Compliance Specialists protect the smallest U.S. businesses. Specializing in True Small Business Data Security™. We protect a small business the right way with the security technology required to thwart Internet Criminals and to obey all the Data Security & Privacy Laws that apply to your business. Here is what three federal announcements on October 13, 2026 mean for any business that hires a virtual assistant, and the decisions that protect your business before the assistant’s first day.

It seems every business expo has offers for virtual assistants. Similar offers arrive in my email. The assistants live and work in Central and South America, Africa, the Philippines and Southeast Asia.

Those offers come from staffing agencies, businesses that find virtual assistants and place them with clients. These are real businesses, offering real people who do real work. In this article, the term “virtual assistant” does not mean the AI assistant software built into phones and computers. It means a real person working for your business from somewhere else. You might see your virtual assistant on a video call, but you might never meet them in person. Many small business owners have hired one. More will.

This is not a warning against hiring a virtual assistant.

This is a warning about protecting your business before their first day. Protecting begins by controlling what your assistant receives from the start, like:

• the passwords to your email account or to your social media accounts,
• access to your client files, and
• the ability to work in your accounting software.

Early protection considers where those passwords might end up.

Every Task Comes With Access

All of your assistant’s work arrives over the internet. Think about what you would ask them to do. Answer email. Post on social media. Send invoices. Book appointments.

Now think about what each of those tasks requires. To answer your email, the assistant has to get into your email. To post for you, they need your social media accounts. To send invoices, they need your accounting software. Every task you hand over comes with access to part of your business.

And all of the work your assistant does happens on a computer you have never seen, in a location you have never visited, thousands of miles away.

Heed The Warning: Three Federal Announcements on One Day!

On October 13, 2026, three federal announcements came out on the same day about workers who get hired into remote jobs — done entirely over the internet.

The first announcement was a warning from the FBI.¹ North Korean workers are using stolen identities to get hired by American employers. The workers apply using the stolen name and the background of a real person. That person has no idea it is happening.

The second announcement came from Texas. Federal agents searched more than 40 homes and seized 187 laptops. Each laptop had been mailed by an employer to a worker it thought it had hired. Instead, the laptops sat switched on in those Texas homes, and the actual workers from overseas used the laptops. The FBI calls these homes “laptop farms” and says each seized laptop “potentially represents one company that has hired a DPRK IT worker.”² DPRK means the Democratic People’s Republic of Korea, North Korea’s official name.

The third announcement came from Ohio. A federal grand jury indicted 14 people. The government charges that people in the United States helped North Korean workers get hired into remote technology jobs, in some cases “subcontracting entire jobs to third-party foreign nationals.”³ In plain terms, a business decided to hire one person to work remotely, then a different person was actually doing the work. In the government’s words, the scheme “impacted more than 70 U.S. company employers.” Those employers included health care, communications, retail and manufacturing businesses.

Those cases were about computer technology jobs, not virtual assistants. However, they raise the same question for any business that hires a person without physically meeting them. Is the person you decided to hire actually the person doing your business’ work?

“The Staffing Agency Checks Them”

Most owners have an answer ready. “The staffing agency checks them.”

That is a reasonable answer. The FBI’s warning shows why it does not settle the question. The workers it describes pay Americans to sit their job interviews and their identity checks for them. They also hand off the work to other people. The FBI’s words are that they “subcontract employment-related remote labor to third-party freelancers.”¹ In plain terms, the person you hired hands off your work to another person.

Your new hire passes their interview. Their ID check also passes. And yet, the person doing your work is not the person you hired.

From your desk, you have no way to tell whether the person typing is the person you hired. That is not a charge against any staffing agency. Distance hides who is at the keyboard.

Who the assistant is really matters, and we will come back to why. First, let’s talk about early protection, the part the business must control correctly: what access the assistant is given.

Count What Left the Business

Here is a setup many owners would recognize. The assistant uses their own laptop, wherever they work. The owner sends over the password to the business email. The same password opens the social media accounts, because that was easiest. The owner shares a screen for an hour to get the accounting software working.

Now count what left the business that day. The passwords to the email, the social media and the accounting software are now on a computer the business does not own. Every email the assistant opens, and every file they download, is saved on the assistant’s laptop too. And if the arrangement ends, the owner has to remember every password that was shared, and still has no way to know who else has them now.

And if the assistant only posts on social media, they still post as the business. Every message they send carries the business’ name, to every customer who reads it.

That setup is the fastest way to get a helpful person working. However, it is not secure. Every password, email and file the assistant was given now sits on the assistant’s laptop, where the business does not see it and does not protect it. Protecting your business the right way requires a designated person to review the setup before the assistant starts. That is mission critical for your business’ security and for compliance with all the Data Security & Privacy Laws that apply to your business.

The Duty Stays With the Business

The data belongs to your business. That means customer data, financial data, intellectual property data, all data. The duty to protect it belongs to your business too, no matter who is doing the work or where they are.

For some businesses, federal law spells this out. If your business prepares taxes, keeps books or arranges loans, your business must obey the Federal Trade Commission’s Safeguards Rule.⁴ Its definition of an authorized user is “any employee, contractor, agent, customer, or other person” allowed into your systems. A virtual assistant is on that list.

The rule then states two requirements for each of those people. The business must “limit authorized users’ access only to customer information that they need to perform their duties and functions.” In plain terms, each person accesses only what their job needs. And the business must put the same protections in a written contract with any outside provider. The rule excuses some smaller businesses from parts of it. That applies to businesses holding information on fewer than 5,000 consumers. The rule’s two requirements still apply to them.

