":81},"Illustrative supplier-scope correction","A supplier maintains one website but has an inherited role across several sites. The approved change narrows the assignment, confirms maintenance on the intended site and checks an authorized test boundary elsewhere. The review records any separate hosting access still outside scope.",{"title":83,"paragraphs":84},"Handle shared secrets, departures and emergency access separately",[85,86],"Where named accounts are supported, review whether shared administrator credentials remain necessary. Removing a person from a password vault does not invalidate a secret they already knew. Coordinate underlying account removal or rotation with the integrations that use it, and review relevant sessions under the provider's supported controls. Do not treat these as interchangeable actions.","Preserve a protected emergency administrative route with a known owner. Restricting routine access should not leave a supplier's personal email as the only account-recovery method. Include new hires, changed duties and departures in the process so the register stays useful after the initial review. Service identities need the same ownership discipline even when no employee uses their password directly.",{"title":88,"paragraphs":89},"Close the review with decisions, not an unexplained score",[90,91],"Give the business owner a record of completed changes, accepted tests, remaining broad rights and uninspected systems. Assign a person and next step to every exception. Recheck after a significant platform, supplier or duty change and at the agreed review point. The result should be understandable without the reviewer present: what access exists, why it exists and how it will be maintained.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli website and digital-infrastructure knowledge. We can scope an access review, supported implementation and handover around the systems your business uses. The review does not become a full penetration test, a legal certification or a promise that every application and session has been exhaustively examined.","Small-business access review closure",[94,95,96,97,98,99,100],"Scope, authority and essential workflows agreed","People, suppliers and applications mapped","Effective access compared with the approved task","Supported narrower roles or exceptions documented","Protected recovery and rollback retained","Allowed task and authorized restricted action tested","Departures, shared secrets and review ownership addressed",[102,105,108],{"question":103,"answer":104},"Can we remove every administrator except the owner?","First map essential tasks, recovery and the supported roles. Some work needs administration, and relying on one unavailable person can create a different failure. Review routine privileges and protected emergency access separately, with named authority and acceptance.",{"question":106,"answer":107},"Is a public website scan enough for an access review?","No, a public scan cannot establish private staff roles, supplier delegation, group inheritance or application permissions. Access review needs appropriate authorized evidence from the systems in scope and should record what could not be inspected.",{"question":109,"answer":110},"What if the software cannot provide a narrower role?","Record the limitation, approved reason for the broader access, compensating controls and a review owner. Do not claim a boundary the product cannot enforce. A different supported workflow may be possible, but changes need business acceptance and recovery planning.",[112,113],{"label":32,"url":33},{"label":72,"url":73},[115,118,120,123,126,129,132],{"path":116,"label":117},"\u002Fglossary\u002Fleast-privilege","Understand permissions, scope and duration",{"path":13,"label":119},"Scope a business access review",{"path":121,"label":122},"\u002Fblog\u002Femployee-offboarding-access","Use an employee departure checklist",{"path":124,"label":125},"\u002Fblog\u002Fpassword-manager-business","Review credential sharing and ownership",{"path":127,"label":128},"\u002Fblog\u002Fbackup-access-separation","Check access to recovery systems",{"path":130,"label":131},"\u002Fblog\u002Fmicrosoft-365-security-checklist","Review the wider Microsoft tenant",{"path":133,"label":134},"\u002Fblog\u002Flinux-ssh-hardening","Connect server access to a verified SSH handoff",{"title":136,"description":137,"button":138,"type":139},"Find access that no longer matches the job","Tell us which systems and suppliers are involved. We can agree an authorized review, supported changes and business acceptance.","Discuss permissions and ownership","check",[141,150,158,166],{"id":142,"path":143,"title":144,"description":145,"category":146,"artwork":147,"order":148,"publishedOn":149},"P104","\u002Fblog\u002Flost-mfa-device","Lost your phone with an authenticator app? Business account recovery","Recover a business account after losing an authenticator phone or security key. Verify identity, use supported recovery and review methods and sessions.","access","support",58,"2026-09-10",{"id":151,"path":152,"title":153,"description":154,"category":146,"artwork":155,"order":156,"publishedOn":157},"P066","\u002Fblog\u002Fpasskeys-business-rollout","Passkey rollout for small business: pilot, recovery and handover","Plan a passkey pilot around supported apps, device ownership, credential providers, recovery and departure. Verify sign-in and fallback before expansion.","security",72,"2026-09-30",{"id":159,"path":160,"title":161,"description":162,"category":146,"artwork":163,"order":164,"publishedOn":165},"P191","\u002Fblog\u002Fidentify-phishing-message","How to identify a phishing message before taking action","Check the requested action, sender, destination and independent verification route. Learn what polished messages and familiar threads cannot establish.","email",49,"2026-08-29",{"id":167,"path":124,"title":168,"description":169,"category":146,"artwork":146,"order":170,"publishedOn":171},"P065","How to choose a business password manager and test the fit","Compare business password managers through ownership, vault access, recovery, staff workflows and exit. Use a synthetic pilot before moving production secrets.",80,"2026-10-10",[],null,{"path":175,"label":176},"\u002Fresources","Website security resources and templates",{"path":178,"label":179},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058939]