I now have all the information I need to write this complete article. Let's get started.
You hired a new salesperson last week. They received their login credentials that morning, and on their very first day, they can view their colleagues' payslips, modify billing settings, and download your entire customer database. Nobody wanted this. Nobody decided this. It simply happened because nobody asked the question: who should see what?
Access and permissions management is one of those issues that managers of very small and small businesses often put off, either due to lack of time or because it seems too technical. Yet, a significant proportion of business security incidents originate from poorly controlled access: a former employee whose account remained active, an intern who could see the entire customer database, a password shared via email. This guide gives you the tools to regain control, without jargon or advanced IT skills.
Why not everyone needs to see everything
The first mistake many small organizations make is thinking that trust is enough. They trust their teams, give them access to everything they need to work smoothly, and then move on. It's human nature. It's also risky.
Security incidents do not always come from outside. A disgruntled employee who leaves with your customer database, an intern who accidentally deletes an accounting file because they had the rights to do so, a service provider whose credentials are compromised and who opens access to your entire information system: these scenarios are documented, common, and often avoidable.
But internal risks aren't the only concern. When an employee has too broad access, every tool they use becomes a potential entry point. One click on a malicious link in an email, and the attacker inherits all of that employee's privileges. If these privileges cover accounting, HR data, and administrator access, the entire information system is exposed.
There is also an organizational dimension that is often overlooked: overly broad access creates confusion. An employee who sees data that does not concern them may make poor decisions, inadvertently access confidential information, or simply waste time navigating areas that are not theirs.
Finally, there is the question of responsibility. When everyone can do anything, no one is truly responsible for anything. Tracing an action, understanding who changed what, responding to an audit: all of this becomes impossible if access is not individualized and delimited.
Restricting access is not a sign of distrust towards your teams. It's a common-sense measure that protects the company, protects the employees themselves, and clarifies everyone's responsibilities.
The main authorization models: by role, by team, by scope
There are several ways to organize the access rights in a company. None is universally better than the others: it all depends on the size of your structure, the nature of your tools and how your teams are organized.
The role-based model This is the most widespread and recommended approach for very small and small businesses. The idea is simple: standard profiles are defined (salesperson, accountant, HR manager, executive, external service provider), and each profile is associated with a specific set of rights. When a new employee joins, they are assigned the profile corresponding to their position, and they automatically have the access they need, no more, no less. This model is often referred to by the acronym RBAC (Role-Based Access Control). It has the advantage of being easy to maintain: if the rights of a profile change, a single adjustment is all that is needed for all employees with that profile.
The team model Organize access around services or departments. The sales team accesses customer relationship management tools and prospect data. The finance team accesses invoicing tools and accounting data. The HR team accesses employee files. This model is intuitive and often reflects the operational reality of an SME. Its drawback: it can create overly rigid silos in structures where responsibilities overlap.
The perimeter model Access is defined based on the sensitivity of the data or areas of the information system. Certain data (customer personal data, payroll data, medical data) is classified as sensitive and accessible only to a very limited circle of people. Other data (product catalog, sales presentations) is accessible to everyone. This model is particularly relevant for companies that process large quantities of personal data.
In practice, SMEs combine these three approaches. Roles are defined by department, sensitivity levels are applied, and adjustments are made on a case-by-case basis for specific situations (general management, occasional service providers, cross-functional projects).
The key, regardless of the approach taken, is to document. A table, even a simple one, indicating for each user profile which tools are accessible and with what level of access (read-only, edit, administer), is worth far more than the best intentions in the world.
The principle of least privilege, applied concretely in an SME
The principle of least privilege is the golden rule of access management. It states one simple thing: each user should only have the rights strictly necessary to perform their tasks. Nothing more.
This principle is recommended by ANSSI in its IT hygiene guide, required by the CNIL within the framework of the GDPR, and explicitly cited in Article 32 of the European regulation as one of the appropriate technical measures to ensure the security of personal data.
In practical terms, in a small business of 20 people, this is what it means:
Your administrative assistant manages schedules, correspondence, and supply orders. She doesn't need access to payroll data, client contracts, or your system's administrative settings. She needs to be able to do her job, nothing more.
Your senior sales representative knows the company well and you trust their judgment. However, this does not justify them having access to their colleagues' HR data or the configuration settings of your billing system.
Your IT provider intervenes on an ad-hoc basis for maintenance. They need temporary technical access, not permanent access to all of your customer data.
The principle of least privilege, when properly applied, doesn't slow down work. It structures it. Everyone knows what they have access to and why. Requests for additional access are handled on a case-by-case basis, documented, and revoked when they are no longer needed.
A common mistake in small organizations is granting administrative rights to multiple people to avoid security breaches. A single compromised administrator account can be enough to expose the entire information system. The French National Cybersecurity Agency (ANSSI) recommends restricting administrative rights to a very limited number of people and using them only for tasks that truly require them, never for everyday browsing or checking emails.
Build your rights matrix in 5 steps
The access rights matrix, also called the permissions matrix, is the central document of your access management policy. It's a table that cross-references your tools and user profiles, and indicates the level of access granted for each combination. Here's how to build it, even without technical expertise.
