Keep business services under documented business control, with named people authorised to administer them. The person who built the website should not be the only person able to renew the domain or recover a critical mailbox.
01 Establish ownership and access
- Create an inventory of domain registration, DNS, hosting, email, builders, payment integrations, analytics and security services. Record the service identifier and renewal route.
- Identify the contractual account holder and the operational owner for each service. Confirm that the registered details reflect the intended business relationship.
- Assign named administrator access where the product supports it. Separate billing, technical administration and routine staff access when those roles differ.
- Secure account recovery with appropriate business-controlled contact methods and MFA. Avoid making recovery depend solely on the service that might be unavailable.
- Document where credentials and recovery codes are held using an approved password-management process. Do not place secrets in the general inventory.
- Review developer, employee and agency access after role changes. Transfer required resources through the provider's supported ownership process.
- Schedule periodic checks of renewal notices, payment details and recovery access, and record the person responsible for each.
Common questions
Does paying an invoice prove I control every connected account?
No. A domain, builder and analytics account may have different owners. Verify each system separately.
Can support transfer a service based only on my request?
Ownership changes require the provider's verification process and the appropriate account authority. Prepare the requested evidence rather than attempting to bypass the current owner.
Should an agency use the business's main password?
Prefer named, limited access where available. That makes it possible to remove the agency's access without changing every user's credentials.