Reviewing Who Has Access

Think about what sits in your CRM: every customer, what they pay, what you quoted, who you're chasing. For many small businesses, it's the most valuable file they own. A competitor would love a copy, and a departing salesperson might be tempted to take one.

Most access problems aren't dramatic. Permissions pile up because someone needed something once, and a login stays alive because nobody remembered to close it. A short regular review is enough to deal with most of that.

How much access does each person need?

The basic idea is simple: each person gets the access their job needs, and no more. Security people call this least privilege. It protects against bad intent, but it mostly protects you from accidents. Someone who can't delete 500 records can't delete 500 records by mistake.

Most CRMs handle this with roles, a set of permissions you assign to a group of people. You rarely need many. Here's an invented example for a window cleaning company with 30 staff.

Permission options vary widely between products, and detailed controls are often kept for higher plans. Check what your plan can really do. If it can't restrict something you care about, write that down as a known risk.

Which four permissions need a harder look?

Not all permissions carry the same risk, and four of them deserve a harder look.

Export. This is the power to take the whole customer list away in one file. Only a few people need it.

Bulk delete and bulk edit. A single mistake here can affect thousands of records. Keep it to people who are trained, and make sure you have a recent backup.

Admin. Admins can change the rules, including the permissions of others. Keep the number low, but have at least two, so you aren't stuck when one is away. Don't leave the only admin login with a single employee, and if an outside consultant set up your system, confirm that you own the admin account.

Connected apps. Tools linked to your CRM can often read and write your data. An old integration nobody remembers is an open door. List what's connected, and disconnect anything you no longer use.

What should you do when someone leaves?

Departures are the part of access control that matters most, and worth writing down as a short routine. Close access the same day someone leaves. If the departure is difficult, do it before the conversation ends, not after.

Deactivate rather than delete, where you can. Deleting a user can remove or orphan the history attached to them. A deactivated user keeps the record intact, and in many products no longer uses a paid seat, though you should check how yours treats it.

Temporary people need the same care. Contractors, seasonal staff and outside consultants often keep access long after the work ends. Give them an end date when they start, and put it in the calendar.

How do you run a quarterly access review?

Every three months, set aside 30 minutes for an access review. Pull a list of all users, with their roles and last login dates, and go through it with someone who knows the team.

People change jobs inside a company too. A rep promoted to manager gets new access, but old access rarely gets removed. Over time, long-serving staff collect far more rights than they need. Reviewing roles rather than individuals keeps that under control.

Good login habits

Access reviews work best when logins themselves are sound. None of this takes much effort.

• No shared logins. You lose all record of who did what.
• Two-step sign-in. A code from a phone or an app, on top of a password. Turn it on if your plan has it, starting with admins.
• Single sign-on, if you already use Google or Microsoft work accounts. It can mean closing one account closes them all, but check which plans include it.
• A password manager. It helps people avoid reusing passwords, which is one of the common ways accounts get broken into.

Fair, not suspicious

You don't need to treat your team as a threat. Tell them why roles exist: to protect customers, to prevent accidents, and to keep things simple. Good people rarely object to a system that also protects them from being blamed if something goes wrong.

Also remember that customer data carries legal duties in many places, particularly if there's a breach. Ask your adviser what applies to you, and keep a short note of who to call if an account is broken into.

Key takeaways

• Give each person what their job needs, using a few simple roles.
• Watch four powers closely: export, bulk changes, admin and connected apps.
• Close access the same day someone leaves, and reassign their work.
• Run a 30-minute review every quarter, using a list of users, roles and last logins.
• Avoid shared logins, and turn on two-step sign-in, starting with admins.