Identity, Access Management, and Practical Security for Distributed Teams in Somalia

Treat identity as your primary security perimeter

In a modern Somali organization, business data no longer stays inside a single locked server room. Staff access financial spreadsheets, customer databases, email accounts, and cloud dashboards from office laptops in Mogadishu, smartphones on the move, and partner offices across East Africa. When work happens everywhere, traditional office firewall boundaries are no longer enough.

Practical Cloud & Managed IT security starts with a simple truth: identity is the new perimeter. Controlling who can sign in, from which devices, and to which specific folders prevents the vast majority of business compromises.

Checklist

• Inventory all cloud workspaces, email accounts, accounting tools, social media business managers, and web admin panels.
• Identify every employee, contractor, and external vendor who currently has access to company systems.
• Adopt a Zero-Trust principle: verify identity, device health, and role permissions on every login.

End the habit of shared accounts and WhatsApp password sharing

In many fast-growing SMEs and institutions, three people share a single info@ or finance@ login, and passwords are sent in plain text over WhatsApp whenever a new colleague joins. When an unauthorized transfer occurs or a critical file is deleted, there is no audit trail showing who performed the action—and changing the password disrupts everyone at once.

Assign an individual named account to every employee and contractor. Use shared mailboxes or role-based delegation groups so multiple staff can collaborate on info@ or support queues using their own unique credentials and individual audit logs.

Checklist

• Eliminate shared password logins for info@, sales@, finance@, and social media accounts.
• Issue an individual named corporate account ([email protected]) to every team member.
• Use delegated shared mailboxes and role groups so actions remain traceable to an individual user.

Enforce multi-factor authentication across email, cloud, and finance

Business email compromise and credential phishing remain the top threats facing regional companies. A single stolen password for an executive email account allows an attacker to intercept vendor invoices, alter payment instructions, or reset passwords for connected banking and social media platforms.

Make multi-factor authentication (MFA) mandatory for every user across your cloud workspace, accounting platforms, CRM, and website admin panels. Separate global administrator privileges into dedicated admin-only accounts protected by hardware security keys or authenticator apps rather than SMS codes alone.

Checklist

• Enforce mandatory Multi-Factor Authentication (MFA) across 100% of user and administrator accounts.
• Prefer authenticator apps or hardware security keys over SMS-based codes for financial and admin accounts.
• Separate daily user accounts from privileged Global Administrator accounts.

Standardize joiner, mover, and leaver checklists

Security gaps accumulate quietly over time when employees change departments or leave the organization without a formal offboarding checklist. Months after a contractor finishes a project, their account often still has full access to company Google Drive folders, source code repositories, or Facebook Business Manager.

Document a strict ‘Joiner, Mover, Leaver’ operating procedure aligned with our risk-first cloud migration framework. Grant new hires only the role-based permissions required for their department, review access when roles change, and revoke all active sessions and tokens within one hour of an employee’s departure.

Checklist

• Implement a documented Joiner-Mover-Leaver (JML) checklist managed jointly by HR and IT.
• Revoke all active login sessions, API tokens, and shared folder permissions within 60 minutes of an employee’s departure.
• Conduct a quarterly access audit to remove dormant contractor accounts.

Protect domain authenticity with SPF, DKIM, and DMARC

Even if your internal email accounts are secure, attackers can spoof your company domain name to send fraudulent invoices or phishing links to your clients and suppliers unless your DNS records explicitly forbid unauthorized senders. A single spoofed email campaign can damage years of hard-earned brand trust.

Configure and verify SPF, DKIM, and enforced DMARC policies on your primary domain alongside your Websites & Software hosting setup. Proper email authentication protects your clients from impersonation and significantly improves the deliverability of your legitimate business emails.

Checklist

• Configure and verify SPF, DKIM, and DMARC (p=quarantine or p=reject) records on your corporate domain.
• Set up external-sender warning banners on incoming emails that mimic executive names.
• Require out-of-band voice verification before approving any change to supplier bank or mobile money details.

Protect mobile endpoints with practical device policies

Because employees in Somalia rely heavily on smartphones for work email and messaging, a lost or stolen handset with no screen lock gives immediate access to corporate data. You do not need intrusive surveillance software to manage this risk.

Use built-in mobile device management (MDM) controls within Google Workspace or Microsoft Intune to require device screen locks, encrypt work profiles separately from personal photos, and allow IT administrators to remotely wipe only the corporate workspace container if a phone is lost.

Checklist

• Enforce screen-lock PIN/biometrics and storage encryption on all smartphones accessing work email or files.
• Use containerized work profiles on mobile devices so corporate data can be wiped remotely if a phone is lost without erasing personal photos.
• Keep operating systems and browsers patched automatically across all office laptops.

Frequently asked questions

Why is sharing a single info@ password across three staff members dangerous?

When multiple people share one password, you have zero audit trail if sensitive emails are deleted or leaked, you cannot enable personal multi-factor authentication cleanly, and when one employee leaves the company, changing the password disrupts everyone else.

What is the fastest way to protect our company from email spoofing and invoice fraud?

Enable multi-factor authentication on every email account, configure SPF, DKIM, and DMARC records on your domain DNS so criminals cannot impersonate your domain, and require a phone call to verify any change in payment instructions.

What happens if an employee loses their smartphone with company email logged in?

With proper mobile identity management in Google Workspace or Microsoft 365, your IT administrator can remotely sign out and wipe the corporate work profile in sixty seconds without touching the employee’s personal files.