guide
Who Owns Your Technology?
IT Mushroomitmushroom.comWho Owns Your Technology? — Guide
Generated · itmushroom.com/resources/technology-ownership
A practical guide to finding who approves changes, who does the work and who can help when the usual person or provider is unavailable.
Choose a topic and start with one service you depend on. Each chapter explains what to look for, what you can check safely and when to get help.
You do not need to read every chapter or change a system. One topic is enough to begin.
- Domains and DNS
- Email and identity
- Devices and infrastructure
- Applications and vendors
- Backup and recovery
- Employee access lifecycle
- Documentation and institutional knowledge
- Technology decisions and lifecycle
Choose a topic · 8 areas
Domains and DNS
What this means
What this meansYour domain is the address people use to find your website and send you email. Ownership includes renewal and the authority to approve changes—not just knowing who built the website.
- Business ownerapproves changes carried out by
- Administrator / authorized providermanages
- Registrar / DNSsupports
- Website / email
Approval, administration and the service itself are different responsibilities.
Check safely
Check safely- Ask the authorized administrator to identify the registrar, company renewal contact and person allowed to approve changes.
- Review the existing ownership and renewal record. Confirm that an authorized company contact has a recovery route if the usual administrator is unavailable.
Worth checking: “The vendor has the only login.”
Worth checking: “The vendor has the only login.”Do it yourself
Create a short domain ownership record using information already available to authorized people. Assign someone to confirm renewal reminders reach a monitored company contact.
Stop here if
Stop here ifThe registration is disputed, a former provider controls the account, recovery is missing, or someone proposes changing live DNS records to prove access. Coordinate with the authorized owner and provider first.
Record it
Record the registrar and documentation locations, approval owner, authorized administrator, renewal/recovery backup, what you checked and next renewal review. Leave account numbers and recovery secrets in the approved secure system.
Technical detail
Separate registrar control from DNS hosting and website hosting. Check delegated access and who approves DNS changes with an authorized administrator. Read existing records; do not change a live record as a test.
Email and identity
What this means
The company needs someone accountable for who can reach its email and information. A provider may administer accounts while the company decides who should have access.
Check safely
- Ask who approves new access, who administers accounts and who can handle an administrator's absence.
- Review the current administrator/recovery record with an authorized person. Ask when the backup route was last checked; do not request passwords.
Worth checking: “The owner's personal email is the administrator.”
Do it yourself
Write down the approval and support contacts and the location of the secure administration procedure. Ask the accountable owner to confirm who can step in and set a review date.
Stop here if
The only administrator has left, recovery depends on a personal account, control is disputed, or verifying the route would require changing access or security settings. Use an authorized specialist before attempting recovery.
Record it
Record the approval owner, administrator, secure procedure location, authorized backup, what you checked and the last review date. Record where credentials are held, never the credentials or recovery codes.
Technical detail
Review delegated administration, least privilege and emergency access with an authorized administrator. Confirm recovery does not depend on one person's personal account. Store credentials in the approved secure system, not this worksheet.
Devices and infrastructure
What this means
Work devices, network equipment and hosted systems need clear responsibility for support, upkeep and eventual replacement. The person fixing a device may not own the replacement decision.
Check safely
- Choose a device or service that matters to daily work. Find its existing asset record, support contact and replacement decision owner.
- Ask who handles maintenance and how an issue is escalated when the usual person is absent. Review current records without changing equipment settings.
Worth checking: “I think one employee handles that.”
Do it yourself
Add missing owner, support and backup contacts to the approved asset record. Agree who reviews ageing equipment and when; leave technical changes to the authorized person or provider.
Stop here if
Equipment is unsupported, ownership or access is unclear, or a proposed check would interrupt work, change configuration or connect an unapproved device. Agree a support/change plan first.
Record it
Record the asset-record location, business owner, operator/support route, backup route, what maintenance you reviewed and the next lifecycle review. Keep sensitive configuration details in approved technical documentation.
Technical detail
Connect the asset record to maintenance, patching, support and replacement responsibilities. Include network equipment and hosted infrastructure as well as employee devices. Inventory review does not verify patching or security.
Applications and vendors
What this means
A business tool needs someone accountable for its usefulness, cost and continuing access. Paying a bill does not necessarily give the company administrative control or a usable exit route.
