What to ask your agency about access control

The gap between knowing this and actually doing it is where most teams lose ground. If you are briefing an agency or a freelancer on access control, these questions are worth asking early.

The realistic threat for most small businesses is automated and opportunistic, not targeted. It rarely shows up as a line item, which is exactly why it slips.

Questions worth asking

• Who will actually do this work, and have they done it before?
• How will we know afterwards whether it worked?
• What happens if it needs changing in a year?
• What are you assuming that we have not confirmed?

What a good answer sounds like

Give the least access that lets someone do their job. There is a version of this that is over-engineered, and it is worth avoiding. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

Shared logins destroy accountability. Where this goes wrong is almost never a lack of knowledge. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

How to tell if yours is fine

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about access control before you move on:

• Someone can say what the current setup is without going to look
• Shared logins destroy accountability — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Most of the value here comes from doing the first two things, not all of them.