Step 1: List your tools. List all the digital tools your company uses: email, customer relationship management (CRM) tools, accounting and invoicing software, project management tools, shared storage spaces, video conferencing tools, website access, etc. Don't overlook any tool, even those that seem insignificant. Every tool is a gateway.
Step 2: Identify your profiles. List the main categories of employees in your company: manager, sales manager, salesperson, administrative and financial manager, accountant, HR manager, project manager, external contractor, intern. These profiles should reflect the reality of your organization, not an ideal organizational chart.
Step 3: Define the access levels. For each tool, define the possible access levels. Generally, four levels are sufficient: no access, read-only (view without modifying), modify (create and edit data), and administration (configure the tool, manage other users). These levels often correspond to the roles offered by your tools themselves.
Step 4: Fill in the matrix. For each profile/tool combination, indicate the appropriate access level. Always ask yourself the same question: what does this profile need to accomplish its tasks? Not what it might need someday, not what it would be useful for it to have. What does it need right now to do its job?
Step 5: Validate and update. The matrix must be validated by the relevant department heads and reviewed regularly. It is not a static document: it evolves with your organization. A change of position, a new application, a departure: each event should trigger an update.
This matrix, even in the form of a simple table, is what the CNIL (French Data Protection Authority) may ask you to present during an audit. It is also your best tool for day-to-day management.
Key moments: arrival, change of position, departure
Access management is not a static state. It's a dynamic process that must adapt to the changes in your teams. Three key moments represent the main risks: the arrival of a new employee, their change of position, and their departure.
At the arrivalThe temptation is to grant access to everything quickly so that the person is up and running. This is understandable. It's also one of the main sources of over-allocation of rights. Best practice is to prepare, before the first day, a precise list of access rights to be created, referring to the rights matrix. Each access must be assigned to a specific individual: one account per person, never a shared account. The CNIL (French Data Protection Authority) explicitly recommends systematically using individual, named accounts to guarantee the traceability of actions.
At the change of positionTwo common mistakes are made. The first is failing to grant new permissions in a timely manner, which hinders the employee's integration into their new role. The second, more serious mistake is failing to revoke old permissions, leading to an accumulation of privileges that no one requested and no one monitors. An employee moving from the sales department to the finance department no longer needs access to prospect data. These permissions must be revoked on the same day as the job change.
At the beginningThe rule is absolute: all access must be revoked immediately, on the day of the actual departure. Not the following week, not when there's time. Immediately. An active account left dormant after a departure is an open door, regardless of whether the former employee has malicious intent. According to field analyses, the average revocation period after a departure in SMEs is several weeks. That's several weeks during which someone who is no longer with the company can access your data.
The exit checklist should include: disabling the email account, revoking access to all business tools, removing access to shared storage spaces, changing passwords for shared accounts the person had access to (although you should avoid shared accounts), and recovering equipment.
These three stages must be governed by written procedures, known to all department heads. A simple procedure, applied consistently, is infinitely better than a sophisticated process applied haphazardly.
GDPR: Access management is an obligation, not an option
Many SME leaders perceive the GDPR as an administrative burden that mainly concerns large companies. This is a mistake. The General Data Protection Regulation applies to any organization that processes personal data, regardless of its size. And as soon as you have customers, employees, or prospects, you are processing personal data.
Article 32 of the GDPR requires data controllers to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Among the measures explicitly mentioned are data confidentiality, integrity, and availability. Access management is central to these three requirements.
Article 5 of the GDPR, which sets out the fundamental principles of the regulation, establishes the principles of data minimization and integrity and confidentiality. These principles directly imply that access to personal data must be limited to those who need it to perform their tasks.
The CNIL (French Data Protection Authority) has clarified these requirements in its recommendations. It expects organizations to be able to demonstrate that access to personal data is limited, traceable, and easily revocable. In the event of an audit, you must be able to present your access policy, your rights matrix, and the procedures for revocation in case of departure.
The penalties for non-compliance are real. The CNIL (French Data Protection Authority) can impose fines of up to €20 million or 4% of global annual turnover, whichever is higher. For an SME, even a penalty well below these limits can have significant consequences, not to mention reputational damage.
The good news: rigorous access management, as described in this article, brings you into compliance with the requirements of Article 32 of the GDPR. It's not extra work: it's the same work, just documented.
Traceability: logging access and knowing who did what
Managing access is good. Knowing what each user did with that access is better. Traceability, or logging, involves keeping a time-stamped record of all actions performed in your systems: who logged in, when, from which device, and what data they accessed or modified.
These access logs serve several essential functions. They allow for the detection of abnormal behavior: a connection at 3 a.m., a massive download of customer data, or access from an unusual country. They enable investigations in the event of an incident: if data has been modified or deleted, the logs allow for tracing who did what and when. Finally, they constitute proof of due diligence in the event of an inspection by the CNIL (French Data Protection Authority) or a security audit.
The CNIL explicitly recommends implementing a logging architecture to ensure traceability of access and actions by various authorized users. The ANSSI, in its IT hygiene guide, dedicates an entire section to logging and recommends enabling logs for critical components and analyzing them regularly.
