Control who can reach a document, from which device, and for how long.

Start with the resource

Protect the document—not only the network around it

Traditional security often begins with a trusted office network. Modern document work is spread across laptops, phones, cloud drives, client portals, collaboration suites, and remote sessions. That makes the document and the service hosting it the practical center of the access decision.

A VPN can create a protected route to a private application, but it should not automatically make every person and device on that route trusted. A more useful question is: what evidence must be present before this specific user can perform this specific action on this specific file?

Use the VPN for remote work guide to understand the network layer, then add the identity and authorization controls described here.

Five decision points

Build access one layer at a time

Strong document access is a chain. If one link is weak—such as a shared account, an unmanaged device, or a public link—the surrounding controls may not prevent disclosure.

Least privilege

Give people enough access to complete the task—then stop

Permissions should follow the work rather than organizational habit. A reviewer may only need view and comment rights. A temporary vendor may need one project folder for two weeks. A finance team may need download rights while a wider group only needs a rendered preview.

Prefer named recipients over anonymous links. Use groups for stable roles, but review group membership regularly. Set expiration when the business need is temporary, and make revocation part of the project-close checklist rather than an improvised cleanup step.

When a document must cross organizational boundaries, confirm who owns the destination account and whether the recipient can forward, download, or re-share the file. The encrypted file sharing guide provides a detailed sharing checklist.

Session controls

Access is not a one-time event

A sign-in can be valid while the surrounding context changes. The device may become noncompliant, an account may be disabled, or a user may move from a known location to an unusual one. Higher-risk workflows can use shorter sessions, reauthentication before downloads, and alerts for bulk access or unusual sharing.

Avoid treating activity logs as proof that content stayed safe. Logs are evidence about events, not prevention by themselves. Decide which events matter, who reviews them, and what action follows when something looks wrong.

Practical baseline

A minimum secure-access standard for small teams

This baseline is intentionally simple. It creates visible ownership and repeatable decisions without pretending one configuration fits every industry, legal obligation, or threat model.

• Every person uses an individual account; shared credentials are removed.
• Multi-factor authentication is required for the document platform and identity provider.
• Sensitive folders default to private, with named-recipient sharing instead of public links.
• Editing, downloading, external sharing, and administrative access are separate permissions where the platform allows it.
• Personal devices follow a documented rule, including updates, screen lock, storage, and remote removal of work data when possible.
• Access is reviewed at project close, role change, and offboarding.