An employee leaves the company, but their account remains active for weeks. An external contractor retains administrator access long after their assignment ends. These situations are commonplace, yet they create vulnerabilities an attacker can exploit in minutes. Securing business access is about more than choosing a strong password: it involves a set of technical and organizational decisions that a digital security guide can help structure.
Multifactor authentication: not all methods offer the same protection
You’ve probably received a code by text message to verify a login. This is called multifactor authentication (MFA). The principle is simple: prove your identity using at least two distinct factors, such as a password and a temporary code sent to another device.
The trap is assuming that all MFA methods offer the same level of protection. In March 2025, the CNIL published a recommendation distinguishing passkeys from traditional multifactor authentication. A passkey is not automatically considered multifactor authentication. This distinction affects how a company evaluates the options offered by its software providers.
In its review of the DGFiP, ANSSI goes further. It points out that a code sent by email offers little protection if the email account can be accessed using the same compromised credentials. In other words, the independence of authentication factors determines how robust MFA really is. A physical token or an authentication app on a separate device offers far greater protection than a simple email code.
A well-designed digital security guide helps you make this distinction. Rather than simply checking a box marked “MFA enabled,” it prompts you to verify that the two factors are genuinely separate. To explore this kind of verification in more detail, P U B’s digital security guide outlines practical implementation steps tailored to SMEs.
Data access rights: the problem doesn’t stop at the front door
Imagine a sales representative accessing the company’s CRM. They need to view their clients’ records, not the entire database. Having permission to enter an application doesn’t mean they should be able to view all its data.
This principle has a technical name: the principle of least privilege. Each user receives only the permissions strictly necessary for their role. If an account is compromised, the attacker can access only a limited area, not the entire information system.
ANSSI recommends going beyond basic access control by setting quotas on requests and the volume of data exchanged. These quotas protect against a specific scenario: large-scale data extraction from an account that is otherwise authorized. An employee—or an attacker using their account—who tries to download an entire database would be stopped by these limits.
Conducting regular access reviews
Assigning permissions isn’t enough. They need to be reviewed. A digital security guide typically recommends scheduling access reviews at regular intervals. Here are some points to check during each review:
- Are former employees’ and contractors’ accounts deactivated within 24 hours of their contract ending?
- Are administrator privileges limited to a small number of identified people, with every action logged?
- Have temporary permissions granted for a project or troubleshooting been revoked once the work is complete?
A forgotten account is a door left permanently open. Most access-related incidents aren’t caused by sophisticated hacking, but by an oversight in account management.
The NIS 2 Directive and access security requirements in France
Access management is no longer just good practice: it is becoming a regulatory requirement. The European NIS 2 Directive, currently being transposed into French law, expands the scope of companies subject to cybersecurity requirements. Many SMEs that were not covered by the first version will now be included.
Among the expected measures, identity and access management is explicitly included in NIS 2 requirements. Companies in scope will need to demonstrate that they have documented procedures for controlling who can access what, and how that access is monitored.
For an SME just getting to grips with these obligations, a digital security guide helps translate them into practical terms. It turns abstract regulatory requirements into concrete actions:
- Map information systems and identify critical access points
- Document a password management policy that complies with ANSSI recommendations (minimum length, renewal, and no password reuse)
- Maintain an access log with timestamps so incidents can be reconstructed after the fact
- Appoint an information systems security officer, even on a part-time basis
Business passwords: what the guides actually recommend
Requiring employees to change their passwords every 90 days was long considered good practice. Current ANSSI recommendations take a more nuanced view. Changing passwords too often encourages users to choose weak passwords or write them on a sticky note.
A current digital security guide instead recommends combining a long password (at least 12 characters) with a business password manager. The manager generates and stores complex passwords, so employees don’t have to memorize them.
Train teams instead of piling on restrictions
Technology alone won’t protect you if users don’t understand why they’re being asked to take these steps. The most effective digital security guides include short awareness modules focused on practical examples: a recreated phishing email or a demonstration of how quickly a short password can be cracked.
Securing business access depends as much on people’s habits as it does on the tools they use. A structured guide helps keep efforts focused: it prioritizes risks, shows where to start, and provides criteria for measuring progress. The next step for any company that hasn’t yet formalized its access management is to map its active accounts and check, one by one, whether each still needs to exist.
