Employees and shared security responsibility

Editorial update: 21 September 2026. Introductory learning material.

Security depends on usable systems, clear responsibilities and people who can ask for help. Employees should not have to make complex technical decisions without support.

• Use approved accounts, tools and sharing methods.
• Report suspicious messages, unexpected authentication prompts and lost devices promptly.
• Follow the organization’s access and data-handling procedures.
• Ask for help when a requested task conflicts with a security rule.

Managers should make reporting easy, explain the response process and address system or workflow weaknesses as well as training needs.

Activity: Confirm where you would report an unexpected sign-in prompt and what information the support team needs.

Reference: CISA small-business resources. Check the source and your system provider’s current instructions before implementation.