Virtual Assistant Security and Access Checklist for Small Teams

Key takeaways

• Give named accounts instead of shared passwords whenever a tool allows it.
• Start with the least access needed for the first workflow, then expand only with a reason.
• Write offboarding steps before access is granted so removal is not a scramble later.
• Pair access decisions with onboarding review and role-value measurement.

Access planning is part of the role design

Security for a virtual assistant is not only a technical setting. It is part of role design. The assistant should know where to work, what they can view, what they can change, and what they must never approve alone. If the business has not decided those limits, the assistant may guess, the manager may overcorrect, and sensitive systems may be opened wider than the first task requires. This checklist works best when it is used alongside the first 30 days onboarding checklist, because access should expand only as the role becomes clearer.

Use named accounts and least access

Whenever possible, give the assistant a named account rather than a shared login. Named accounts make it easier to manage permissions, review activity, and remove access later. Start with the least access needed for the first workflow. An assistant who sorts inbox messages may not need billing access. An assistant who updates CRM fields may not need export permissions. Least access is not about mistrust. It is about making the workflow safer and easier to supervise.

Use a password manager and multi-factor authentication

Passwords should not be sent through chat, email, or screenshots. Use a password manager, multi-factor authentication, and tool permissions that can be removed when the assignment changes. The NIST small business cybersecurity guidance is a strong outside baseline for thinking about passwords, devices, updates, backups, and sensitive business systems in a practical small-business setting.

Document what the assistant cannot do

A useful access note includes the no-go decisions as clearly as the allowed tasks. The assistant may prepare a refund note but not issue the refund. They may draft a client reply but not send messages involving legal, medical, financial, or angry-customer issues without approval. They may update a CRM stage but not delete records or export a list. Written stop rules prevent speed from becoming risk.

Review activity during onboarding

Security review should be practical. During the first week, check whether the assistant stayed inside the assigned tools, left clear notes, and escalated sensitive items. During the first month, review whether permissions still match the work. If the manager is considering expanding the role, use the guide to measuring virtual assistant value before scaling to decide whether wider access is justified by a stable workflow.

Write offboarding before you need it

Offboarding should not be invented during a resignation or provider change. Keep a short list of accounts, permissions, shared folders, password-manager entries, devices, and recurring calendar access. When the assignment ends, remove or rotate access, transfer owned files, and confirm that workflow notes are stored in a company-controlled place. The same list also helps if a replacement assistant needs to take over.

Ask providers how they handle access

Before choosing a provider, ask how assistants receive credentials, whether shared passwords are discouraged, how device expectations are handled, and what happens when a role ends. If a provider cannot explain access and offboarding clearly, pause before granting live systems. You can share your access requirements through the contact-us planning form when you are ready to discuss a role.

FAQ