The setup above fails both. The assistant accesses everything the owner’s password accesses, and the business does not see what is on the assistant’s laptop.

If this rule does not cover your business, the Data Security & Privacy Laws that apply to your business still do. Your customers trust you with their information. Protecting it is your business’ duty, wherever the work is done.

What the Business Owns and Decides

Vulnerability Awareness, Element 1 of the 19 Essential Elements in True Small Business Data Security™, starts with seeing the risk to the whole business. The risk here is not the assistant. It is everything the business gave away to get the assistant started.

There is a way to set this up that protects your business the right way, and it starts with ownership.

The business owns the work, so the work stays on a computer the business controls. One way is to provide a virtual computer, a computer that lives online, and require the assistant to use it. The assistant signs in to it from wherever they work. Nothing is shipped, so there is no laptop to end up in a laptop farm. The virtual computer stays under the business’ control the whole time, and the work and the files never land on the assistant’s own laptop.

The business owns every account. Every password is kept in a password manager the business controls, and the assistant is required to use it. The assistant gets their own sign-in, never the owner’s. The business decides what that sign-in accesses.

The business also decides where that sign-in comes from. The question is: “Where are you?” When you hire an assistant who lives in one country, the business allows sign-ins to that account only from that country, where its systems support it. A sign-in from anywhere else is blocked, and the attempt is recorded. If the work is handed off to another person somewhere else, the business has a record of it instead of never knowing.

A location limit does not prove who is typing. So the next question is who is watching the work. If you hire through a staffing agency, ask whether it gives the assistant a manager in the same country, close enough to oversee the work day to day. That matters most when you pay by the hour. An hourly bill is a claim about who worked and for how long. A manager on the ground is the person who confirms it.

A U.S. office is not the same as oversight. Ask who manages the assistant day to day, and where that manager sits.

Some owners skip the staffing agency and hire an assistant directly. It costs less, and the reason is plain: there is no manager on the ground. When I spoke with a representative of a staffing agency in the Philippines, they described what that manager does. The manager keeps the assistant on task and accountable to the client. The manager is also a second contact for the client if the assistant goes missing or is out sick. Hire directly, and every one of those jobs comes back to you, from thousands of miles away. Everything else in this section matters more, not less.

The business also puts one rule in writing: the assistant does the work personally. The FBI found North Korean workers handing off their work, but it does not take a scheme. Any assistant is able to hand off part of the job to another person and still deliver on time. The work arrives, the bill is paid, and the business never learns who did it, or who has now seen its information. The agreement with the staffing agency says the work is not handed off, and the manager on the ground is there to see that it is not.

Plan the Last Day First

Last, the business plans the assistant’s last day before their first one. Every arrangement ends sometime. On that day the business has to remove every sign-in, lock every account and get back every file. It is only able to do that if it knows exactly what was given.

So the exit plan comes first, and it shapes the first day. If an account is not on the list, it is not handed out. The exit plan and the start plan are the same list, read in two directions.

Each of those decisions protects your business. Each is made before the assistant starts, by a designated person, and written down.

Summary Action Checklist: The First Day and the Last Day

Each action gets two dates. On the first day, work from the top down. On the last day, work from the bottom up.

☐ Designated person: First day ________ / Last day ________

☐ Written agreement: First day ________ / Last day ________

☐ Email: First day ________ / Last day ________

☐ Password manager: First day ________ / Last day ________

☐ Virtual computer: First day ________ / Last day ________

☐ Sign-in location: First day ________ / Last day ________

☐ Social media: First day ________ / Last day ________

☐ Accounting software: First day ________ / Last day ________

☐ Client files: First day ________ / Last day ________

Every action on this checklist gets a date, because protecting your business starts with knowing when each decision was made, and who made it. We will send you the fillable, printable PDF.

Compliance Specialists does not place virtual assistants, and we do not recommend one staffing agency over another. Whether you hire through an agency or directly is your decision. Protecting your business while you do it is ours. Our Solid Foundation Compliance Programs™ are built to make the decisions in this article with you, before the assistant starts, and to keep your business protected as the work changes. We run the same program on our own business first. The Data Security & Privacy Laws apply to the smallest businesses too, and those businesses deserve protection built for their size.

If your virtual assistant left tomorrow, which accounts would you need to lock, and who in your business holds that list?

Protecting You to Grow™

Let’s look at what your virtual assistant accesses today, and build your dated First Day and Last Day checklist together.

Book your 30-minute review

Sources

1. FBI Internet Crime Complaint Center, Alert I-101326-PSA, North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment, October 13, 2026. https://www.ic3.gov/PSA/2026/PSA261013

2. U.S. Attorney’s Office, Northern District of Texas, Operation Lonestar Roundup Dismantles North Korean IT Worker Network, October 13, 2026. https://www.justice.gov/usao-ndtx/pr/operation-lonestar-roundup-dismantles-north-korean-it-worker-network-used-penetrate-us

3. U.S. Attorney’s Office, Northern District of Ohio, 14 Indicted in North Korean Remote IT Worker Conspiracy Affecting More Than 70 U.S. Companies, October 13, 2026. https://www.justice.gov/usao-ndoh/pr/14-indicted-north-korean-remote-it-worker-conspiracy-affecting-more-70-us-companies

4. Federal Trade Commission, Standards for Safeguarding Customer Information, 16 CFR Part 314, §§ 314.2(a), 314.4(c)(1) and (f), 314.6. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314