Decide where work belongs
A remote team needs a clear place for business records and a clear way to access them. This scenario is illustrative. Begin by identifying essential systems, authorised users and the record that should be treated as final. Avoid allowing customer documents to accumulate across personal inboxes and untracked local folders.
Choose an account ownership model before buying collaboration software. The business should control its domain, primary administrator accounts and recovery process. A contractor’s personal identity should not be the only way to manage subscriptions or export company information.
Protect identity and recovery
Enable appropriate multi-factor authentication and consider phishing-resistant options where supported. Give each person an individual account. Establish a recovery process that survives a lost phone, a departing staff member or an unavailable owner. Keep recovery information secure and do not paste it into online planning tools or enquiry forms.
Restrict administrator permissions to the tasks that require them. Where practical, use separate accounts for daily work and administration. Record which person approves access and review it periodically. An account checklist records work completed; it does not independently validate the organisation’s security.
Make device expectations explicit
For business-owned devices, record the assigned user, updates, encryption status, support process and return procedure. For personal devices, get appropriate advice about what the business may manage, monitor and remove. Tell staff how company data should be stored and what happens when employment or a contract ends.
Home internet quality varies. Test video calls and essential applications rather than setting an arbitrary download-speed requirement. Explain who pays for additional connectivity and what staff should do during an outage. A public hotspot may introduce privacy and access risks that need a considered policy.
Back up the data, not the assumption
Synchronisation replicates changes, which can include unwanted deletion or encryption. Map vendor retention and recovery features against your own recovery requirements. If a third-party backup is used, confirm what it includes, where it stores data and how an authorised person restores it.
Test a representative restore to a safe location and record the time, permissions and missing information. Include shared files, mailboxes and application records if they are essential. A green status indicator is not evidence that all necessary records can be recovered.
Operate a repeatable joiner and leaver process
- Approve access against the role and verify the person’s identity.
- Set up accounts, multi-factor authentication and secure recovery.
- Confirm device readiness and where business records must be stored.
- On departure, revoke sessions and access across all relevant services.
- Transfer record ownership before removing licences or accounts.
Review subscriptions after this process is stable. A low utilisation report can identify a potential saving, but cancellation can break integrations or retention. Use the audit tool to create a review list, then confirm each change with the system owner.