Make a list of the accounts your team needs to operate: email, booking systems, supplier portals, payments and website management. Record an owner for each service and identify who can change its access settings. This turns a broad security concern into a manageable review.

This guide is an access planning checklist. Use it with your provider’s instructions and the security support appropriate to your organisation. It does not certify a system or promise that an account cannot be compromised.

Start with responsibilities

Write down what each role needs to do. Include ordinary booking work and more sensitive tasks such as changing payment settings or granting access to colleagues. Then compare the available system permissions with those responsibilities.

NIST calls the restriction of access to the minimum needed for assigned tasks “least privilege”. Apply that principle to both staff and connected tools. Source: NIST: least privilege

Test the proposed role with a suitable test account. Include an action that should be permitted and one that should be unavailable. This checks the actual behaviour rather than relying on an account label.

Choose an appropriate sign-in method

Multi-factor authentication uses different types of evidence to verify identity, such as knowledge and possession. Two pieces of the same factor type are not the same as two different factors. Source: NIST: multi-factor authentication

Check the methods available for each service. The NCSC describes FIDO2 as a phishing-resistant approach where the service and devices support it. Its guidance also explains the circumstances in which other methods may be used. Source: NCSC: recommended types of multi-factor authentication

Agree the approach with the person responsible for security. Start with a small trial so the team can check both routine sign-in and the approved fallback before expanding the change.

Assess passkeys in the actual working setup

FIDO describes passkeys as cryptographic credentials that can replace passwords. Some are synchronised between devices and others remain bound to a device, so the implementation matters. Source: FIDO Alliance: passkeys

Ask how the supported arrangement works for office computers, homeworking devices and replacement equipment. Record who manages the relevant device or account. This avoids discovering during a staff change that recovery depends on a personal arrangement nobody documented.

Do not assume a passkey grants the right permissions. Review sign-in and access rights as separate parts of the same account setup.

Prepare recovery before it is needed

Identify the provider’s recovery process and the person authorised to use it. Check that contact details are current and accessible through the agreed route. This gives the business a considered response when a device is lost or a staff member is unavailable.

The NCSC advises keeping backup codes safe where a service provides them. Store recovery material through your approved secure process and test the procedure without exposing real credentials. Source: NCSC: setting up 2-step verification

Keep secret recovery material out of routine handover documents. The handover should identify the owner and approved route, so it remains useful without becoming a second store of sensitive access details.

Review access when work changes

Use joining, role changes and leaving as checkpoints. Record which accounts need to be granted, adjusted or removed and who confirms completion. Include supplier accounts and connected tools, so the review follows the real workflow.

Finally, ask another authorised colleague to follow the documented process for a fictional staff change. Note any missing decision and update the checklist. The aim is a process that can be followed consistently, with evidence of what was checked.

Written and updated by Travelgenix. Sources checked on 16 October 2026. Worked examples and checklists are editorial illustrations and recommendations, not customer results.