Skip to main content
    Back to all articlesOnboarding & Management
    • 12 min read•520 reads

    First VA Security Checklist: Hire Without Risk

    A step-by-step security checklist for hiring your first VA: the Verify to Limit to Monitor to Review to Revoke framework, four phases from before hiring to.

    Quick Answer

    A step-by-step security checklist for hiring your first VA: the Verify to Limit to Monitor to Review to Revoke framework, four phases from before hiring to.

    Key Takeaways

    • Create unique user accounts, use a password manager with shared vaults, enable MFA on every account, apply least-privilege access, and document each permission in an access log.
    • No.
    • No.
    • Remove all access the same day, rotate any shared credentials that were exposed, transfer ownership of documents and accounts, archive business data, verify no active sessions remain, and document the offboarding in your access log.

    What First VA Security Checklist Is

    A step-by-step security checklist for hiring your first VA: the Verify to Limit to Monitor to Review to Revoke framework, four phases from before hiring to.

    Continue Reading

    AI Automation Engineer, PropulseVA

    Marjohn Robillo

    Foundational Revenue Operations & AI Automation Partner (since 2021)

    Marjohn Robillo is a foundational partner and independent revenue operations consultant for PropulseVA. Collaborating with PropulseVA since 2021, he architects enterprise-grade AI automation systems, multi-channel CRM pipelines, and autonomous workflow engines for service businesses, agencies, and franchises across North America, Australia, the UK, and the Philippines. Marjohn is a highly accomplished freelancer and RevOps engineer who has architected over 300 live conversion systems globally.

    • Licensed Financial Advisor in Philippines Insurance Commission
    • Licensed Professional Teacher (LPT)
    • Former College Instructor
    • MPA Graduate & Certified CRM Systems Architect
    • Former CO1 · Bureau of Corrections PH
    First VA Security Checklist: Hire Without Risk

    Executive Summary

    Hiring your first virtual assistant does not have to be risky if you follow a structured security process. The most common mistakes — sharing a master password, granting blanket admin access, skipping MFA, or failing to plan offboarding — are preventable. This checklist walks you through four phases: before hiring, during onboarding, during employment, and offboarding. Use the VERIFY → LIMIT → MONITOR → REVIEW → REVOKE framework. These practices apply to all remote workers regardless of country — geography does not determine trust, access controls do.

    The VERIFY → LIMIT → MONITOR → REVIEW → REVOKE Framework

    VERIFY

    Confirm identity and work evidence before granting any access. References, portfolio, and a paid test task validate skill and reliability.

    LIMIT

    Grant least-privilege access — only what the role requires, through unique user accounts and a password manager.

    MONITOR

    Enable login alerts, document processes, and set clear device and security expectations.

    REVIEW

    Audit access periodically. Remove what is no longer needed as the role evolves.

    REVOKE

    When the engagement ends, remove access immediately, rotate shared credentials, and verify no active sessions remain.

    For the broader onboarding process, see our 30-day onboarding guide and our secure password sharing guide.

    Phase 1: Before Hiring

    • Verify identity and request references or work evidence.
    • Define exactly what data and systems the role requires.
    • Classify systems by sensitivity (public, internal, financial, customer data).
    • Choose a password manager with shared vaults (e.g., 1Password, Bitwarden).
    • Plan unique user accounts for every platform the VA will touch.
    • Prepare a written access scope before day one.

    If this is your first VA, see our first VA guide for the full hiring journey.

    Phase 2: During Onboarding

    • Create unique user accounts — never share your master login.
    • Store all credentials in the password manager's shared vault, never in chat or email.
    • Enable MFA/2FA on every account that supports it.
    • Apply least privilege: grant the minimum access the role needs.
    • Use role-based permissions where platforms support them (CRM, email, social).
    • Avoid sharing banking credentials casually; use limited-access or read-only tools where possible.
    • Document each permission granted in an access log.
    ResourceRecommended Access MethodAvoidReview Frequency
    EmailUnique delegated account / role-basedSharing master passwordMonthly
    CRMUnique user with scoped roleFull admin by defaultMonthly
    Social mediaPlatform role / manager accessPersonal login sharingMonthly
    Banking/accountingLimited/read-only or accountant roleFull banking loginBi-weekly
    Shared filesFolder-level permissionsRoot drive accessMonthly
    Website CMSEditor/author roleAdministrator roleMonthly

    Phase 3: During Employment

    • Enable suspicious-login alerts on key accounts.
    • Conduct periodic access reviews — remove unused permissions.
    • Maintain documented SOPs so the VA never needs ad-hoc credential sharing. See our SOP framework guide.
    • Set clear device and security expectations (updates, antivirus, no public Wi-Fi for sensitive work).
    • Use time tracking or activity reporting only where it improves operational clarity, not for surveillance. See our time tracking guide.

    Phase 4: Offboarding

    • Remove all access the same day the engagement ends.
    • Rotate any shared credentials that were exposed.
    • Transfer ownership of any documents, files, or accounts the VA created.
    • Archive business data and confirm no active sessions remain.
    • Revoke password manager vault access and review shared links.
    • Document the offboarding in your access log.

    Common First-VA Security Mistakes

    • Sharing a single master login instead of creating a unique user account.
    • Granting full admin access "to make things easier."
    • Sending passwords over chat or email instead of a password manager.
    • Skipping MFA because it feels inconvenient.
    • No offboarding plan — access lingers after the VA leaves.

    A Note on Offshore Workers

    These security practices apply to all remote workers, regardless of country. Offshore workers are not inherently higher risk. Trust is built through verification, limited access, monitoring, and clean offboarding — not through assumptions about nationality.

    Next Step

    If you want a VA engagement with structured onboarding and security practices, explore PropulseVA's managed virtual assistant support.

    Frequently Asked Questions

    How do I securely onboard my first virtual assistant?+

    Create unique user accounts, use a password manager with shared vaults, enable MFA on every account, apply least-privilege access, and document each permission in an access log. Never share your master login. Follow the VERIFY → LIMIT → MONITOR → REVIEW → REVOKE framework.

    Should I share my password with a VA?+

    No. Use a password manager's shared vault instead of sharing raw passwords. Create unique user accounts for each platform the VA accesses, and enable MFA. If a platform only allows one login, use a delegated or role-based access feature where available.

    Are offshore VAs a higher security risk?+

    No. Security depends on access controls — unique accounts, MFA, least privilege, and clean offboarding — not geography. These practices apply to all remote workers regardless of country.

    What should I do when a VA leaves?+

    Remove all access the same day, rotate any shared credentials that were exposed, transfer ownership of documents and accounts, archive business data, verify no active sessions remain, and document the offboarding in your access log.

    Ready to hire your AI-trained VA?

    Get matched with top 1% Philippine talent, fully vetted and equipped.

    Book a Free Audit