How to Review Administrator Access: An SMB Checklist

Reviewing administrator access means finding every account that can make high-impact changes, confirming each one is still needed, splitting personal logins from admin logins, and writing down any case where you can't follow the rule exactly. Do this on a schedule, not just after something goes wrong, and you close off one of the easiest paths an attacker, or a simple mistake, can take through your business.

Step 1: Build a Complete Inventory of Privileged Accounts

You can't secure access you don't know exists. Start by listing every account that has elevated rights, not just "IT admin," but anything that can change settings, access financial data, deploy code, or manage other users' permissions.

Walk through each major system separately: email/identity platform, cloud infrastructure, finance and payroll tools, CRM, website or CMS, backup systems, and any line-of-business software. For each, pull the full list of accounts with elevated roles. Don't rely on memory or an org chart from a year ago.

Decision rule: what counts as "privileged"

If an account can create or delete other accounts, change security settings, access or export bulk customer data, or approve payments, treat it as privileged, regardless of what the job title on the account says.

Step 2: Remove or Downgrade Unused Access

Every inventory turns up accounts nobody remembers granting: a former contractor, a vendor integration that was never revoked, a founder who no longer touches the finance system day-to-day. Each one sits unmonitored and unused.

For every privileged account, check the last login date and the last action taken. We recommend treating 60-90 days of inactivity as your trigger point: disable the account rather than deleting it outright, so you can confirm with the owner before removing it for good.

• If the person has left the company: revoke access immediately, don't wait for the next review cycle.

• If the person changed roles and no longer needs admin rights: downgrade to a standard account the same week.

• If a vendor or integration account is unused: disable it and confirm with the vendor before deleting, in case a scheduled job still depends on it.

Step 3: Separate Daily-Use and Administrator Accounts

A person who checks email, browses the web, and opens attachments from an account that also has admin rights is one phishing click away from handing over the keys. The fix is simple: give anyone who needs privileged access two accounts, one for everyday work, one for admin tasks only.

How to roll this out without disrupting work

Start with the highest-risk accounts first: anyone with domain admin, cloud root, or finance-system owner rights. Create a separate admin identity, require it to log in only when performing an administrative task, and set the daily account to standard-user permissions. If your team is too small to justify two logins for one person, at minimum turn on multi-factor authentication for every privileged account and avoid using it for routine browsing or email.

Step 4: Document Exceptions Instead of Ignoring Them

Some exceptions are legitimate: a founder who needs standing access to the bank account, a small IT team where full separation isn't realistic yet. The problem isn't having exceptions. It's having undocumented ones that nobody remembers approving or reviewing.

For each exception, write down who has the access, why it's needed, who approved it, and when it will next be reviewed. Keep this list somewhere your whole leadership team can find it, not buried in one person's inbox. If you can't name a business reason for an exception during the review, that's your signal to close it rather than carry it forward.

How Often to Repeat This Review

A one-time cleanup fades fast as people join, leave, and change roles. Set a recurring cadence, we recommend quarterly for most small businesses, and trigger an extra review immediately after any departure involving privileged access, a role change, or a new vendor integration. If you don't have anyone internally who owns this process, that's a sign it's time to bring in outside help rather than let it slip.

Sheer Safe's managed security and virtual CISO services exist for exactly this gap: ongoing ownership of access, identity, and security hygiene for businesses without a dedicated security hire. When your access policies also need to satisfy a client questionnaire or regulatory requirement, our compliance support can help you document exceptions and controls in a way that holds up to scrutiny. The National Institute of Standards and Technology (NIST) publishes widely-referenced guidance on least-privilege access if you want a deeper technical grounding.

If this checklist surfaced more gaps than you expected, or you're not sure where to start, a free security review is a low-friction way to get a second set of eyes on your current access setup before it becomes a bigger problem.