Imagine this situation: a company ends its relationship with the agency that built its website and managed its digital channels. During the handover, it discovers that it cannot manage the domain, hosting renewal notices go to a former contractor and recovery of a key account depends on that person's private phone.
This is an illustrative scenario, but the question is concrete: can the company continue operating independently when the person on whom its digital resources depend changes?
The problem need not start with an attack. The end of a contract, an employee's absence or a lost device may be enough.
Use, administrative access and ownership are different
The term “digital ownership” often brings together several distinct questions:
- Who is named in the registration or contract? Check the documentation and the service provider's records.
- Who can manage the resource? An administrator may be authorised to change settings or access rights, but this does not in itself establish ownership.
- Who can recover access? Recovery addresses, phone numbers and backup sign-in methods may determine whether the company can regain an account.
- Who keeps the service active? Know who receives invoices, warnings and expiry notices.
The company should therefore check more than whether it has a password. It should verify its authority, access and ability to continue operating.
Where the blind spot appears
Digital resources are often managed by several people: marketing handles social media, IT handles business email, an agency manages the website and finance pays invoices.
Each may do their job properly while a gap remains between those responsibilities.
A paid invoice does not confirm that the company controls an account. Having a password does not mean it can change the recovery address. A returned company laptop does not confirm that all access belonging to a former employee has been removed.
A blind spot appears when the assumption “someone handles that” is accepted as proof that the business is protected.
What the company can lose
The impact depends on which resource becomes unavailable and how important it is to operations.
Losing business email access may disrupt communication with clients and recovery of other accounts. Unavailable website administration may delay changes and problem resolution. Losing access to an advertising account may halt campaigns, while an unrenewed service may cause operational downtime.
Beyond the immediate disruption, additional work follows: proving authority, contacting support, reconstructing settings and explaining to clients why a service is unavailable.
Not every account deserves the same priority. First check resources whose loss would have the greatest business impact — and those used to access other systems.
A practical check: map your digital resources
Start with a simple register. For each resource, record the responsible person, management arrangements and recovery procedure.
| Resource | What to check | A sign that further checks are needed |
|---|---|---|
| Domain | Registration details, management access and renewal notices | The company cannot view registration details or depends on one external person |
| Hosting and website | The provider account, administration and backups | The company does not know where its website is hosted or who can restore it |
| Business email | Administrator roles and recovery methods | The only recovery option depends on an employee's private phone |
| Social media | Business roles and authorised administrators | Access depends entirely on one contractor |
| Advertising and analytics accounts | Who manages accounts, data and billing | The company sees reports but lacks suitable account access |
| Business tools and data storage | Administration, subscriptions and data export capability | Nobody knows how data would be exported or access transferred |
Do not put passwords or backup codes in this register. Record where access credentials are stored securely and who is authorised to use them.
Five questions for an initial internal discussion
For every resource important to the business, ask:
- Who is responsible for it within the company?
- Who currently has access, and do they still need it?
- Can we continue managing it if the main person is unavailable?
- Have we tested the recovery method, or do we merely assume it works?
- What exactly do we check when an employee leaves or a contract ends?
“We don't know” does not prove that the resource is compromised. It is a reason to assign a specific person to complete a check within a defined period.
How to close the gaps you find
Start with the resources on which communication, revenue and access to other systems depend.
Check registration and contract details. Align administrator roles with actual business needs. Where supported by the platform, use individual accounts and appropriate permissions with multi-factor authentication.
Provide controlled backup access for an authorised person and test recovery without interrupting normal operations. Include access handover in employee offboarding and the end of supplier relationships.
The aim is not to give everyone access to everything. It is to let the company continue operating without dependence on one person, with clear controls over who can do what.
The SECURITY 360° perspective: check dependencies between accounts
An inventory is the start. The next question is how the resources connect.
If business email is used to recover other accounts, who can recover the email itself? If a domain expiry notice goes to an inactive address, who will notice? If an agency maintains the website, who in the company confirms that handover is actually complete?
These connections reveal where individually well-managed accounts can collectively become a business problem.
The check is complete only when you know who is responsible, how access is maintained and how the business continues if its usual access method fails.
Does your company know which accounts and people its operations depend on?
SECURITY 360° can help you understand the connections between digital resources, responsibilities and business continuity and set priorities for further checks.
Book a discussion about your company's digital resources →
Related reading: An untested plan is not a plan
DISCUSSION O TEMI
Komentari 0
What is your experience? Be the first to join the conversation.