Client access and password procedure
SOP template
| SOP no. | Version | Effective date | |||
|---|---|---|---|---|---|
| Owner | Approver | Review date |
Purpose
To keep client accounts secure, with access only for the people who need it, for as long as they need it.
Scope
Every client website, hosting, domain, analytics, ad and social account the agency can reach.
Responsibilities
| Role | Responsibility |
|---|---|
| Account manager | Requests access from the client and removes it when the contract ends. |
| Team members | Use only their own logins and the password manager. |
| Operations lead | Manages the password manager and runs the quarterly access review. |
Procedure
Ask for user access, not passwords
Ask the client to invite each person as a user with the right role, so they keep ownership.
Store shared logins in the manager
Where a shared login can’t be avoided, store it in the agency password manager, in the client’s vault.
Caution: Never send passwords by email or chat, or keep them in a document.
Turn on multi-factor login
Use multi-factor login on every account that supports it.
Give the least access needed
Give each person the lowest role their work needs, and admin access only to those who must have it.
Remove access when people leave
On a staff member’s last day, remove their access to every client account and the password manager.
Hand back access when a contract ends
Transfer ownership, remove the agency’s users and record the handover with the client.
Records
- The access list for each client.
- The quarterly access review.
Related documents
- Client onboarding checklist
Revision history
| Version | Date | What changed | Approved by |
|---|---|---|---|
