How Should a Small Business Organize Shared Files?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Keep business files in one shared, business-owned drive with a simple set of top folders, a naming rule everyone follows, access limited to who needs it, one current version of each important document, and a record of who approved what. Set it up once, then add to it as you grow.

Why it matters

Files saved on personal laptops and in inboxes get lost when a device dies or someone leaves. Wide-open sharing lets the wrong person see payroll or customer data. Two versions of the same contract cause real disputes. The Federal Trade Commission (FTC) advises giving staff access only on a need-to-know basis and keeping only the data you need.

12.2.1 Folder structure

What it means: a small set of top folders the whole business uses. The outline names seven: legal, financial, customer, marketing, operations, human resources, and technology.

How to do it:

Create one business-owned shared drive or folder, owned by a business account, not a personal one.
Add the seven top folders. A number prefix keeps them in order, like “01 Legal” and “02 Financial.”
Put a few subfolders under each. For example, Marketing can hold Logos, Photos, Website, and Google Business Profile. Legal can hold Formation, Licenses, Insurance, and Contracts.
Keep customer folders by customer name or job number.
Add a short “Read me” file at the top explaining what goes where.

Common mistake: too many levels. If it takes five clicks to find a license, people will save it to their desktop instead.

12.2.2 Naming rules

What it means: every file name follows the same pattern so you can find and sort it.

How to do it: pick a pattern like Year-Month-Day, then a short description, then a version or status, for example “2026-10-17 Smith Kitchen Estimate v2” or “2026-10-01 General Liability Certificate.” Putting the date first in that order makes files sort by date. Write the rule in the “Read me” file.

Common mistake: names like “Final,” “Final2,” and “Final REAL.” Use dates and version numbers instead.

12.2.3 Permissions

What it means: sensitive folders are open only to the people who need them.

How to do it:

Mark which folders are sensitive: usually Financial, Human Resources, Legal, and anything with customer personal data (see 11.6.2 Sensitive Information).
Share those only with named people, never with “anyone with the link.”
Give contractors access only to the folders their work needs (see 11.7.6 Least Privilege Access).
Record who has access in your access inventory (see 11.7.5 Access Inventory).
Remove access the same day someone leaves.

Common mistake: sharing one top folder with everyone, which quietly gives them access to every subfolder below it.

12.2.4 Version control

What it means: there is one current copy of each important document, and everyone knows which one it is.

How to do it: edit shared documents in place instead of emailing attachments back and forth. Most cloud file tools keep a version history, so you can see and restore earlier copies. When a document is final, save a dated Portable Document Format (PDF) copy and keep the editable one in a “Drafts” or “Working” subfolder.

Common mistake: downloading a file, editing it offline, and uploading a second copy with almost the same name.

12.2.5 Approval records

What it means: proof of who approved a document or change, and when.

How to do it: for contracts, policies, prices, and website or listing changes, keep the approval with the file. That can be a signed PDF, an approval email saved as a PDF in the same folder, or a short line in a change log: date, document, change, approved by. Your file tool’s version history and comments can help, but save the final approval as its own file.

Common mistake: approvals that live only in a text message or a phone call.

When to get help from a pro

An information technology (IT) helper can set up a shared drive, permissions, and backups. Questions to ask:

Is the shared drive owned by the business, so it stays if someone leaves?
Which folders are restricted, and who can see them now?
Is the shared drive backed up somewhere separate (see 11.8 Business Backups)?

Bill’s note

[Bill: add a short note. For example, a client who couldn’t find their logo, photos, or business registration when they needed to fix a listing, or the folder setup you use for every SiteSmarty client.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the SiteSmarty shared drive, top folders, naming rule, and restricted folders]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the top folder list and one folder’s sharing settings]
[Result so far:]

Questions people ask

What folders should a small business have? Start with legal, financial, customer, marketing, operations, human resources, and technology, then add subfolders as needed.

How should I name business files? Start with the date as year, month, day, then a short description and a version number.

Who should have access to which folders? Only the people who need each one. Lock down financial, human resources, legal, and customer data folders.

How do I stop people from editing the wrong version? Edit shared files in place, use version history, and save finals as dated PDFs.

How do I record who approved a document? Save the signed copy or approval email in the same folder, or keep a simple change log.

Audit check

Outline line	Question	Pass looks like	Fail looks like	Evidence to collect
12.2.1 Folder structure	Are business files in one business-owned shared drive with clear top folders?	Seven top folders, a “Read me” file, owned by a business account	Files on personal laptops, in inboxes, or in a personal account	Screenshot of the folder structure and owner
12.2.2 Naming rules	Do files follow a written naming rule?	Date-first names, version numbers, rule written down	“Final2,” “scan001,” no pattern	The “Read me” file and a sample folder
12.2.3 Permissions	Are sensitive folders limited to the people who need them?	Named-person sharing, no public links, access inventory current	“Anyone with the link,” former staff still have access	Sharing settings screenshots and access inventory
12.2.4 Version control	Is there one clear current version of key documents?	Edit in place, version history on, final PDFs saved	Multiple near-identical copies	Sample folder showing working and final copies
12.2.5 Approval records	Is there proof of who approved key documents and changes?	Signed PDFs, saved approval emails, or a change log	Approvals only in texts or memory	Change log and sample approvals

Where this fits

Do this first: 12.1.2 Email Accounts and Shared Inboxes, 11.5 Data Map

Do this next: 12.3.1 Main Business Phone Number

Sources

Federal Trade Commission, "Start with Security: A Guide for Business" (checked October 17, 2026)
Federal Trade Commission, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.