Keep a small team secure

When several people share one login, nobody can tell who did what, and nobody can take access away from one person without changing it for everyone.

1. Give each person their own account with only the rights they need, instead of sharing one password. Google advises against sharing admin accounts, and both Google and Microsoft suggest limited admin roles for everyday tasks.
2. For social media pages, use the platform's roles. In Meta Business Suite, Full access is the highest level and Partial access limits people to the tasks they are given.
3. Where a password must be shared, share it through a password manager, not in a chat. Bitwarden and 1Password, for example, let organisations share collections or vaults with only the people who need them. See Use a password manager.
4. List every account the organisation depends on, as the NCSC suggests: email, storage, social media, the website, banking. Add the domain registrar too. Note who controls the recovery email and phone number of each one.
5. Have at least two admins for each important account, each managed by a different person. Google, Microsoft and 1Password all warn that a single admin who is locked out can lock out the whole team.

Roles limit what a person can do, not what they can copy while they have access. Plan for that when people leave.

The US cybersecurity agency CISA says two-step verification should be required by settings, not left to trust, and warns that gaps often appear with new staff and new phones.

NCSC warns that accounts often stay active after people leave without anyone noticing. Do this on their last day, or at once if they leave on bad terms.

1. Reset their password and sign them out everywhere. In Microsoft 365: Users → Active users, select the person, then Reset password, and on the Account tab Sign out of all sessions, then Block sign-in. Microsoft says blocking can take up to 24 hours, so the password reset matters.
2. In Google Workspace, Google's checklist includes removing their recovery email and phone, revoking app access, security keys and sign-in cookies, and wiping work data from their phone. Google says deleting the account is the surest way, but transfer their files first: deleted data can't be recovered after 20 days, and files in shared drives aren't transferred.
3. Remove them from the password manager, then change every password they could see. Bitwarden and 1Password both say a device kept offline can keep a readable copy; with 1Password, until it next goes online. That is why every password must change. 1Password says to assume admins saw everything in the vaults they managed.
4. Remove their roles on social media pages, the website, the domain registrar and bank accounts.
5. Remove them from Signal groups (only admins can), and reset group links: open the group, then Group Link → Reset Link.
6. Change any shared secret they knew, such as a Wi-Fi password or door code.

Removing access doesn't remove what someone already copied or remembers. If you expect someone to leave on bad terms, plan this in advance.

Group chats are where most sensitive talk happens, so a few shared rules matter more than any setting.

1. Keep separate groups for different levels of sensitivity, and keep the sensitive ones small: see Keep groups tight.
2. In Signal, admins can choose who may add members, edit group details and manage invite links. Turn on Approve New Members if you use a link, and don't post invite links publicly, as Security in a Box advises.
3. Make only people you have verified admins, Security in a Box advises, and don't trust a display name alone.
4. Agree on a disappearing-messages timer. In Signal, anyone in the group can change it, and it only applies to new messages: see Set disappearing messages as the default.
5. If removing someone doesn't solve a problem, start a new group, Security in a Box suggests.

Disappearing messages don't stop a member from taking screenshots. A group is only as private as its least careful member.

Decide before an emergency what counts as one, who does what, and how you will reach each other. CISA suggests a written plan; Holistic Security, roles that everyone has agreed to in advance.

1. Name who to contact first, and a backup person, for each kind of problem: a hacked account, a lost or seized device, a member who is detained or harassed.
2. Keep a contact list on paper as well. CISA advises an address book you can use when your systems are down.
3. Agree a main and a backup way to reach each other, and what not to say on open channels.
4. For a hacked account, follow If your account was hacked. For a device that may be taken, see If your phone or computer may be taken.
5. Keep emergency access: Microsoft suggests two emergency admin accounts with security keys, stored separately; 1Password says you need your Emergency Kits if everyone who can recover accounts is locked out.
6. Know who can help: Access Now's Digital Security Helpline offers free 24/7 help to civil society, journalists and activists (help@accessnow.org; Georgian is not among its languages, Russian is). See Know where to get expert help.
7. Practise the plan once, for example by walking through a scenario together.

A plan written once and forgotten won't help. Review it when people join or leave.