Overview
A virtual assistant access checklist helps a small business grant the right access without opening its entire digital workspace. Before the assistant starts, list the recurring tasks, identify the systems involved, name an internal owner, and decide what evidence will show that each task is complete. Access should follow the work.
Build one access inventory with the application
Build one access inventory with the application, business purpose, data involved, requested permission level, approver, date granted, review date, and removal owner. That record gives the team something concrete to check when the role changes or ends.
Use least privilege as the rule
Use least privilege as the rule. NIST defines least privilege as restricting access to the minimum needed for assigned tasks. An assistant who uploads approved invoices may need an intake folder and a draft-entry screen. That does not mean the same person needs bank payment release, user administration, or every company folder. Source: https://csrc.nist.gov/glossary/term/least_privilege
Create an individual account whenever the system allows
Create an individual account whenever the system allows it. With a shared login, it becomes harder to tell who changed a record, remove one person's access, or review activity. Choose the smallest workable role and leave administrator rights with the internal system owner.
Require multifactor authentication on company accounts
Require multifactor authentication on company accounts. CISA explains that MFA uses two or more ways to verify identity. Its small-business guidance recommends MFA for email, file storage, remote access, privileged accounts, and accounts used by people who handle sensitive data. CISA recommends phishing-resistant methods where they are available. Source: https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication
Keep passwords out of ordinary email
Keep passwords out of ordinary email, chat, and procedure documents. Use the company's approved password manager or the application's invitation flow. The business should control recovery addresses, recovery phone numbers, billing ownership, and administrator roles.
Make the approval specific
Make the approval specific. Record the task, requested role, folders or records in scope, start date, review date, and approver. A request such as give access to accounting is too broad to review later.
Test the account before live work begins
Test the account before live work begins. Ask the assistant to sign in, open the required queue, update a sample record, save a draft, and confirm that restricted actions are unavailable. This small test can reveal either a missing permission or one that reaches too far.
Technical access is only half of the handoff
Technical access is only half of the handoff. Write down the rules for approved devices, downloads, local file storage, public Wi-Fi, browser extensions, copying data into other tools, suspected phishing, and unexpected MFA prompts. NIST's small-business identity guidance describes the goal plainly: the right people and technologies should have the right level of access to the right resources at the right time. Source: https://www.nist.gov/video/identity-and-access-management-fundamentals-small-business
Give blocked work an exception path
Give blocked work an exception path. If the assistant cannot complete a task with the assigned permissions, they should log the blocked action and send it to the system owner. A broader permanent role is not the automatic fix. The owner may complete the restricted step or approve one narrow change.
Review access on a schedule and whenever
Review access on a schedule and whenever the role changes. Confirm that the account is active, MFA is enrolled, each permission still supports current work, and old folders or applications are gone. NIST's small-business MFA guidance recommends limiting systems and data to people who need them, limiting administrator privileges, and removing access when needs change or someone leaves. Source: https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication
Write the offboarding checklist while you set up
Write the offboarding checklist while you set up the account. List every account, folder, group, password-vault item, device, API token, forwarding rule, and recovery method tied to the assistant. On the final workday, disable the account, end active sessions where the system supports it, remove access to shared resources, transfer owned files, rotate any credential that was actually shared, and record who completed the work.
Use the first 30 days as a controlled
Use the first 30 days as a controlled trial. Check whether the assistant completed assigned work without repeated access escalations. Confirm that restricted actions stayed unavailable, the inventory matches current permissions, and activity records are available to the internal owner. Change the role only when a recurring task supports the request.
A short access scenario belongs in the hiring
A short access scenario belongs in the hiring process. Ask a candidate what they would do if a procedure points to a folder they cannot open, an MFA prompt arrives while they are not signing in, or a manager asks them to use a coworker's login. The answer should follow the approval path, protect credentials, and stop when a request conflicts with the written boundary.
Before the start date
Before the start date, document the workflow, inventory the systems, assign a system owner, approve the minimum role, create a named account, enroll MFA, share access through the approved method, test allowed and restricted actions, set a review date, and prepare offboarding. Continue with HireBackOffice's /blog/prepare-before-hiring-virtual-assistant and /blog/back-office-sops guides. The /services/document-management and /services/compliance-support pages cover related file and evidence workflows.
HireBackOffice can help scope recurring back-office work around
HireBackOffice can help scope recurring back-office work around a written access boundary and an internal review owner. Start with one workflow, then expand only when the team has evidence that the role needs more access. Contact the team at /contact-us.