Staff use computers, Microsoft 365, Google Workspace, accounting, POS, website or social media systems
Staff use computers, Microsoft 365, Google Workspace, accounting, POS, website or social media systems.
Small business cyber safety
Staff Access Risk Checker
Do staff have more access than they need?
Check admin access, old staff accounts, shared passwords, contractor accounts, website access, social media access and accounting access in plain English. Based on public ASD/ACSC Essential Eight guidance.
Staff accessAdmin rightsOffboardingPractical self-check
When to use this check
Use this when you want a practical business-owner answer, not a technical framework first.
You are not sure which staff or contractors still have admin access
You are not sure which staff or contractors still have admin access.
You want to reduce damage if one account, device or password is compromised
You want to reduce damage if one account, device or password is compromised.
Privacy: this checker runs in your browser and does not ask for sensitive details.
Answer the quick questions
Tick the statements that match your staff access setup.
How this relates to the Essential Eight
This check relates mainly to admin access and account control. In Essential Eight language, it supports restricting administrative privileges and safer identity practices.
Helps improve Essential Eight alignment step by step. This is a practical self-check, not a formal government certification or audit.
What this means for a small business
Least privilege simply means staff should have the access they need for their job, not extra access that can cause bigger damage if something goes wrong.
What to fix first
- Remove old staff and contractor access.
- Reduce daily admin use on computers and cloud systems.
- Replace shared passwords with named accounts and a safer password process.
Why it matters
These basic checks help protect business money, files, customer records, staff devices and daily operations.
When to get local help
Need help reviewing staff access without disrupting the business? Your IT & Tech Mates can help clean up old accounts, admin access and shared passwords.
Related tools
Use the hub and related tools to check the other parts of your small business cyber safety setup.
Cyber Safety Hub
Return to the hub and choose your business concern.
Small Business Cyber Safety Self Check
Start with the full five-minute check across logins, backups, updates, access and device safety.
Email & Login Safety Checker
Check two-step login and account access for email, cloud, accounting, website and social platforms.
Backup Safety Checker
Check whether files, invoices, records and job photos can be recovered if something goes wrong.
Staff Access Risk Checker
Review old accounts, admin access, shared passwords and contractor access.
Out-of-Date Computer Risk Checker
Check whether computers, browsers, Office, accounting apps, POS systems and remote access tools are being kept up to date.
Risky Office Attachment Checker
Check whether risky Office files, invoices, spreadsheets, supplier documents or attachments could put your business at risk.
Safer Browser & App Settings Checker
Check browser updates, extensions, downloads, password saving, PDF readers, remote access apps and common unsafe app settings.
Cyber Insurance & Tender Evidence Helper
Prepare a plain-English evidence checklist for insurers, suppliers, clients or tenders.
Small Business Cyber Action Plan Builder
Turn your answers into a simple action plan: first 3 fixes, this week, this month and later.
Need help turning this into real protection?
Your IT & Tech Mates can help set up two-step login, backups, updates, admin access, safer devices, and a plain-English cyber action plan for your business.
FAQ
What does least privilege mean?
It means people get the access they need to do their work, and not extra admin access they do not need every day.
Should every staff member be an admin?
Usually no. Admin access should be limited because it can increase damage if a device or account is compromised.
Is this a formal audit?
No. This is a practical self-check based on public ASD/ACSC Essential Eight guidance, not a formal government certification or audit.