For an SME, logging doesn't necessarily require sophisticated tools. Modern business applications include native logging features: connection history, change logs, and action lists per user. The key is to ensure these features are enabled, that logs are kept for an appropriate duration (the CNIL recommends retaining connection logs for between 6 months and 1 year), and that these logs are protected against modification.
One important point to remember: logs are useless if no one reads them. Schedule regular, even quick, reviews of access to the most sensitive data. An anomaly detected early can prevent a major incident.
Shared accounts, passwords and two-factor authentication
Three practices alone account for a large part of the risks associated with access management in SMEs: shared accounts, weak or reused passwords, and the absence of...authentication double factor.
Shared accounts These are the primary source of problems. A "secretariat" account used by three people, an "admin" account whose password circulates among the technical team, a generic login created for a project and never deleted: each of these accounts represents a vulnerability. When several people use the same account, it becomes impossible to know who did what. Traceability disappears, and with it, any possibility of investigation in the event of an incident. The rule is simple: one account per person, without exception. If a shared account is truly unavoidable, document precisely who has access and why, and change the password as soon as one of the individuals concerned leaves the company or changes positions.
Passwords Passwords remain a sensitive issue. The practice of changing passwords every three months, long recommended, is now considered counterproductive by the French National Cybersecurity Agency (ANSSI) and many experts. Forced to change their passwords regularly, employees develop predictable workarounds (adding a number to the end, alternating between two passwords) that weaken security. The current best practice: long passwords, unique for each service, managed by a password manager. A strong password that never changes is infinitely more secure than a weak password changed every three months.
Two-factor authentication (2FA or MFA) This adds a crucial layer of security. Even if a password is compromised, the attacker cannot access the account without the second factor (a code sent via SMS, an authenticator app, or a physical key). The CNIL (French Data Protection Authority) explicitly recommends implementing multi-factor authentication, particularly for remote access, professional email, and tools containing personal data. The ANSSI (French National Cybersecurity Agency) has made it one of its top recommendations. Enabling two-factor authentication on your most sensitive tools is probably the security measure with the best effort-to-protection ratio available today.
Auditing access once a year: the method
Access management isn't a one-time project. It's an ongoing process. Derived rights, forgotten accounts, and outdated access naturally accumulate over time. An annual audit helps restore order before the situation spirals out of control.
First step: export the list of all active accounts in each of your tools. These applications allow you to export this list from the administration interface. This gives you a snapshot of who has access to what at any given time.
Second step: cross-reference with your list of active collaborators. Compare the list of accounts with the list of your current employees. Identify the accounts that correspond to people who have left the company, changed positions, or whose status has changed (end of assignment for a contractor, end of internship). These accounts must be deactivated immediately.
Third step: check the consistency of the rights. For each active account, compare the assigned rights with those defined in your access rights matrix. Identify any discrepancies: overly broad rights, access to tools not intended for that user profile, or administrative rights granted without justification. Each discrepancy must be either corrected or documented with an explicit justification.
Fourth step: interview the department heads. Send each manager a list of their team's accounts with their associated permissions, and ask them to approve or report any discrepancies. This step is invaluable: department heads know their employees' actual needs better than anyone.
Fifth step: document and preserve the evidence. Record the audit date, any identified anomalies, and the corrective actions taken. This document serves as proof of due diligence in the event of an audit. The CNIL (French Data Protection Authority) recommends formalizing this review in a documented procedure.
This audit, if carried out thoroughly, takes half a day for an organization of 20 people. It's a modest investment considering the risks it helps to avoid.
FAQ: Your questions about access management
Does access management really concern very small businesses?
Yes, without exception. The GDPR applies to any organization that processes personal data, regardless of its size. And very small businesses are often more vulnerable than large companies, precisely because they have fewer resources to manage incidents. Size doesn't protect you.
What should be done if an employee needs exceptional access for a one-off project?
Grant this access temporarily and with documentation. Record who requested access, why, and for how long. Set an expiration date. At the end of the project, revoke access. Never allow exceptional access to become permanent by default. This is how permissions accumulate, weakening information systems.
How to manage access for service providers and subcontractors?
The GDPR requires you to regulate third-party access to your data. Any service provider accessing your systems or personal data must be governed by a contract specifying their security obligations. Their access must be individual, limited to what is strictly necessary, tracked, and revoked as soon as the assignment is completed. You are responsible for their level of security with regard to the CNIL (French Data Protection Authority).
Where do you start if you're starting from scratch?
Start with three actions that have an immediate impact: deactivate the accounts of employees who have left the company, enable two-factor authentication on your work email and most sensitive tools, and remove shared accounts, replacing them with individual user accounts. These three actions require no budget, little time, and significantly reduce your risk exposure. Next, build your access rights matrix and your onboarding and offboarding procedures.
Djaboo is a CRM tool designed for small and medium-sized businesses that centralizes the management of customers, projects, and teams. It natively integrates user rights management features, allowing each manager to precisely define who has access to what, without requiring any technical expertise.
