Cover five things in fifteen minutes: their own account and MFA, the device they use, which data they may touch, how to spot suspicious messages, and who to tell if something goes wrong. Give them only the access their role needs, and write down what you granted so you can remove it later.
Why the first day matters
New volunteers are keen to help and unsure what is allowed. If nobody explains the rules, they improvise: they reuse a password, forward donor lists to a personal address, or click a message that looks like it came from the director. A short briefing replaces guesswork with a habit.
The fifteen minute agenda
- Accounts (3 minutes). Create a named account. Turn on MFA together, in the room. Do not share a login.
- Devices (3 minutes). If they use a personal device, confirm automatic updates and a screen lock. CISA's advice is to install updates quickly and turn on automatic updates.
- Data (3 minutes). Say which data they can see and which they cannot. Say where files may be stored, and that exports to personal email are not allowed.
- Messages (3 minutes). Show one real example of a fake request, such as a message from a "director" asking for gift cards or a password.
- Reporting (3 minutes). Give a name and a channel. Promise no blame for reporting a mistake.
A one page record
Keep this in your volunteer file. It also helps at offboarding.
| Field | Example entry |
|---|---|
| Name and role | Events volunteer |
| Accounts granted | Email, shared drive folder for events |
| Data access | Event signups only, no donor database |
| Device type | Personal laptop |
| MFA confirmed | Yes, date |
| Briefed by | Name |
| Access end date | Date or "review in 6 months" |
An end date or review date stops access from piling up. Our guide on offboarding volunteers and staff covers what to do at the end.
Least access, not zero trust drama
You do not need a heavy process. Ask one question per tool: what is the least this person needs to do the job? Most tools have a viewer or editor role below administrator. Choose it.
Some tasks need more. A volunteer treasurer may need bank access. Keep that account individual, add MFA and review it each quarter.
Make the rules short and kind
Write the rules in plain language and keep them to a page. Avoid threats. People remember a friendly rule better than a long policy. Use words like "please" and explain the reason, such as "so a lost phone does not expose our members".
What to refresh
Repeat the briefing at the start of each season or program, and when roles change. A two minute reminder in a team meeting is enough between sessions.
Quick check
Do short term volunteers need all of this?
Yes, at a smaller scale. Event helpers may only need a named account, MFA if offered and a rule on data. Keep the briefing proportional.
Who should lead the briefing?
Anyone who knows the systems. It does not need a technical person, just someone with the checklist and the authority to grant access.
Sources
Last reviewed: 19 October 2026.
