Clear Path step · Business · Your industry's rules and risks
Give every staff member and volunteer their own account
Why it matters: Shared logins can't be protected with MFA well, can't be traced and never get removed when volunteers move on.
On your path if you picked “Nonprofit or faith community” for “What's your industry?”.
Do it
- Check whether you qualify for the nonprofit programs from Microsoft or Google, which offer business accounts at low or no cost.
- Create individual accounts with MFA.
- Limit volunteers to the systems they need.
- Remove access the day someone's role ends.
Check it worked: No shared logins: each person has their own account with only the access they need, removed the day they step away.
Simply put
Shared logins are like one key copied for every volunteer, with no record of who has it. Individual accounts can each have MFA, show who did what, and be switched off the day someone steps away.
In detail
Volunteer turnover is the nonprofit version of employee offboarding, and it's usually where access lingers longest.
If this is new to you: Worried about the cost? Microsoft and Google run nonprofit programs with business accounts at low or no cost. Start with the people who handle money and member data.
Points toward the Long View: access that follows each person's role and ends when their role does.