Giving someone access to your inbox, calendar, CRM or accounting system is an act of trust. It's also a security decision. The good news is that the controls that matter most are simple, cheap and well documented. This checklist covers what to set up before day one, how to handle sensitive workflows, and how to offboard cleanly.
Principle 1: Named accounts, never shared logins
Every person should have their own account in every system. Shared logins make it impossible to audit who did what, can't be revoked for one person without disrupting everyone, and often violate vendor terms.
Most business tools support delegation or additional users:
- Email and calendar: delegate access in Google Workspace or Microsoft 365.
- CRM: a named user with an appropriate role.
- Accounting: a user role in QuickBooks Online or Xero.
- E-commerce: staff or user accounts in Shopify and Amazon Seller Central (Shopify staff accounts).
Principle 2: Least privilege
Grant the minimum access needed for the agreed tasks, then expand deliberately. An assistant who manages your calendar doesn't need admin rights in your CRM. A bookkeeper who reconciles accounts doesn't need permission to release payments.
Review access monthly in the first quarter, then quarterly.
Principle 3: Multi-factor authentication everywhere
MFA is one of the most effective controls against account takeover. The US Cybersecurity and Infrastructure Security Agency recommends it broadly and explains the options (CISA MFA). Prefer authenticator apps or security keys over SMS where possible.
NIST's digital identity guidelines (SP 800-63) are the detailed reference for authentication practices if you want to go deeper.
Principle 4: Use a password manager for anything shared
Some credentials must be shared — a vendor portal without multi-user support, for example. Share these through a business password manager, never by email or chat. Password managers let you share without revealing the password and revoke access instantly.
Principle 5: Secure devices
Remote assistants should work on devices that meet a minimum standard:
- Supported, up-to-date operating system
- Full-disk encryption
- Screen lock with a short timeout
- Endpoint protection
- No shared family use of the work device
- Secure home Wi-Fi with a strong password
ExecWing also requires backup power and a backup internet connection, which is about continuity as much as security.
Principle 6: Extra controls for money
Payments are where remote access carries the most risk, and where fraud is most common. Business email compromise — where criminals impersonate executives or vendors to redirect payments — is a major category of reported cybercrime; the FBI's Internet Crime Complaint Center collects reports.
Controls that help:
- Separation of duties. The person who prepares a payment shouldn't be the person who approves it.
- No stored bank credentials. Bookkeepers can work from bank feeds in your accounting system and statements you share. They don't need your online banking password.
- Vendor-change verification. Any change to a vendor's bank details is verified by calling a known contact — not a number from the email requesting the change.
- Payment limits and approvals in your bill-pay tool.
See our security page for how ExecWing applies this to bookkeeping.
Principle 7: Data handling rules
Agree simple rules in writing:
- Work stays in your systems; no local copies unless needed and approved.
- No personal email or personal cloud storage for work files.
- No use of client data for anything other than the agreed work.
- Report suspected phishing or mistakes immediately — without blame.
Principle 8: Regulated data needs agreements
If your assistant will handle regulated data, you'll need specific agreements:
- Health information: a HIPAA Business Associate Agreement where the assistant's work involves protected health information. HHS explains when a BAA is needed (HHS business associates).
- Personal data processed in the Philippines: the Data Privacy Act of 2012 applies; contracts should address it.
Principle 9: Clean offboarding
When an engagement ends:
- Revoke access to every system the same day.
- Rotate any shared credentials.
- Transfer ownership of files and documents.
- Confirm deletion of any local copies.
- Record the offboarding in a checklist.
Keep an access inventory from day one so offboarding is a checklist, not a scavenger hunt.
A one-page checklist
- [ ] Named accounts in every system
- [ ] Least-privilege roles
- [ ] MFA on all accounts
- [ ] Password manager for shared credentials
- [ ] Device standard confirmed
- [ ] Payment approvals separated
- [ ] Vendor-change verification process
- [ ] Data-handling rules signed
- [ ] BAA or other agreements where required
- [ ] Access inventory maintained
- [ ] Offboarding checklist ready
A worked example: setting up access for a new assistant
Here's how the principles in this article translate into a 60-minute setup for a new executive assistant:
| Step | Action | Principle |
|---|---|---|
| 1 | Create the assistant's own Google Workspace or Microsoft 365 account | Named accounts |
| 2 | Enforce MFA, preferably an authenticator app or security key rather than SMS | MFA |
| 3 | Grant mailbox and calendar delegation from the executive's account | Least privilege, no shared passwords |
| 4 | Invite them to the password manager; share only an "EA" folder | Password manager |
| 5 | Add them to CRM, expense and travel tools with standard roles | Least privilege |
| 6 | Confirm device encryption, screen lock and OS updates | Secure devices |
| 7 | Share the data-handling rules and get a signed acknowledgment | Data handling |
| 8 | Record every account granted in an access log | Clean offboarding later |
The access log
Keep a simple sheet. It makes offboarding fast and audits painless:
| System | Account | Role | Granted by | Date granted | Date removed |
|---|---|---|---|---|---|
Phishing: what assistants see most
Assistants are targets because they handle executives' email and money-adjacent tasks. Common lures include:
- A fake "CEO" asking for gift cards or an urgent wire
- A vendor "changing bank details"
- A fake login page for Microsoft 365, Google or DocuSign
- An "invoice overdue" email with a malicious attachment
The rule: any request involving money, credentials or bank changes is verified through a separate, known channel before anyone acts. NIST guidance and CISA's MFA resources favor phishing-resistant authentication, such as security keys, for accounts that matter most.
Offboarding in under an hour
When an assistant leaves, work through the access log top to bottom on their last day: disable accounts, remove delegation, revoke password-manager sharing, rotate any shared credentials they could see, and transfer file ownership. Then mark each line with the removal date.
The bottom line
Remote access doesn't have to mean more risk. Named accounts, least privilege, MFA, a password manager, secure devices and payment controls cover most of what matters — and they're good practice for your in-house team too.
Read ExecWing's security approach or our guide to the Philippine Data Privacy Act for US companies.
Sources
- CISA, Multifactor Authentication.
- NIST, Digital Identity Guidelines, SP 800-63.
- FBI, Internet Crime Complaint Center.
- HHS, Business Associates FAQ.
- National Privacy Commission, Data Privacy Act of 2012.
- Shopify Help Center, Staff accounts.
- NIST, SP 800-63B Digital Identity Guidelines: Authentication. ---SOURCES---
Want a dedicated assistant who already knows this playbook?
ExecWing places full-time, managed assistants from the Philippines with US leaders. Month-to-month, from $1,900/mo. See pricing or how it works.
Book a 20-minute fit call