Are your Google and social media accounts secure? Do you have a transition policy in place? Social media and marketing tools are constantly evolving, and as employees take time off or move to new positions, it's easy for account access to become unclear. Here are essential tips to ensure your school implements best practices for account security.

School Account Security Best Practices

For most CRMs (Customer Relationship Management tools), social media accounts, and marketing platforms like Google’s Marketing Suite, consider the following:

• Enable 2-Factor Authentication (2FA): For all accounts, enabling 2FA is crucial. This added security layer should be mandatory for all employees to prevent unauthorized access and protect your brand, especially on social media and email marketing platforms.
• Create Multiple Authorized Users: It’s wise to have at least two users with administrative access or knowledge of accessing key accounts. This ensures continuity if one person is unavailable. These should be employees of the school in IT, marketing, and elsewhere.
• Have a minimum access policy. This may be part of your overarching WISP (written information security policy). If not,  you should have this minimum access policy for your marketing accounts which allows the user to have only the privileges that are necessary to perform their intended job function without permissions above that.
• Develop an Employee Transition Plan: Similar to IT protocols for email access when an employee departs, social media access should also be revoked. Document this plan and ensure those involved are aware of the procedures.

Google Account Access Policy

Google, being the leading search platform globally, is a critical hub for marketing data. Schools often use Google Ads, Analytics, Business, sometimes Search Console, and YouTube, all within the Google Marketing Suite. Without proper administrative assignments, schools risk losing valuable data.

• Google School: If you're part of Google Workspace for Education, accessing Google properties is streamlined. Best practice includes using a generic email for marketing, such as marketing@myschool.org, to manage suite products. Ensure IT or a designated person knows these credentials, and enable 2FA for security and transparency.
• Non-Google Schools: If your school uses other services like Microsoft or Outlook for email, consider establishing a marketing Gmail account with IT’s permission. This account should be linked to all Google properties, with two to three individuals having access.

Securing Meta (Facebook & Instagram) Accounts

Meta requires access to its platforms via personal accounts. However, your personal information remains private when managing business assets. A common issue is the absence of a transition plan or backup for extended absences. To avoid these challenges, follow these best practices:

• Avoid Fake Personal Pages: Meta identifies and deletes fake personal profiles used by schools for shared access. Ensure authenticity to prevent account loss.
• Utilize Business Manager: Link all assets to Meta’s Business Manager for comprehensive access management. At least two employees should have super admin access through their personal Meta accounts, ensuring operational continuity.

Business & School Search Directories

• Use a General Email: Similar to the Google accounts strategy, use a general email for directory listings to maintain consistency, with someone in admissions, marketing, and IT all able to manage that profile.
• Maintain a Property List: Track all claimed properties with a simple spreadsheet. Ensure a transition plan for this list, allowing at least two employees to have updated access.

Summary

The cornerstone of preventing data loss, hacking, or access issues to digital accounts lies in robust governance. This includes ensuring multiple administrators are in place, only those who need access have it, employing two-factor authentication, and ensuring your school has a transition policy for planning. Schools must take these policies seriously to safeguard their valuable digital assets.