Sharing Files Safely: Permissions, Links and Outside Partners

Practical habits for sharing files and data safely when you collaborate, based on FTC, CISA and NIST guidance for small organizations.

Collaboration Center · Last reviewed October 23, 2026 · 6 min read

Collaboration means sharing: drafts with colleagues, contracts with partners, spreadsheets with an accountant, photos with an agency. Each share is a small decision about who can see what, for how long, and what they can do with it. A lot can go wrong without any sophisticated attack: a link that was never turned off, a folder shared with "anyone," or a former contractor's account that still has access.

This guide covers practical habits for sharing files and data safely, drawing on guidance from the Federal Trade Commission, the Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology. It focuses on day-to-day collaboration rather than your whole security program.

Know what you are sharing

You cannot protect what you have not identified. The FTC's Protecting Personal Information guide opens with "Take stock," which it describes as "Know what personal information you have in your files and on your computers," followed by "Scale down": "Keep only what you need for your business." NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide likewise suggests prioritizing inventorying and classifying your business data.

A simple classification scheme is enough for most small organizations. For example:

Public: anything you would post on your website.
Internal: everyday working files that would be awkward, but not harmful, to leak.
Confidential: contracts, pricing, financials and strategy.
Restricted: personal information about customers or staff, such as Social Security numbers, health or financial account details.

Label folders by tier, and agree on which sharing methods are allowed for each. The less you collect and keep, the less there is to share by mistake.

Share with people, not with links

Most cloud storage tools offer several ways to share, and they are not equally safe:

Sharing with named people means only those accounts can open the file, and you can see who has access.
Sharing with "anyone in the organization" is convenient for internal material but reaches everyone, including future hires.
Sharing with "anyone with the link" means whoever holds the link can open it, including people it was forwarded to.

Use named-person sharing for confidential and restricted material. If you must use an open link, choose view-only, set an expiration date where the tool allows it, and remove the link once the need has passed. Remember that "view only" and "disable download" settings reduce casual copying but cannot stop someone from photographing a screen.

Sharing a link to a single controlled copy is usually better than emailing attachments. Each attachment becomes a separate copy you can no longer update, track or revoke.

Give the least access that does the job

NIST defines least privilege as granting each entity "the minimum system resources and authorizations that the entity needs to perform its function." The FTC's Start with Security guide makes the same point in plain terms: "Not everyone on your staff needs unrestricted access to your network and the information stored on it." NIST's quick-start guide suggests restricting sensitive information to only those employees who need it to do their jobs.

For collaboration, that means:

Grant comment or view access when someone only needs to review.
Share a specific file or subfolder rather than a whole drive.
Give contractors and partners their own guest or individual accounts, never a shared staff login.
Decide who in your organization is allowed to share files externally at all.

Protect the accounts behind the shares

A carefully shared folder is only as safe as the accounts that can open it. CISA's Secure Our World campaign recommends four core steps: avoid and report phishing scams, use strong passwords, use multifactor authentication and a password manager, and update software. NIST's quick-start guide calls enabling multifactor authentication "one of the fastest, cheapest ways you can protect your data" and suggests starting with the accounts that can reach the most sensitive information.

Be wary of unexpected messages saying a file has been shared with you, especially ones that ask you to sign in. If a share notification is surprising, confirm it with the sender through a separate channel before clicking.

If your organization uses Microsoft 365 or Google Workspace, CISA's Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines that include settings worth reviewing, and CISA notes all organizations can use them.

Encrypt sensitive data and hold partners to the same standard

The FTC advises that businesses "encrypt sensitive information that you send to third parties over public networks (like the internet), and encrypt sensitive information that is stored on your computer network, laptops, or portable storage devices." NIST's quick-start guide suggests configuring tablets and laptops to use full-disk encryption.

For everyday collaboration, check your tools' security documentation to confirm how they encrypt data in transit and in storage. Then make sure restricted data stays inside those approved tools rather than traveling through personal email accounts, consumer file-transfer sites or unencrypted USB drives. When a partner insists on a method you are not comfortable with, agree on a secure alternative before anything is sent.

Outside partners need the same discipline, and they often handle your data. The FTC recommends investigating a service provider's data security practices and comparing their standards to yours, and it advises: "Put your security expectations in writing in contracts with service providers." NIST's quick-start guide suggests assessing cybersecurity risks posed by suppliers and other third parties before entering into formal relationships.

A short written agreement can cover which data the partner will receive, how they may store and share it, who on their side can access it, and what they will do with it when the work ends.

Review, clean up and dispose

Sharing settings drift. People change roles, projects end and links get forgotten. The FTC's Start with Security guide reminds businesses that security "isn't a one-and-done deal."

Build a light routine:

Each quarter, review externally shared files and folders, and remove access that is no longer needed. NIST's guide asks, "Are we removing access when they no longer need it?"
When someone leaves or a project ends, transfer ownership of their files and remove their access the same day.
Delete data you no longer need. The FTC's "Pitch it" principle is to "Properly dispose of what you no longer need," including securely erasing data from devices before disposal.

When something is shared by mistake

Mistakes happen: a file goes to the wrong person, or a confidential folder turns out to be open to anyone with the link. Act quickly. Remove the access or link, ask the recipient to delete the file, and record what happened. Then consider whether your obligations go further. NIST's quick-start guide notes that incidents may need to be communicated to stakeholders "as required by laws, regulations, contracts, or policies," and those requirements vary, so get legal advice if personal information was exposed. Having a basic incident response plan in place before anything goes wrong makes these decisions much easier.

Key takeaways

Know what data you hold, classify it simply, and keep only what you need.
Prefer sharing with named people over open links, and expire or remove links when the need passes.
Grant the least access that does the job, and give outsiders their own accounts.
Protect the accounts behind every share with multifactor authentication and caution about unexpected share notices.
Review external shares regularly, remove access promptly and dispose of data you no longer need.

Sources

Spotted something out of date? Let us know.