How access controls help protect a business

A client asks for a signed report. The shared drive has a draft, but the approved copy is in the WhatsApp history of an employee who left three months ago. The team can still call the former employee. What happens if that person has lost their phone?

Access controls help a business keep work available to the people who need it and restrict who else can reach it. Start by asking which accounts and devices can open a client file, where copies can go and what happens to access when someone leaves.

Businesses in Uganda have different capacities to absorb a serious IT incident. An institution such as the Bank of Uganda can draw on resources that are out of reach for many small businesses. A smaller firm that spends a week recovering still has to pay salaries and find money for emergency support, even as client work and income are delayed. If confidential records are exposed, the business also has to answer to the people who entrusted it with that information. For some firms, that combination can threaten their ability to stay open.

At Uganda’s inaugural National Cybersecurity Conference, the Uganda Communications Commission called for stronger leadership, accountability and preparedness for cyber incidents.¹ For a business owner, preparedness starts with knowing which systems the team relies on and what would happen if they failed. We recommend a six-month technology review built around what staff can demonstrate.

Recovery starts with knowing what work would stop

If the office internet goes down at 9 a.m., which jobs can still move? If a laptop fails, can its user pick up their work on another machine? Start with the last fault someone reported. Find out who dealt with it, how long the employee waited and whether the same problem came back.

Then ask someone to restore an important file from backup to a safe location. Open it, check its date and record how long it took to recover. If the newest copy is from last Thursday, work out what the team would have to recreate. Check who can access the backup and who could restore it if the usual person were away. Compare what the team can demonstrate with the downtime and lost work the business can afford.

Everyday shortcuts can take company information outside its control

WhatsApp may be where a client replies fastest. When it also holds the only record of what the client approved, a routine handover can depend on someone’s personal phone. We recommend keeping internal work communications in a company-managed Teams or Slack workspace. When a client decision comes through another channel, staff should know where to record it. Ask someone who missed the last project meeting to find the current document and explain what the client agreed to.

Follow a new employee from their first sign-in to their first client file. Who set up the laptop and issued the work account? If the company uses a domain, has the device been joined to it? If five Wi-Fi networks show up in the office, can the team explain which are for guests and which can reach company systems? Using a test file and an ordinary staff account, check what the employee can open, download or share from a personal laptop at home. Then check who removes that access when the employee leaves.

For remote staff, a firewall can filter incoming connections and a VPN can provide an encrypted route into the network. The business still needs to decide which accounts and devices can open each system or file. Test that last step with an ordinary staff account, including from a device the company has not approved.²

A client is waiting for a document. The latest version is on an employee’s personal laptop, so they copy it to a USB drive and bring it into the office. If the laptop is infected with malware that spreads through removable drives, the same USB drive can carry it to a company computer.

At your next technology review, give the team that scenario and ask them to show how they would get the document onto a work computer. If they reach for a USB drive, ask what makes that the easiest option. The approved route has to work when a client is waiting, too.

A familiar sender can still send an unsafe file

A client sends a file called Signed Report.pdf. It arrives when the team expects it and has the right name. The contents could still be a JavaScript file renamed with a .pdf extension.

For businesses that regularly exchange sensitive documents with clients, a client portal can give both sides an approved place to send and retrieve files. Apply the zero-trust principle to access by verifying who is signing in and what they’re allowed to do.² Then check the upload itself. A portal can verify that the contents match an accepted file type and scan files for malware before staff can download them.³ At the next review, use a harmless test file to see what happens when its contents don’t match its extension.

These controls in the age of AI

An employee has fifteen minutes to prepare for a meeting. They pay $20 a month for an AI subscription, so they paste in the client report and get a summary. The business needs to know where the report was processed, whether a copy was kept and who can see it. It also needs to know whether the employee had an approved way to do the same work.

If staff are already paying for AI individually, find out what they spend and which tasks come up often enough to justify a shared tool. A company-managed model on a rented cloud server is one option to evaluate. Hosting it away from the office can keep it available to staff who have a connection elsewhere during an office power or internet outage. Compare existing subscription spend with the cost of hosting and maintaining the model. Before approving it for sensitive work, decide who can sign in, what they can upload, how long files and chats are kept, and what the hosting provider can access.

Make it easier for clients to trust how their information is handled

In Deloitte’s 2023 US consumer survey, only 34% of respondents felt companies were clear about how they used data collected through online services.⁴ When asking a client to share confidential information, explain why it is needed, who can access it and how long it will be kept. If AI is used to process it, explain what goes into the tool and what happens to any retained copy. Tell clients whom to contact if they have a question or upload the wrong document.

Use the six-month review to see whether those explanations match what happens in practice. If the team still needs a former employee’s phone to find the signed report, or a personal AI account to summarise it, give staff an approved route they can use when a deadline is close. A business that can explain how it handles sensitive information and show that its staff follow through gives clients a reason to choose it.

Endnotes

1. Uganda Communications Commission, Securing Uganda’s Digital Future, August 2026.
2. National Institute of Standards and Technology, Zero Trust Architecture (SP 800-207), August 2020, and Guide to Enterprise Telework, Remote Access, and Bring Your Own Device Security (SP 800-46 Rev. 2), July 2016.
3. OWASP Foundation, File Upload Cheat Sheet.
4. Deloitte Insights, Data privacy and security worries are on the rise, while trust is down, September 2023.