Most five-person teams do not have a full-time IT person. They have a shared Google Workspace or Microsoft 365 account, a handful of laptops and phones, a few critical software subscriptions, and the quiet risk that someone will leave, a laptop will be lost, or an old access permission will still be active six months later. This guide offers a practical digital hygiene checklist sized for exactly that reality.
I am Eric Holt. Before becoming an independent consultant I spent years supporting internal tools and employees at a mid-sized B2B company. Since 2017 I have helped small professional firms, dental offices, real-estate teams, and contractor businesses keep their digital house in order without enterprise complexity. The checklist below is the distilled version that fits a five-person operation.
The goal is basic control and clean offboarding, not a corporate security program.
Why Small Teams Need a Lightweight Checklist
Five-person teams face a specific pattern of risk:
Access is granted quickly when someone joins and removed slowly (or never) when they leave.
Shared logins persist because “everyone needs it” and no one owns the password change.
Devices are a mix of company-owned and personal, with no clear record of what holds business data.
Subscriptions continue after the person who set them up is gone.
A short, repeatable checklist prevents these patterns from compounding. It does not require new software or a dedicated administrator—only a named owner and a calendar reminder.
The 15-Minute Version
If you have only fifteen minutes today:
Open a shared note or spreadsheet and list every person who currently has access to the main business email, file storage, and financial tools.
Highlight anyone who has left the team in the last six months but still appears on the list.
Circle the single highest-risk shared login (bank, payroll, primary domain registrar, or main email admin).
Change that one password or revoke that one leftover account if you have the authority.
Put a thirty-minute recurring calendar event three months from now labeled “Digital hygiene check.”
That short pass surfaces the most urgent gaps and establishes the review rhythm.
The Complete Checklist for Five-Person Teams
1. Named Owner for Digital Access
One person (usually the owner or office manager) is explicitly responsible for the checklist. When that person is unavailable, a second person knows where the list lives and how to revoke access in an emergency. Without a named owner the work becomes everyone’s job and therefore no one’s job.
2. Living Access Inventory
Maintain a simple shared document with four columns:
Person
Systems they can access (email, files, banking, CRM, industry software, social accounts)
Device(s) that hold business data
Date access was last reviewed
Update the inventory when someone joins, when someone leaves, and during the quarterly review. The document does not need to be fancy; it needs to be current.
3. Clean Offboarding Sequence
When a team member leaves, complete these steps within one business day:
Revoke email and file-storage access.
Change passwords on any shared accounts that person knew.
Remove the person from password-manager vaults, shared drives, and third-party tools.
Collect or remotely lock company-owned devices.
Confirm that business data on personal devices has been removed or made inaccessible.
Write the completion date next to the person’s name in the access inventory. Delayed offboarding is the single most common source of lingering risk in small teams.
4. Shared-Account Discipline
Shared logins should be rare and deliberate. Where they still exist (some industry platforms force them), store the credentials in a team password manager, limit knowledge of the password to the minimum number of people, and change the password immediately when anyone who knew it leaves. Prefer individual accounts with proper permissions whenever the software allows it.
5. Device and Data Location Record
Know which laptops, phones, and tablets hold business email, client files, or financial data. For company-owned devices, keep a one-line record of the serial number and the person assigned. For personal devices used for work, ensure the business accounts can be removed without wiping the entire phone. This record makes recovery far faster when a device is lost or a person departs.
Time, Cost, Difficulty, and Risk
Time: Building the first access inventory and offboarding checklist usually takes sixty to ninety minutes. Quarterly reviews take twenty to thirty minutes once the documents exist. Individual offboarding takes fifteen to thirty minutes when the checklist is followed.
Cost: Near zero if the team already uses a password manager and standard productivity suites. No enterprise tools are required for this level of hygiene.
Difficulty: Suitable for any owner or office manager who can edit a shared document and change account passwords. No technical certification is needed.
Risk: The main risk is treating the checklist as a one-time project instead of a living habit. The second risk is incomplete offboarding that leaves former team members with residual access.
Who maintains it? The named owner runs the quarterly review and performs or delegates offboarding. A backup person must be able to locate the inventory and revoke access if the owner is unavailable.
Quarterly Review Agenda (Twenty to Thirty Minutes)
Once every three months the owner opens the access inventory and walks through four questions:
Does every person still on the list need the access they currently have?
Has anyone left whose access has not been fully revoked?
Are there shared passwords that should be changed or converted to individual accounts?
Have any new critical tools been added that are not yet on the inventory?
Update the document, change what needs changing, and set the next review date. That is the entire recurring ritual.
Special Situations Common in Five-Person Teams
Contractors and temporary help. Give the minimum access required and set a calendar reminder for the expected end date. Revoke on that date whether or not someone remembers to ask.
Husband-and-wife or co-owner teams. Both owners should be able to reach the access inventory and the password manager. A single point of failure is especially dangerous when the team is already small.
Industry-specific software that resists individual accounts. Document the shared credentials, restrict knowledge of them, and treat every personnel change as a mandatory password change.
Personal phones used for business texting or authentication. Ensure that business-related apps and two-factor methods can be removed cleanly. Avoid making a personal phone the only recovery path for a critical business account.
A Real Five-Person Example
A small real-estate team had grown from three to five people over eighteen months. Shared logins existed for the MLS tool, the transaction platform, and the social-media accounts. When one agent left, her email was revoked but the shared passwords remained unchanged and her personal phone still received some two-factor codes. We built the access inventory in one sitting, rotated the shared passwords, moved the social accounts to a proper business manager structure, and instituted a quarterly review. Six months later another agent departed; offboarding took twenty minutes and left no residual access. The checklist had turned an ad-hoc risk into a routine task.
The same pattern holds for dental offices, contractor crews, and professional service firms of similar size: a living inventory plus disciplined offboarding removes most of the avoidable exposure.
What This Checklist Deliberately Avoids
It does not require a full MDM (mobile device management) system. It does not demand enterprise-grade identity software. It does not turn the owner into a full-time security officer. Those tools become relevant at larger scale. For five people the priority is knowing who has access, removing it promptly when they leave, and reviewing the list on a fixed cadence.
Closing the Loop
Digital hygiene for a five-person team is mostly about ownership, visibility, and timely revocation. Name one person responsible, keep a living access inventory, follow a short offboarding sequence, and review the list every quarter. Those four habits prevent the majority of lingering-access and orphaned-subscription problems that small teams encounter.
Start with the fifteen-minute inventory of who can currently reach the main email, files, and financial tools. Then schedule the first thirty-minute quarterly review. When someone leaves, treat the offboarding checklist as non-negotiable same-day work. The system stays light enough that a busy owner will actually keep it alive.
The next and final guide in this initial series covers the family emergency account list everyone should have before they need it. Until then, open a shared document and write down the names and systems that currently have access. That single list is the foundation of workable digital hygiene for a small team.
Make it boring enough to work.
No comments yet.