Security Basics: Finding Your Recovery Gaps Before a Lockout Does
Most security conversations focus on keeping attackers out. Yet a common way small teams lose access to their own tools is far less dramatic: an employee leaves, a phone is lost, or an administrator is simply unreachable, and nobody can get back in. Account recovery is the other half of access control, and it often receives less attention than the initial login. This article walks through a practical way to map recovery paths across your software, so you discover the gaps while everyone is calm and available rather than during an outage or a crisis.
Start With an Inventory of Accounts That Matter
Begin by listing every service your business depends on for communication, money movement, customer data, code, and documents. Include the obvious ones such as email, file storage, and your accounting platform, but also the less visible tools: domain registrars, DNS hosts, app store developer accounts, analytics dashboards, and social media profiles. Many small teams discover that a forgotten account controls something important, such as a domain that still points to a live site.
For each entry, record the account name, the email address or username tied to it, the person or role who owns it, and whether it is personal or shared. A shared login shared by several people is a different risk from a named account for each employee, and you will want to treat them differently when planning recovery. Keep this inventory somewhere other than inside the tools themselves, because you need it even when those tools are inaccessible.
Trace the Recovery Chain for Each Account
Every account has a way to regain access if the password or device is lost. Typically this involves a recovery email address, a phone number, backup codes, or an administrator who can reset the password. The critical question is what the recovery method depends on. If a recovery email goes to a mailbox that is itself controlled by a departed employee, the chain is broken even though the account looks protected. If a phone number belongs to a personal device that someone takes when they leave, the same problem exists.
Write out the chain for your top accounts as a simple sequence: account A recovers through mailbox B, which recovers through phone C, which is held by person D. Any link that depends on one individual, one personal device, or one mailbox nobody else can reach is a single point of failure. Trace these chains deliberately, because the weak link is often several steps removed from the account itself.
Identify Who Holds Administrative Recovery Power
Some platforms let an administrator reset other users' credentials or restore access. This power is useful, but it also means that whoever holds it can recover accounts that are not theirs. For each important tool, determine how many people hold administrative rights and whether those rights are documented. A common gap is a tool where only one person knows how to add a new administrator, and that person is also the only one with full admin access.
Ask the vendor or check your admin settings to confirm what an administrator can and cannot do. Note whether any action requires a second person's approval, whether there is an audit log showing who performed a recovery, and whether you can designate a backup administrator. Because product features differ and change over time, verify these points in the current documentation rather than relying on memory or assumptions.
Plan for the Day Your Admin Is Unreachable
A break-glass plan is a documented procedure for regaining access when the usual administrator cannot act. It does not need to be elaborate. It should name at least two people who can perform critical recovery tasks, state where the emergency credentials or recovery codes are stored, and describe the order of steps to follow. Storage matters: recovery codes saved only in a mailbox that is itself locked out are of no use, so keep them in a location separate from the accounts they protect and make sure more than one trusted person knows where that location is.
Test the plan on a low-stakes account before you need it. A simple exercise is to have a second person attempt to reset a non-critical password using only the documented steps. Any step that is unclear, requires a device nobody can find, or depends on a person who has left the company will surface during the test instead of during an emergency.
A Practical Recovery Review Checklist
Run this review every quarter or whenever staff change. Confirm that every critical account has a recovery email or phone number that a current employee controls. Verify that at least two people hold administrative recovery power for each essential tool, and that those people are not the same individual with the same device. Check that backup codes or recovery keys exist, are stored outside the locked tools, and are readable by someone other than their original creator.
Next, look for stale entries. Remove accounts belonging to former staff only after you have transferred any data or ownership they hold. Confirm that domain registrations, billing contacts, and developer accounts list current addresses. Finally, write the date of the review and the names of those involved, so the next person inherits a clear record rather than a guess. This small routine turns recovery from an emergency scramble into a known, maintained process that your team can rely on when it counts.