A workspace security checklist you can run in an afternoon: access, sharing defaults, recovery, devices and leavers. What to check, in what order, and what each answer should look like.
Most workspace breaches are not clever. Somebody who left three months ago still has access, a document shared "to anyone with the link" turns up in search results, or a single admin account holds everything and nobody knows the password. A workspace security checklist exists to catch that class of problem on a schedule, before it catches you — and the whole first pass takes an afternoon rather than a project.
Two separate questions, and most teams can only answer one. Can you recover a document somebody deleted or overwrote last Tuesday, and can you get all your data out if you decided to leave the product tomorrow? Test both rather than assuming. A restore you have never performed is a plan, not a capability, and an export you have never run is a claim in a feature list.
Write down who holds the recovery path for the workspace itself — the account that can restore access if the main administrator is unavailable. The commonest single point of failure in a small company is one person's phone.
Pick a frequency that survives a busy quarter: quarterly for access and sharing, annually for recovery testing, immediately on any departure. Record each pass with the date and what changed, because the value of a checklist is partly the history it builds — a reviewer can see that the question was asked, and you can see which answers keep drifting back.
Ettex Teams keeps the register side of this: people and their access, devices against owners, integrations with an owner each, and a log of every review with its date and findings. Pairing it with a written access control policy means the checklist produces a record rather than a conversation.
Quarterly for access and sharing, annually for recovery testing, and immediately after anybody leaves. Reviews that are scheduled less often than departures happen will always be out of date.
Removing access for people who have left. It is the most common real exposure and the cheapest to fix.
They need to be able to answer who changed or shared something. Whether that comes from a logging feature or from a documented review depends on the tools you have, but the question has to be answerable.
SSO removes a password per service and concentrates risk in one place. That trade is usually worth making — provided the identity provider itself is protected better than the accounts behind it.
Turning on two-factor authentication is the single highest-value security change most small teams can make. Which second factor you pick decides whether it stops the attack that actually happens.
Forced ninety-day changes, three special characters, no repeats — most password rules were written from intuition and make passwords weaker. The current guidance says something close to the opposite.