Why Daily Operations May Be Undermining Your Data Protection

By VaultTek | September 22, 2026

Most organizations do not intentionally create data-security risks.

Employees are trying to get work done. A deadline is approaching. Someone needs a file quickly. A password is difficult to remember. Multi-factor authentication adds another step. Saving something to the desktop feels faster than navigating to the approved shared location.

In the moment, the shortcut often feels harmless. 

“It’s just easier this way.”

And most of the time, nothing happens.

The file is retrieved. The employee logs in. The work gets completed. Operations continue normally.

That is precisely why these habits can persist for years.

The problem is that cybersecurity incidents rarely begin with an organization deliberately choosing to leave itself vulnerable. More often, risk accumulates quietly through everyday decisions – shared credentials, reused passwords, files stored only on local devices, unnecessary access privileges, skipped security steps, haphazard data backups, and workarounds that become routine simply because they are convenient.

Each decision may seem small.

Together, they can undermine an otherwise strong data-protection strategy – creating unnecessary vulnerabilities, allowing important information to fall outside protected systems, or making recovery more difficult when something goes wrong.

September is the Federal Emergency Management Agency’s (FEMA) National Preparedness Month, making it a useful time to look beyond disaster plans and emergency procedures and consider another form of readiness: Are the everyday habits inside your organization helping protect your data – or quietly making recovery more difficult?

Preparedness does not begin when something goes wrong.

It is built into what happens every day.

The False Sense of Security in “It’s Just Easier This Way”

Most employees are not thinking about cybersecurity every time they access a system or save a document.

They are thinking about doing their jobs.

That is understandable. Technology should support operations, not make routine work unnecessarily difficult.

But convenience can create its own form of false confidence.

Common operational habits may sound like:

• “We all use this login because everyone needs access.”
• “I save important files to my desktop so I know where they are.”
• “That system doesn’t require MFA, so we haven’t turned it on.”
• “I use the same password for several work accounts because it’s easier to remember.”
• “We’ve always done it this way.”
• “Only a few people use that old system.”
• “I’ll move the file to the shared drive later.”
• “IT knows we use this workaround.”
• “It’s only temporary.”

Temporary practices have a way of becoming permanent ones.

And once a workaround becomes part of normal operations, people often stop seeing it as a risk.

That matters because data protection is not defined only by the security tools an organization purchases. It is also influenced by how employees actually use systems, where information actually resides, who actually has access, and whether established protections are followed during normal work.

An organization can have firewalls, antivirus software, cloud platforms, an IT provider, and reliable backup systems and still create unnecessary exposure through everyday behavior.

Technology provides the guardrails.

Daily operations determine whether people stay inside them.

Routine Operations Are Part of Your Security Environment

In our May article, we discussed why having IT support is not the same as having an organization-wide data-protection strategy.

One reason is particularly relevant here: IT cannot control every decision an employee makes throughout the workday:

• An IT team can configure systems.
• It can establish access controls.
• It can implement backup.
• It can provide security tools.

But employees still decide where they save files, how they handle passwords, whether they report suspicious activity, whether they follow approved processes, and whether they look for shortcuts when security controls become inconvenient.

That means everyday operations are not separate from cybersecurity or data protection.

They are part of both.

Where employees save information, how they access it, who can reach it, whether critical files are included in protected backups, and whether established security practices are followed all influence how exposed – and how recoverable – an organization may be when something goes wrong.

For courts, local governments, professional organizations, and other entities responsible for essential records, a small operational shortcut can affect far more than one employee or one computer.

It can affect whether information is protected, whether activity can be traced, whether compromised access can be shut down quickly, and whether essential data is available for recovery.

Consider a few common examples: 

1. Shared Passwords: Convenient Until Something Goes Wrong

A department has a system several people need to use. Instead of creating individual accounts, everyone uses the same username and password.

Operationally, it seems efficient. From a security standpoint, it creates several problems:

• If the password is compromised, it may be difficult to determine whose activity is legitimate and whose is not.
• If an employee leaves the organization, changing that person’s access may mean changing credentials for everyone.
• If the password is reused elsewhere, one compromised account can create opportunities to access additional systems.

And if the credentials are written down, emailed, stored in a document, or passed between employees informally, the organization may no longer know exactly who has them.

The better practice is straightforward: 

1. Employees should have individual accounts whenever systems allow it.
2. Passwords should be long and unique.
3. Organizations should use approved password-management tools instead of relying on employees to remember – or share – credentials.

Cybersecurity & Infrastructure Security Agency (CISA) identifies strong, unique passwords and organization-wide password managers among the foundational cybersecurity practices for state, local, tribal, and territorial governments.

The objective is not to make logging in harder. It is to make unauthorized access harder.

2. Skipping MFA: Removing an Important Second Barrier

Passwords are stolen every day.

They can be captured through phishing, malware, credential-stealing software, data breaches, data theft or password reuse across multiple services.

That is why multi-factor authentication has become such an important layer of protection.

MFA requires another form of verification beyond the password itself. Even when a password has been compromised, that additional step can prevent the attacker from simply logging in.

