1. Objective

This SOP governs how credentials, system access, and account security are managed throughout your engagement. As an EA, you will be granted access to systems containing sensitive business data, client information, and financial records. How you receive, store, use, and eventually relinquish that access directly affects the security of your executive's business. Poor credential hygiene is one of the most common and most preventable sources of business risk in small operations.

Where this SOP starts: Day 1 — during the access setup process.
Where this SOP ends: Last day of the engagement — when all access is formally revoked.

Success looks like: Your executive's accounts are never compromised due to poor credential management. All access is properly granted, tracked, and revoked at the end of an engagement. You never share credentials in an insecure way. Your executive knows exactly what you have access to at any time.

2. Your Role & Boundaries

2a. What you handle independently

• Receiving credentials through secure channels and storing them in the approved password manager
• Maintaining the access log — updating it when new access is granted or revoked
• Ensuring your own devices are secured (password-protected, up to date)
• Flagging any suspicious account activity immediately

2b. What requires executive approval before acting

• Accessing any system or account not included in your initial access agreement
• Sharing any credential with a third party
• Creating new accounts on your executive's behalf using their information
• Resetting any password without your executive's knowledge and authorization

2c. What you never do

• You never receive or store credentials in unencrypted email, text, or chat messages
• You never share credentials with anyone — including other team members — without explicit authorization
• You never use your personal accounts for business access when a shared or business account is available
• You never leave credentials in a browser that's not secured by a master password
• You never retain access to accounts after an engagement ends

3. Receiving Access Credentials

Approved channels for receiving credentials:
- Password manager shared vault (preferred — see Section 4)
- Encrypted message (e.g., via a one-time secret link tool like onepassword.com/create-link)
- Direct verbal communication in a private setting

Never accept credentials via:
- Email (even "secure" email)
- Slack or Teams
- Text message
- Any platform that retains message history

When credentials are shared insecurely (which happens with new clients who don't have a system yet):
1. Acknowledge receipt
2. Store in the password manager immediately
3. Notify your executive: "I've received and stored those credentials securely. For future access sharing, I'd recommend using [method] to avoid sending credentials through email."

4. Password Manager Protocol

All credentials are stored in a dedicated password manager. This is non-negotiable.

Recommended tools: 1Password, Bitwarden, LastPass, Dashlane.

Setup in Week 1:
- Confirm which password manager your executive uses, or set one up if they don't have one
- Create a shared vault specifically for EA-relevant credentials
- Store only the access you actually need — not everything in their vault

What goes in the shared vault:
- Login credentials for platforms you actively manage
- API keys or access tokens you use directly
- Shared service account credentials

What stays out of the shared vault:
- Personal accounts (your executive's personal banking, personal email unrelated to your work)
- Credentials for systems you don't need access to

5. Access Log

Maintain a simple log of every account and system you have access to.

Format:
| Platform | Access Type | Granted Date | Access Level | Notes | Status |
|---|---|---|---|---|---|
| Gmail | Full email access | 2026-04-01 | Full read/send | Shared via password manager | Active |
| Google Drive | File management | 2026-04-01 | Edit | Specific folder only | Active |
| QuickBooks | Invoice management | 2026-04-15 | Limited | Invoicing only — no financial reporting | Active |

Review the access log monthly. Confirm that every access item is still needed. Remove access you no longer use — both from the log and from the system itself.

6. Account Security Practices

Your devices:
- Use a strong, unique password for every device you work from
- Enable screen lock with a short timeout (5 minutes max)
- Keep your operating system and browser up to date
- Use a VPN when working on public or shared networks

Browser security:
- Never let your browser save credentials for accounts that contain sensitive information
- Clear saved form data regularly
- Use private/incognito windows when accessing accounts on shared or temporary devices

Two-factor authentication:
- Enable 2FA on every business account where it's available
- Store 2FA backup codes in the password manager (not in email or unencrypted notes)
- If you use an authenticator app, ensure it's on a device you own and control

7. Suspicious Activity Protocol

If you observe any of the following, treat it as a security incident and notify your executive immediately:
- An unfamiliar login location or device shown in an account's security log
- Password change notifications you didn't initiate
- New email forwarding rules you didn't create
- Account access that looks unfamiliar in any way

Immediate action:
1. Do not attempt to manage the situation yourself
2. Notify your executive: "I've noticed suspicious activity in [account]. I haven't taken any action yet — please advise how you'd like me to proceed."
3. Document what you observed with timestamps

8. Offboarding Access Revocation

When an engagement ends:
1. Remove your access from every system in the access log — platform by platform
2. Provide your executive with a list of every account you had access to so they can confirm revocation is complete
3. Delete credentials from your password manager
4. Confirm with your executive that all access has been revoked

Timeline: All access should be revoked within 48 hours of the engagement end date.

Do not retain access "just in case." If your executive needs you to help with a specific task after engagement end, they can grant access specifically for that task.

9. Escalation Protocol

Escalate when:
- You discover a security incident (suspicious login, unauthorized access)
- You're asked to share credentials with a third party
- You're asked to access a system that's not in your access agreement

Security escalation format:

URGENT — Security concern:

[What you observed, when, in which platform]

I haven't taken action yet and haven't logged in since noticing this.

Please advise on next steps.

10. Tools & Access

11. Changelog