Start with a clear remote access map
Before staff log in from home, map which apps they use, who should have access, and what level of permission each person needs. A sales agent in Johannesburg should not have the same access as a finance clerk in Cape Town, even if they both work on the same laptop. The goal is simple: give people only what they need, then review it regularly.
For South African teams, this matters even more when people work across different towns and time zones, or when load-shedding means logins happen at odd hours. Clear access rules reduce confusion and cut down on rushed password sharing over WhatsApp.
- List every core system used by remote staff.
- Assign access by role, not by request.
- Remove old shared accounts where possible.
- Record who approves new access and who checks it later.
Set up secure login habits for home and mobile use
Home networks are not all equal. Some staff use fibre in Stellenbosch, others rely on mobile data in Durban or a small router in a flat in Gqeberha. Make sure every user knows how to log in safely, especially when using phones, tablets or public Wi-Fi. A password manager helps staff store and use strong passwords without writing them down or reusing the same one across accounts.
For mobile logins, turn on extra checks such as device approval and two-step verification where available. This gives you a better barrier if a phone is stolen or a SIM is swapped. Keep the steps short and practical so people actually follow them.
- Use a unique password for every application.
- Switch on two-step verification for all admin accounts.
- Block access from unknown devices until approved.
- Ask staff to lock screens when stepping away, even at home.
Train people on password use and everyday risk
Security only works if people understand the routine. A short training session should cover how to create passwords, how to recognise suspicious messages, and why login details must never be shared between team members. This is especially important for small business teams where one person may wear several hats and is tempted to keep things informal.
Training should also explain what to do during a power cut or data outage. If a staff member cannot reach the office, they still need a clear way to get help without exposing credentials. Keep the process simple and repeat it during onboarding so new staff do not learn bad habits later on.
- Show staff how the password manager works on benchtop and mobile.
- Explain phishing signs using real examples from daily work.
- Make support steps clear for after-hours issues.
- Include a short refresher for every new hire.
Build permission rules that reduce mistakes
Permission mapping is where many small businesses tighten things up. A remote worker should have access to the files, systems and folders they need, but not to payroll, admin settings or old client records unless their role requires it. This keeps the business safer and also makes account changes easier when someone changes roles or leaves.
At 1Pass, we see that many teams start with too much access and only clean it up after a problem. It is better to set the rules early and keep a simple approval path. That way, the owner or manager knows exactly who can see what and why. It also helps if your team is spread between Woodstock, Pretoria and remote locations nationwide.
- Create separate access groups for each role.
- Limit admin rights to a very small number of staff.
- Review shared vaults and remove anything unnecessary.
- Record changes so there is a clear trail for audits.
Use offboarding steps that protect the business
Remote work makes offboarding easy to overlook. If a contractor finishes a job or a staff member leaves on short notice, access must be removed the same day. That includes saved passwords, shared vaults, app permissions and any mobile sessions still active on personal devices. Delays create risk, especially when a former employee still has access to cloud tools from home.
A good offboarding process should be written down and followed every time. It saves the admin team from guessing and keeps the business steady when staff changes happen quickly. Even a small company in Cape Town can avoid unnecessary problems by using one fixed checklist.
- Disable accounts immediately after the exit decision.
- Reset shared passwords where the person had access.
- Remove the user from vaults, groups and admin panels.
- Check that company data is returned or removed from personal devices.
Keep remote access under review
Remote security is not a once-off task. Quarterly access reviews help you spot old permissions, inactive users and gaps in training. This is useful for businesses with changing project teams, seasonal staff or part-time support across cities like Durban, Johannesburg and Gqeberha. It is also a practical way to check whether everyone is still using the system as intended.
If you run a small team, keep the review short and focused. Look at who has admin rights, who has not logged in for weeks, and whether any staff members need fresh training. A simple review every three months is often enough to catch issues before they become costly.
For many businesses, the best setup is a mix of secure password storage, controlled access and regular training. That gives home-based staff enough freedom to work well, while keeping the business protected when people move between office, home and road. It also makes support easier when a team member phones in from a weak signal area or after a power cut, because the process is already set out.
