Access policy for company accounts determines who has access to which tool, at what level, and what happens when a person leaves. In small companies it tends to be handled in the worst possible way: accounts are set up under a specific employee's personal email, two-factor authentication is tied to their phone, and passwords circulate in chat. One person leaving then means losing an advertising account or a social media profile. A functional setup rests on four rules: set up accounts under the company identity and a company email, assign named access to people instead of a shared password, tie two-factor authentication to a company device or to backup codes not held by a single person alone, and have ownership vested in at least two people. Include the removal of access in the offboarding process as a mandatory step.
See also: Digital Assets of a Company, Ownership of advertising accounts, Contract with a marketing agency.