Yet MFA is sometimes treated as an inconvenience.

Employees may complain about the extra step. Older applications may require additional configuration. Organizations may turn it on for some accounts but leave others unprotected.

That can create exactly the opening an attacker needs.

CISA recommends requiring MFA wherever possible, particularly for email, file storage, remote access, privileged accounts, and employees handling sensitive information.

The strongest available methods should be used where practical, but the larger lesson is simple: A password should not be the only thing standing between an attacker and essential organizational data.

3. Saving Files Locally: Accessible Does Not Mean Protected

Another common shortcut is saving important documents only to a desktop, laptop, downloads folder, or other local location.

Employees often do this because it feels faster.

They know where the file is. They can open it immediately. They may intend to move it to the proper location later.

But locally stored data can fall outside centralized protection depending on how the organization’s systems are configured.

If that device fails, is stolen, becomes corrupted, is infected with ransomware, or has to be replaced quickly, the organization may discover that the important information existed in only one place.

This connects directly to a concept discussed in our March article: Saving data is not the same as backing it up.

A file sitting safely on an employee’s computer today may be accessible, but that does not necessarily mean the organization has a separate, versioned, protected, and recoverable copy.

For courts and organizations managing essential records, employees should understand where official records belong and why.

The approved storage location is not simply an organizational preference. It may be what allows that information to be properly secured, retained, backed up, monitored, and recovered.

4. Access That Never Gets Removed

Daily operations also create risk when access accumulates over time:

• An employee changes departments but keeps permissions from the previous job.
• A temporary contractor receives access that is never removed.
• A former employee’s account remains active.
• An administrator uses the same privileged account for routine work.
• A vendor receives broader access than necessary because narrowing permissions takes additional time.

None of these situations may cause an immediate problem. But each expands the number of paths someone could potentially use to reach organizational systems and data.

Access should follow a simple principle:

• People should have the access they need to perform their responsibilities – and no more.
• Organizations should regularly review user accounts, disable inactive accounts, limit administrative privileges, and adjust access when roles change.

Again, the goal is not bureaucracy. It is reducing unnecessary opportunity.

5. When Workarounds Become the Way Work Gets Done

Perhaps the most difficult operational risk is the workaround everyone knows about:

• The approved process is cumbersome, so employees created another one.
• Documents get emailed to personal accounts.
• Files are moved through consumer cloud-storage services.
• Information is downloaded to a local computer because a system is slow.
• Several employees share one login.
• Updates are postponed because restarting would interrupt the workday.
• A legacy application remains in service because replacing it would be complicated.

Individually, each decision may have a reasonable operational explanation.

But when workarounds become routine, organizations can develop two different environments:

• The environment leadership and IT believe exists.
• And the environment employees actually use.

Data protection must account for the second one.

That is why leaders should not simply ask whether policies exist. They should ask whether those policies reflect how work is really being done.

6. Small Shortcuts Can Create Large Gaps

One reason these habits are easy to overlook is that nothing appears broken.

> Shared credentials still work.

> The file saved to the desktop is still there.

> The employee without MFA still logs in successfully.

> The old account remains dormant.

> The workaround keeps the department moving.

Everything looks normal.

Until it is not.

The security problem may remain invisible until:

• A password is compromised
• A laptop fails
• An employee leaves
• A ransomware attack begins
• A phishing email succeeds
• Someone accidentally deletes a file
• A device is lost or stolen
• An attacker uses an old account
• A critical record cannot be found during recovery

This is similar to the backup problem we have discussed in previous VaultTek articles. It also reinforces the framework behind our Risk Management series: identify the risk, understand what it could affect, and determine what needs to be in place to reduce the impact and support recovery.

Real-World Example: Change Healthcare

The 2024 Change Healthcare cyberattack provides a dramatic example of how one missing security control can have consequences far beyond the system where the weakness exists.

According to information presented to a U.S. Senate committee, attackers used compromised credentials to access a legacy Citrix remote-access portal that did not have multi-factor authentication enabled.

The attack ultimately caused widespread disruption throughout the U.S. healthcare system, affecting the processing of prescriptions, claims, payments, and other essential services.

Change Healthcare is obviously a larger organization than most courts, municipalities, or professional firms.

But that is not the point. The important lesson is how access began.

Not with some futuristic technology or impossibly sophisticated scenario.

Compromised credentials reached a system that lacked an additional authentication layer.

One ordinary security control mattered.

That is exactly why routine practices deserve leadership attention.

National Preparedness Month: Readiness Starts Before the Emergency

Every September, FEMA’s National Preparedness Month encourages Americans to prepare before emergencies occur.

FEMA’s 2026 theme, “Americans Stand Ready,” emphasizes resilience, resourcefulness, and taking practical action before a disaster.

Although the campaign focuses broadly on emergency preparedness, the principle applies equally well to organizational data.

1. You cannot build readiness after the disruption has already started.
2. You cannot retroactively turn on MFA before stolen credentials are used.
3. You cannot move a locally stored file into protected backup after the laptop containing the only copy has failed.
4. You cannot reconstruct access records that never existed because everyone shared one login.
5. You cannot define recovery priorities for the first time while systems are unavailable and employees are waiting for direction.

