High-impact

Stop account sharing

Replace shared and default logins with individual accounts, so activity is traceable to a person and access ends when they do.

Back to the Toolkit →

Why this matters

A shared login records that something happened, but not who did it. If unreleased content is downloaded or shared before it should be, a file is deleted, or a setting is changed, the log points at an account rather than a person — and if six people use that account, you cannot tell which one. An investigation has to move fast — the sooner you know what happened, the sooner it can be contained and reported. Individual accounts turn that into checking a record; shared ones turn it into interviewing everybody, which is exactly the delay you cannot afford.

Shared credentials also outlive the people who used them. A password known to a freelancer who finished last spring is still a working key, because nobody changes it when one person moves on. Individual accounts close that door the day someone leaves.

Stop account sharing — checklist

List the logins currently shared: delivery portals, review platforms, storage, the edit suite machines, the studio's own systems, social and billing accounts.
For each one, check whether the service supports individual users. Most do, often at no extra cost — the shared login is a habit rather than a limit.
Create a named account for every person who needs access, and give each the level of access their role actually requires.
Retire the old shared password once everyone has moved across, rather than leaving it working alongside the new accounts.
Where a shared or service account genuinely cannot be split, put its password in a password manager, record who holds it, and change it whenever someone with access leaves.
Stop using default logins that shipped with equipment or software. Rename them where you can and change the password where you cannot.
Make removing accounts part of the leaving process, alongside returning kit and keys, so it happens the day someone finishes.
Review the account list quarterly. Anyone who no longer needs access should not still have it.

Keep going

If this one helped, try another.

Consider these suggestions for what to do next. They either address the same gaps, or are logical next steps.

High-impact Enable MFA Turn on multi-factor authentication for email, file transfer and remote access — one of the most common gaps described in industry security alerts. Fix itThis weekOpen → Start here if you've done nothing else. High-impact Reduce access Give each person access only to the systems and projects their current work requires, review it when their role changes, and remove it the day they leave. Fix itThis weekOpen → Same afternoon, same admin screen. High-impact Check for leaked passwords Free breach-lookup services tell you which of your company addresses appear in known password dumps. Anything that shows up needs changing today. Fix itThis weekOpen → Tells you which accounts to start with. Gap Analysis Find Your Gaps The free TPN Questionnaire measures your current practices against the MPA Content Security Best Practices, giving you a clear picture of your gaps and a route to closing them. Fix itThis quarterOpen → Tells you which fix matters most for you.