Insider Risk and Access Control for Small Teams
Most insider incidents in small teams are mistakes, not malice, and both are limited by the same thing: people seeing only what their work needs. A practical guide.
"Insider risk" sounds like corporate espionage. In a small team it usually looks more ordinary: an email sent to the wrong client, a spreadsheet of everyone's details forwarded to a personal account "to work on at home", a leaver who still has access three months later, a compromised account belonging to a perfectly loyal colleague. Occasionally it is deliberate. The defences are the same for all of these, and most of them are about access.
Why small teams are exposed
- Everyone can see everything, because setting up permissions felt like bureaucracy when there were four of you.
- Shared logins mean nobody can tell who did what.
- Admin rights are handed out to whoever needed to fix something once.
- Leavers are offboarded informally, and some accounts are forgotten.
- Trust replaces controls, which is pleasant until an account is taken over by someone else.
Principle: need to know, by default
People should have access to the records their work needs, and not the rest. This is not a statement of distrust. It limits the damage of mistakes, of compromised accounts and of the rare bad actor, all at once. It also makes it easier to answer the question "who could have seen this?", which you will be asked after any incident.
Practical controls, in order of value
- Individual accounts for everyone, with two-factor authentication. See rolling out two-factor to the whole team.
- Access per matter or per client, not one shared pool. Sensitive categories such as HR, health or whistleblowing restricted to named people.
- Few administrators. Two is usually right: enough for cover, few enough to keep track.
- A same-day leaver process: accounts disabled, sessions ended, devices returned, shared passwords changed, sharing links reviewed.
- Role changes treated like leaving and joining: remove the old access as you add the new.
- An audit trail that records views, downloads, shares and permission changes, and that users cannot edit.
- Limits on bulk export, or at least visibility of it. Large downloads are the most common way data walks out.
Watch for signals, not people
You do not need surveillance. You need to notice unusual patterns: someone opening dozens of records outside their work, large exports late at night, access to files unrelated to their role, forwarding rules to personal addresses. A periodic look at the access log, or alerts where your tools support them, is enough for most small teams.
Make the right thing easy
People forward files to personal accounts because remote access is awkward. They share passwords because adding a user is slow. Fix the friction and most risky workarounds disappear. And give people a safe way to raise concerns about colleagues' conduct, as discussed in handling whistleblowing reports confidentially.
When someone leaves
Departures are the highest-risk moment, even when they are friendly. Plan the handover so the work stays in the shared system rather than in the leaver's inbox; see how to hand over a case when someone leaves. Then remove access on the last day, not when someone remembers.
A quarterly fifteen minutes
- Who has admin rights, and do they still need them?
- Are there any accounts for people who have left?
- Who can see the most sensitive records?
- Any unusual exports or access in the log?
