Almost nobody in a small organization needs administrator rights day to day. Give admin to as few named people as possible, use a separate account for admin tasks, and review the list every quarter. CISA's Cyber Essentials recommends granting access and admin permissions on a need to know and least privilege basis.
Why admin sprawl happens
Small teams grant admin to get things moving. The founder set up the email system, so they are admin. A volunteer helped with the website, so they are admin. Someone needed to reset a password once.
Years later nobody remembers who has what. A compromised admin account is a far bigger problem than a compromised ordinary one, because the attacker can add users, change settings and read everything.
Step 1: list the admins
Open the admin or user settings of your main systems: email and files, donor or member database, website, accounting, payment tools, domain registrar. Write down every account with elevated rights.
Mark each as one of three types.
- A named person who still needs it
- A named person who no longer does
- Generic or shared (such as an info account)
Step 2: remove what is not needed
Remove admin from anyone who has moved roles or only needed it once. If a task comes up again, grant access for that task and take it away after.
Generic and shared admin accounts are the riskiest, because you cannot tell who did what. Replace them with named accounts. Where a tool only allows one login, store the credentials in a team password manager with access limited to two or three people.
Step 3: separate daily and admin accounts
If an administrator reads email and browses the web with the same account that can change every setting, one bad click is a disaster. Give administrators a normal account for daily work and an admin account used only for admin tasks, protected with multi factor authentication.
CISA says to use multi factor authentication for all users, starting with privileged, administrative and remote access users. So admin accounts come first.
Step 4: keep at least two admins
Least privilege does not mean one admin. If the only administrator leaves or loses access, you may be locked out of your own systems. Keep two trusted people with recovery details stored safely, and treat the second as a backup, not a daily user.
Step 5: review on a calendar
Put a quarterly reminder on someone's calendar. Walk the list again. Tie it to your offboarding routine so that anyone leaving has access removed the same day. Our volunteer and staff offboarding checklist covers the steps.
What to record
Keep a simple table: system, admin name, reason, date last reviewed. It takes minutes to update and helps if an insurer, funder or auditor asks who has access.
Quick check
How many admins should a small organization have?
As few as the work needs, with at least two so one departure does not lock you out. Name each person and write down why.
Is a shared admin login acceptable if the password is strong?
It is a weak setup because you cannot tell who used it. Use named accounts, or limit a shared credential to a few people through a password manager.
Safeguard's compliance and evidence automation can collect access review evidence for teams that need to show it; a small team can start with the spreadsheet above.
Sources
Last reviewed: 19 October 2026.
