Access control

The rules and tools that decide who can see or use specific systems, files and locations, and what they are allowed to do once they have access.

Access control covers both digital and physical security. On the digital side, it determines which employees can open a shared folder, log in to your accounting system or change settings on a server. On the physical side, it includes key cards, door locks and visitor sign-in procedures for your office or server room.

For a small business, access often grows informally over time. Staff change roles, contractors come and go, and permissions are rarely removed. That leaves more accounts with more access than they need, which gives an attacker more to work with if any one account is compromised. Under Alberta's Personal Information Protection Act, organizations are expected to protect personal information with reasonable security arrangements, and limiting who can reach that information is a basic part of that.

Practical tip: review who has access to your most sensitive systems, such as payroll, client records and banking, at least twice a year, and remove access the same day an employee leaves.