Preparedness happens during ordinary days.

That makes National Preparedness Month an excellent opportunity to look not only at emergency plans, but at the small operational practices that determine whether the organization will truly be ready when those plans are needed.

A Practical Preparedness Review: Look at How People Really Work

Leaders do not need to become cybersecurity experts to improve daily security practices. They do need to understand how work is actually being done.

One useful exercise is to bring together leadership, IT, department heads, records management, and employees who understand day-to-day workflows and ask:

PASSWORDS AND ACCESS

• Does every employee use an individual account where possible?
• Are any passwords routinely shared among employees?
• Are passwords being stored in spreadsheets, documents, email, or handwritten notes?
• Does the organization provide an approved password manager?
• Are passwords unique across systems?
• Are inactive employee and vendor accounts removed promptly?
• Are user permissions reviewed when employees change roles?
• Are administrator privileges limited to employees who actually require them?

MULTI-FACTOR AUTHENTICATION

• Which systems currently require MFA?
• Does MFA protect email?
• Does it protect remote access?
• Does it protect administrative accounts?
• Are there legacy systems that do not support it?
• Has leadership been made aware of those exceptions and the associated risk?

FILE STORAGE

• Where are employees expected to save important organizational data?
• Is critical information stored on individual desktops or laptops?
• Are employees using personal email, USB drives, or unapproved cloud services to move files?
• Is everything considered an essential record included in the organization’s backup strategy?
• Would IT know where to find the information employees need most during recovery?

DAILY WORKFLOWS

• Which security processes do employees routinely describe as inconvenient?
• What workarounds have developed as a result?
• Are those workarounds known to IT?
• Are policies aligned with how departments actually operate?
• Do employees know how to report a security concern quickly?
• Would they feel comfortable reporting a mistake immediately?

The final question is especially important.

Employees sometimes delay reporting suspicious activity because they are embarrassed that they clicked a link, downloaded something, or entered credentials where they should not have.

Speed matters.

A culture that encourages immediate reporting is far more valuable than one in which employees try to hide mistakes.

The objective should not be to blame people for creating risk.

It should be to identify where every day processes make risky behavior easier than secure behavior.

Then fix the process.

Four Small Changes That Can Make a Meaningful Difference

CISA identifies four foundational cybersecurity practices for state, local, tribal, and territorial governments: phishing training, strong passwords, multi-factor authentication, and keeping software updated.

For organizations reviewing their own daily habits, that provides a useful starting point.

1. Make Secure Access Easier

Provide employees with individual accounts and an approved password manager.

If the secure way of working requires employees to remember dozens of complex passwords on their own, people will naturally create shortcuts.

Give them better tools.

2. Require MFA Where It Matters Most

Start with remote access, email, administrative accounts, file-storage systems, and systems containing sensitive or mission-critical information.

Then identify remaining systems where MFA cannot be enabled and treat those gaps as known risks requiring mitigation.

3. Make Approved File Storage the Easy Choice

Employees should know exactly where organizational records belong.

Approved platforms should be accessible, understandable, and incorporated naturally into workflows.

If employees consistently save information elsewhere because the approved process is difficult, address the process rather than assuming additional policy language will solve the problem.

4. Review Accounts and Access Regularly

Build account review into normal operations.

When employees leave, change positions, or no longer require a system, access should change with them.

Do not allow yesterday’s permissions to become tomorrow’s vulnerability.

But Good Habits Still Need a Recovery Plan

Strong operational practices reduce risk.

They do not eliminate it.

An employee can make every correct decision and the organization can still experience hardware failure, ransomware, data corruption, software vulnerabilities, severe weather, power loss, vendor outages, or other disruptions.

That is why prevention and recovery must work together.

As discussed throughout our previous VaultTek articles, true resilience requires independent, protected, and recoverable copies of essential data.

The 3-2-1 backup methodology remains an important baseline:

• 3 copies of your data
• 2 different types of storage media
• 1 copy stored offsite

VaultTek strengthens that model through triple-redundant protection that includes secure on-site backup and two geographically separate, U.S.-based off-site backups.

Because even when strong operational practices reduce the likelihood of something going wrong, organizations still need confidence that essential data can be restored when it does.

Preparedness requires both.

From Operational Risk to Vault-Tight Protection

Preparedness is not one policy, one cybersecurity tool, or one backup appliance.

It is a combination of people, processes, technology, and recovery planning working together to protect the information your organization depends on.

For courts, local governments, and organizations responsible for essential records, daily operating practices should strengthen that protection – not quietly work against it.

At VaultTek, our vault-tight approach to data protection is grounded in the proven 3-2-1 backup methodology. VaultTek provides triple-redundant protection through secure on-site backup and two geographically separate, U.S.-based off-site backups, supported by proactive monitoring and personalized service.

That layered structure provides a reliable recovery path even when primary systems, local infrastructure, individual devices, or other components are compromised.

Because standing ready is not something you decide to do when disruption begins.

It is something you build into the way your organization works every day.