Designers and freelancers often hold access to client files, brand assets, websites, and project accounts. Protecting those accounts and keeping recoverable copies of work can limit the damage from a lost device or compromised login. No checklist can keep every attacker away, but these steps make common problems less likely and give you a response plan.
If you work alone or run a small studio, start with the accounts and files you could least afford to lose. NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide can help a small organization prioritize security work without assuming it has a dedicated IT team.
1. Secure the accounts that unlock everything
Start with your primary email, password manager, design tools, cloud storage, domain registrar, website, and payment accounts. Use a unique password for each account and store it in a password manager rather than reusing a password across clients or services.
Turn on multifactor authentication (MFA) wherever it is available, especially for email and file storage. Use a passkey or another phishing-resistant method when a service supports one. Store recovery codes somewhere separate from the device and account they unlock, and make sure you can still access your recovery email or phone. NIST's digital identity guidance explains authentication options in more technical detail.
Avoid shared logins for client work. Give each collaborator their own account when possible, and remove temporary access when the project ends.
2. Keep your devices and design tools supported
Install operating-system, browser, design-app, and security updates promptly; turn on automatic updates where they are reliable. Stop using software or operating systems that no longer receive security fixes, and remove browser extensions, plugins, and apps you no longer need. Download tools from their official sources and review the permissions they request.
Lock your screen when you step away. Enable full-disk encryption on devices that store client files, and use a strong device sign-in method. If you want more device-specific ideas, see our guide to keeping your laptop safe and secure.
3. Share client files with the least access needed
Agree with each client on where files should live and who should be able to access them. Share with named accounts and grant only the permissions needed for the task. Before sending a link, check whether it is public, whether recipients can edit or download, and whether you can set an expiry. If a public link is required for a preview, limit what it contains and remove the link when it is no longer needed.
Use separate project folders or workspaces where practical. Do not send a password in the same message as the file link, and do not keep client material in a personal account without the client's approval. Our guide to secure online file sharing covers additional sharing controls.
Encrypted storage can be useful for sensitive files, but encryption alone does not control who you share with or guarantee recovery. NordLocker describes one encrypted-storage option; check any provider's account recovery, collaboration, and export options against your client requirements.
4. Keep a backup you can restore
Cloud sync is convenient, but a synced deletion or compromised account can affect synced files too. Keep another copy of active work in a separate location or account with access controls that are not always writable from your main device. Use version history when available, and periodically restore a sample file so you know the backup is usable.
Decide what you need to retain, where it is stored, and when it should be deleted in line with your client agreement. NIST's small-business ransomware guidance includes preparation and recovery resources.
5. Verify unusual requests before acting
Phishing can arrive by email, text, chat, or a shared-file notification. Be cautious of unexpected sign-in links, attachments, requests to install a plugin, or urgent changes to payment or file-sharing details. A familiar display name or logo is not proof that a message is genuine. Open the service from a saved bookmark or type its address yourself, and verify unusual requests through a phone number or contact method you already trust.
NIST's phishing guidance for small businesses recommends checking suspicious requests through known contact information. Microsoft's phishing guidance also explains common warning signs.
6. Know what to do if an account or device is compromised
Use a trusted, clean device to change the affected account's password, revoke active sessions, and review recovery details and connected apps. Contact the service provider through its official support channel. If client files or credentials may be exposed, tell the client promptly and follow your agreement and applicable reporting requirements. Keep suspicious messages and other useful evidence rather than forwarding them to more people.
When a project ends, review shared links, collaborator accounts, and local copies of client files. Remove access you no longer need, and retain or delete files according to the agreed schedule. For broader planning, see our guide to cybersecurity best practices.
Cover photo by Antoni Shkraba
