The Least-Privilege Access Checklist for Remote Assistants

"Least privilege" is a simple idea: give each person only the access needed to do their job, and nothing more. It limits the damage from mistakes, compromised accounts and misuse. Security frameworks from NIST to the CIS Controls treat it as a foundational practice.

For leaders working with a remote assistant, least privilege can feel abstract. This checklist makes it concrete, system by system.

Before you grant anything

Start with the role. List the tasks the assistant will do in the first 90 days, then map each to the system and permission level required. Grant access in phases as tasks are delegated, rather than everything on day one.

Ask three questions for each permission:

1. Which task requires this?
2. Is there a lower permission that would work?
3. Who will review it, and when?

Email

• [ ] Use delegate access to your mailbox rather than sharing your password.
• [ ] Consider whether the assistant needs send-as or send-on-behalf permission, or only read and organize. Start with the minimum.
• [ ] For shared inboxes (info@, support@), grant access to the shared mailbox only, not to personal mailboxes.
• [ ] Set up mail rules together so sensitive categories — HR, legal, personal — can be routed to a folder the assistant doesn't process, if you prefer.

Calendar

• [ ] Grant edit access to calendars the assistant manages.
• [ ] Mark sensitive events private where your platform supports it, so details are hidden even from delegates.
• [ ] Avoid granting access to calendars the assistant doesn't need, such as other executives' calendars.

File storage (Google Drive, OneDrive, SharePoint, Dropbox)

• [ ] Share specific folders, not your entire drive.
• [ ] Use view access where editing isn't required.
• [ ] Keep HR, legal, board and compensation folders separate, with access granted only if the role requires.
• [ ] Disable external sharing for sensitive folders, or restrict it to approved domains.

CRM (Salesforce, HubSpot, others)

• [ ] Create a named user with a role or profile matching tasks — for example, edit records but not export all data, or no admin settings.
• [ ] Restrict mass export and mass delete permissions unless the role specifically requires them.
• [ ] For CRM admin roles, consider using a sandbox for configuration changes before production.

Project and task tools

• [ ] Add the assistant to relevant projects or workspaces, not organization-wide admin.

Finance and accounting

• [ ] In accounting software (QuickBooks Online, Xero, NetSuite), use a role that matches the work — for example, bookkeeping access without the ability to add users or change bank feeds, if not required.
• [ ] For bank portals, prefer view-only access. Payment initiation, if needed, should require approval by an authorized person.
• [ ] Use spend-management cards with limits instead of sharing a company card number.
• [ ] Require approval for new payees and changes in payment details.

ExecWing bookkeepers prepare payment runs for approval; release stays with your authorized approvers.

HR and payroll

• [ ] Grant payroll access only for payroll roles, and with the minimum permissions — for example, data entry without approval rights.
• [ ] Keep employee sensitive data (Social Security numbers, bank details, medical information) restricted.

Admin consoles (Google Admin, Microsoft 365 admin, IT tools)

• [ ] Avoid granting super admin or global admin roles.
• [ ] Use scoped roles — for example, a helpdesk role that can reset passwords but not change security settings.
• [ ] Log privileged actions and review them.

Social media and marketing tools

• [ ] Use the platform's business manager or team features to grant roles rather than sharing account passwords.
• [ ] Prefer editor or publisher roles over admin.

Regulated data

If your assistant will handle regulated data, add role-specific controls:

• Health information (HIPAA): a signed Business Associate Agreement before access; minimum necessary access. ExecWing requires a BAA for medical and dental admin roles.
• Financial information (GLBA): access consistent with your information security program under the FTC Safeguards Rule or applicable banking rules.
• Export-controlled data (ITAR/EAR): do not grant access to foreign persons without authorization.
• Student records (FERPA): access consistent with your institution's policies.

Devices and networks

• [ ] Agree device standards: up-to-date operating system, disk encryption, screen lock, endpoint protection.
• [ ] Avoid storing company data on personal devices beyond what work requires.
• [ ] Use your company's approved tools for file transfer.

Review cadence

• [ ] Monthly in the first quarter: review access against tasks actually delegated.
• [ ] Quarterly after that: remove unused access.
• [ ] On role change: adjust access immediately.
• [ ] On departure: revoke everything the same day. See offboarding a remote assistant securely.

Keep an access register

Record every system, permission level, grant date and owner. It turns reviews from guesswork into a quick checklist. See password manager setup for assistants for a template.

Common objections

"It's faster to give full access." In the short term. In the long term, broad access increases risk and makes offboarding harder.

"I trust my assistant." Good — trust is essential. Least privilege isn't about distrust; it protects both of you if an account is compromised or a mistake happens.

"The tool doesn't support granular roles." Then compensate with process: approvals, monitoring and limited use.

Phasing access with delegation

Least privilege works best when access grows with the role. A typical progression:

• Week 1: Calendar edit access, inbox delegation without send permissions, the project tool and a single shared folder.
• Weeks 2–4: Send-on-behalf for routine replies, CRM named user with standard role, travel vault in the password manager.
• Month 2–3: Additional folders and tools as specific tasks are handed off; finance tools in view-only or preparation roles if the role includes them.

Each step should be tied to a task on your delegation list. If a permission doesn't map to a task, it can wait.

Quick answers

How do I know which permissions a task needs? Try the task with the lowest role first. If it fails, raise permission one step at a time and note what was required.

What about tools with only one admin login? Keep the credential in a restricted vault, limit who can use it and change it whenever access changes.

How long does an access review take? With an access register, usually under an hour per quarter for a single assistant.

Key takeaways

• Map every permission to a specific task.
• Start with the lowest role that works and raise it only when needed.
• Add controls for regulated data such as health or financial information.
• Review access monthly at first, then quarterly.

The bottom line

Map access to tasks, grant the minimum role in each system, phase access as delegation grows, add regulated-data controls where needed and review regularly. Least privilege takes a little planning up front and pays for itself the first time something goes wrong. See our security page.

If you do nothing else this week, create an access register for your assistant, compare it to the tasks they actually do and remove one permission that no longer maps to a task.