Topic
Technology Ownership & Continuity
An employee leaves, a vendor stops responding, or account recovery points to an old phone. Your business still needs to get into its email, website and other essential services.
Find who controls the accounts, where to start if access is lost, and what to keep in place for the next person.
If the usual provider were unavailable
This example uses an IT provider. The same dependency can sit with an employee, owner or contractor.
Usual provider available in this example.
One route through the usual provider
- Business
- Usual providerUsual contact
- Accounts & systems
When the provider cannot respond, the business has to recover access and instructions before work can continue.
A second authorized route is prepared
- Business
- Authorized backup
- Accounts & systems
The business can turn to another authorized person or provider, with the access and instructions needed to continue.
Who controls the accounts?
Who should control the company’s domain?
IT Mushroom recommends that the business retain authority over its domain registration and renewal.
A provider can handle the work. Confirm who the domain is registered to, who can approve changes and how renewal is handled. The registrant is the person or organization that registers the name under an agreement with a registrar; a website invoice alone does not establish that.
See what to verify for domain and DNS →How do we find the registrar or DNS provider?
Start with renewal notices and administrator records; a domain lookup can help identify the registrar and nameservers.
Registration and DNS hosting may be handled by different companies. A lookup points to services, not to who can sign in. Confirm access with the administrator rather than changing a live DNS record as a test.
Should an employee or vendor be the administrator?
An employee or vendor can administer an account while your business keeps decision-making authority.
Use the permissions needed for the work and identify who can take over. Microsoft 365 has different administrative roles; the business owner does not need broad admin privileges for daily work.
Understand email and identity responsibility →Should the web developer hold the hosting account?
Our default is company-held accounts, with delegated provider access where available.
You should be able to move providers or bring work in-house. If a platform lacks separate access, or you want the provider to hold the account, agree how your business can take over or move and document that arrangement. Confirm the platform’s transfer rules first.
Prepare questions about providers and handover →When someone leaves or access is lost
Our IT person has left. What do we need first?
Find the administrators, support contacts and records for your domain and DNS, email, devices, business applications, website and backups. Separate confirmed access from open questions.
Decide who will take over, preserve useful information and remove access that is no longer authorized. In Microsoft 365, blocking sign-in and keeping or handing over email and files are separate tasks.
How do we move accounts back to the company?
For an agreed handover, identify the destination account or operator, data to retain, connected services and how completion will be confirmed. Follow the service’s transfer process.
Read about access handover and follow-up →What if recovery goes to an old email or phone?
First establish that the business is entitled to administer the account. Then look for an existing authorized administrator or recovery route. The obstacle may be a former employee’s or provider’s account, a personal email address, an old phone number or an unavailable multi-factor authentication (MFA) device.
- Ask an existing authorized administrator whether they can restore access or update recovery methods.
- If recovery uses an old company-controlled mailbox, ask its authorized administrator whether that mailbox can appropriately be restored or used. Do not access someone’s personal email or phone without their authorization.
- Use the platform’s official account-recovery or support process. Be ready for identity and business verification when ordinary sign-in methods are unavailable.
- Keep the last working company access route until replacement access is confirmed. Avoid canceling the service or deleting the account during recovery.
- After recovery, update company-controlled recovery methods, prepare an authorized alternative and record how access is managed.
Some recoveries are quick; others take sustained follow-up and repeated verification, and access may not be recoverable. Disputed entitlement needs the provider’s dispute process; legal ownership disputes need legal advice. Suspected unauthorized access also needs a security response.
Keep four answers within reach
For each important service, keep these four answers in a company-accessible record. Store passwords and recovery codes in an approved secure system, and link to the access procedure.
- Authority
- Name the business decision-maker and what they can approve.
- Access
- Identify who can administer the service and the backup access route.
- Documentation
- Keep the setup, contacts and recent changes where the next person can find them.
- Recovery
- Record what could be restored, from when and by whom, with test evidence and open questions.
Could the business recover?
Is OneDrive or Google Drive sync the same as a backup?
Sync keeps copies aligned; it does not by itself provide an independent backup. A deletion or unwanted edit can spread to the synced copies.
Version history and deletion recovery can help within limits. Google distinguishes document history from other Drive-file versions, and OneDrive restore has eligibility and recovery conditions. Ask which loss each feature could help you recover from.
Google · file versions · Microsoft · OneDrive restore
Understand backup, sync and version history →How do we know the backups could restore useful work?
Ask for the most recent recovery-test record: what was restored, from when, where it was checked, who checked it and what remained unresolved. A backup notification alone does not answer those questions.
Agree any new test with the responsible operator in an isolated destination, without deleting or overwriting live work.
Choose the next useful step
Understand one service
The Ownership Guide explains eight areas of responsibility, practical questions and safe manual checks.
Read the Ownership Guide →Review what you know
Organize what you report as clear, uncertain, unknown or not reviewed. This is a self-review, not a technical inspection.
Open the Ownership Review →Keep a working record
Keep responsibility, evidence and next actions for one service. Export a copy to retain the visit’s draft.
Create an Ownership Record →
When the next step needs implementation
A provider transition or access correction may need IT Projects. Continuing administration and recovery responsibilities may need Managed IT & Support.
Need help sorting this out?
If ownership, access or recovery is unclear, IT Mushroom can help work through what exists, what can be recovered or transferred, and what should be documented next.
Contact IT Mushroom