Check safely
- Review the existing subscription or contract record: who approves renewal, who operates the tool, and where is the vendor support route?
- Ask an authorized owner how company access and business information would be handed over if the provider changed. Confirm contract ownership without exporting live data as a test.
Worth checking: “We would have to call the old provider.”
Do it yourself
Create or update a vendor record with approval, support, renewal and documentation contacts. Add an unanswered handover question as an action for the authorized owner to resolve.
Stop here if
Contract ownership is unclear, a former provider has the only access, data ownership is disputed, or several parties must coordinate a transfer. Do not cancel, migrate or change administrator access as a test.
Record it
Record contract/documentation locations, business owner, operator, support and backup routes, renewal date, handover questions and the next review. Keep account identifiers in the approved internal record.
Technical detail
Review tenant ownership, delegated administration, renewal terms, data portability and vendor offboarding. A billing contact alone does not establish administrative control. Plan authorized exports or migrations separately from this review.
Backup and recovery
What this means
Keeping copies and restoring useful work are different jobs. Someone must own what needs protection, someone must monitor it, and someone must be able to coordinate recovery.
Business owner: agrees priorities and authorizes recovery
- Protectthen
- Monitorthen
- Testthen
- Restore
What a restore reveals informs the next protection and review cycle.
Check safely
- Ask who monitors backups, who can authorize recovery and who carries it out. Locate the current recovery procedure and backup contact.
- Review the latest relevant restore-test record. Ask what was restored, when and whether it was usable; a backup-success email alone does not answer that.
Worth checking: “Nobody has tested the restore.”
Do it yourself
Collect the existing recovery procedure and restore-test record in the approved documentation system. List what is missing and ask the owner to arrange a planned restore test with the authorized person or provider.
Stop here if
Recovery access is missing, no relevant restore-test record exists, a failure is already happening, or testing could overwrite data or interrupt work. Do not improvise a production restore; use a qualified recovery operator.
Record it
Record the business recovery owner, monitoring/restore operator, procedure location, backup contact, last relevant test, what still needs an answer and the next planned review date.
Technical detail
Agree how much work could be lost and how long recovery may take. Review recovery objectives, independent recovery access and the scope of a documented restore test. Backup success alone does not demonstrate a usable restore.
Employee access lifecycle
What this means
Access should follow a person's job as they join, change roles and leave. One person authorizes the change; an operator carries it out; someone confirms the full handover is complete.
Completion owner: confirms the approved change and continuing responsibility
- Approveauthorizes
- Make the changerequires
- Confirm completionleads to
- Own follow-up
Someone must confirm the whole access and handover checklist, including services beyond email.
Check safely
- Review an existing joiner/leaver checklist without copying employee details. Identify the approver, operator and completion owner.
- Ask whether the checklist covers business applications, devices, shared access and knowledge handover—not only email. Find the backup person for time-sensitive changes.
Worth checking: “I think one employee handles that.”
Do it yourself
Agree the approval, operating and completion roles and update the internal checklist with their contacts. Add gaps as review actions; use an approved process for any actual employee access change.
Stop here if
An urgent departure, disputed authority, shared credentials or missing account ownership makes the change sensitive. Do not revoke or grant access merely to test the checklist; coordinate with authorized management and operators.
Record it
Record the approval owner, access-change operator, checklist location, completion owner, backup route and last process review. Keep employee-specific records in the approved confidential system.
Technical detail
Connect authorization to identity, device and application changes. Include shared access, vendor accounts, active sessions and handover. A disabled email account may not complete an employee departure.
Documentation and institutional knowledge
What this means
Important work should not depend entirely on someone's memory. Useful documentation tells an authorized backup where to start and who to ask when a procedure is unclear.
Check safely
- Choose one important routine process. Locate its current procedure, owner and review date.
- Ask an authorized backup person to read it and identify missing steps or contacts. Check whether they can find the required secure-access location without sharing secrets.
Worth checking: “We know how it works, but it isn't documented.”
Do it yourself
With the process owner, document the purpose, normal steps, approved support route and stopping point. Have the backup person review the wording; do not run a risky process solely to test the document.
Stop here if
The process involves sensitive information, unapproved access or a production action the backup is not authorized to perform. Get the owner or a qualified operator to review it before anyone tries it.
