How do I control who can access which business systems?

Give access based on job responsibility, not convenience. Use named accounts, role-based permissions where available, multi-factor authentication, and a process for approving, changing, and removing access. Review higher-risk access regularly and remove old accounts quickly.