Answers

How do you set up a new employee's accounts and devices?

Ascent Vision · Published October 30, 2026

Work from one written list of the accounts the job needs, and create a separate login for each person, with the business holding ownership. Give only the access the job requires, turn on a second sign-in step, hand over a device that is updated and free of earlier data, and give a short rule sheet. Write down everything handed out, so it can be taken back when the person leaves.

Start from the account list

Use the same written list of accounts that the related answer on removing an employee's access when they leave works from, and go through it for the new role: email, files, the customer list, booking and payment tools. As general advice, create each account under the business, with the owner or an admin role held by the business and the new person added as a user.

Give every person their own login, contractors included, with a strong, unique password; the related answer on removing an employee's access covers why NIST's small business guide advises separate accounts, and the same account list serves both jobs.

Give only the access the job needs

Give access only to what the job needs (the related answer on removing an employee's access covers NIST's wording). The FTC's guide to protecting personal information calls the same idea the "principle of least privilege", meaning each employee has access only to the resources needed for their particular job. NIST also advises that employees do daily work from accounts without administrative privileges, which hinders attempts, intentional or not, to install unauthorized software.

For accounts that hold important information, NIST advises using more than one form of identification when signing in. The related answers on multi-factor authentication and on password managers cover that second step.

Prepare the device

• Check for updates the day you set it up. NIST advises checking for updates immediately on new computers and when installing new software.
• Install only what the job needs. NIST advises installing only the applications you need to run the business.
• Make sure protection software is installed. NIST advises anti-virus and anti-spyware software on every device used in the business, including phones and tablets.
• If the device was used before, wipe the earlier user's data and accounts first. This is general advice; NIST's wiping advice is about computers you are disposing of.
• Turn on a screen lock.

Give a short rule sheet

NIST advises training employees immediately when hired, and having them sign a paper saying they will follow your policies. The FTC guide likewise advises asking every new employee to sign an agreement to follow the company's confidentiality and security standards for handling sensitive data. NIST's suggested topics include what business computers and phones may be used for, how to treat customer or business information, and what to do in an emergency or security incident.

A one-page sheet is usually enough: how passwords are kept, how to handle a suspicious message (the related answer on spotting a phishing email covers the signs) and who to ask.

Record it and check it

Write down each account created, each device handed over with its serial number, the date and who gave it. That record is what lets you take everything back later without guessing. Set a date a few weeks out to check that each login works and nothing extra was granted.

Sources

1. NIST, "Small Business Information Security: The Fundamentals" (NISTIR 7621 Rev. 1, November 2016)
2. FTC, "Protecting Personal Information: A Guide for Business" (October 2016)

Related answers

• How do you remove an employee's access to accounts when they leave?
• What is multi-factor authentication, and should every business account use it?
• Does a small business need a password manager?
• How do you spot a phishing email or text, and what should staff do with it?