Record it
Record the procedure location, accountable owner, operator, authorized backup, what a read-through showed, any steps needing clarification and the next review date. Point to secure credentials rather than copying them.
Technical detail
Keep procedures usable and current without exposing secrets. Record where secure credentials are held rather than copying them into ordinary documentation. Review access permissions and whether an authorized backup can follow the relevant procedure safely.
Technology decisions and lifecycle
What this means
Technology choices need an owner beyond the day of purchase. Someone should know why a tool exists, what depends on it and when to review renewal, replacement or retirement.
Accountable owner: confirms decisions and the next review
- Choosethen
- Implementthen
- Usethen
- Reviewdecide whether to
- Renew / replace / retire
Responsibility continues after implementation, including the decision to keep or retire a system.
Check safely
- Choose one approaching renewal or replacement. Find who approves it, what work it supports and where the original decision is recorded.
- Ask who reviews continuing usefulness, support and handover needs. Check existing dates and dependencies rather than cancelling anything to see what breaks.
Worth checking: “We would have to call the old provider.”
Do it yourself
Add the decision owner, purpose, dependencies and next review date to the approved technology record. Create a reminder for the owner before renewal or replacement decisions are due.
Stop here if
A retirement or provider change could disrupt work, the contract is unclear, or nobody understands the dependencies. Coordinate a decision and transition plan before changing or cancelling the service.
Record it
Record approval authority, operator/adviser, decision/documentation location, backup decision route, what you checked, what still needs an answer and the next renewal/lifecycle review.
Technical detail
Record decision authority, dependencies, renewal dates and reasons for choices. Assign a review owner and triggers for replacement, retirement or provider transition. Review integration and data-retention dependencies before an authorized change.
What do we mean by ownership?
Owner
Who is answerable for the business outcome and can approve a change?
Operator
Who carries out maintenance, support and approved changes?
Access
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup
Who can take over when the usual person or provider is unavailable?
Review
When was this last reviewed, and by whom?
See the full ownership model
- Accountable owner
- Who is answerable for the business outcome and can approve a change?
- Person or provider doing the work
- Who carries out maintenance, support and approved changes?
- Where administrative access is held
- Name the approved secure system and authorized role. Never enter credentials or secrets.
- Documentation
- Where can an authorized person find the current record or procedure?
- Backup person or support route
- Who can take over when the usual person or provider is unavailable?
- Last reviewed
- When was this last reviewed, and by whom?
Record where credentials are securely held, never the credentials themselves. Use an authorized backup person rather than sharing passwords.
Consider outside help when control is disputed, recovery is missing, contracts are unclear or several parties must coordinate. IT Mushroom can help coordinate this review, or you can work through it with another qualified provider.
Take this with you
Read a topic, fill in what you know or print a blank copy to use with an authorized person. Leave gaps as questions; do not record passwords or recovery codes.
Personalize your copy (optional)
These details stay in this visit and appear in your printed copy. They are not sent to IT Mushroom or added to a conversation. Reloading clears them. Leave out secrets and sensitive account details.
Ownership record 1 of 8
Domains and DNS
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 2 of 8
Email and identity
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 3 of 8
Devices and infrastructure
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 4 of 8
Applications and vendors
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 5 of 8
Backup and recovery
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 6 of 8
Employee access lifecycle
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 7 of 8
Documentation and institutional knowledge
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?
Notes / follow-up
Ownership record 8 of 8
Technology decisions and lifecycle
Do not enter passwords, recovery codes, API keys, account numbers, private keys or other credentials. Record where credentials are securely held, never the credentials themselves.
Accountable owner
Who is answerable for the business outcome and can approve a change?
Person or provider doing the work
Who carries out maintenance, support and approved changes?
Where administrative access is held
Name the approved secure system and authorized role. Never enter credentials or secrets.
Documentation
Where can an authorized person find the current record or procedure?
Backup person or support route
Who can take over when the usual person or provider is unavailable?
Last reviewed
When was this last reviewed, and by whom?
What did you check?
What record, document, system or authorized person helped confirm what you know? Keep sensitive details in approved secure documentation.
What still needs an answer?
Leave anything uncertain here rather than guessing.
What happens next?
What needs to happen, and who will do it?
Review again on
When should this be checked again?