The most expensive question in a small office is often a simple one: who has the login for that? When the person who set up the phone system, the website or the internet account is out sick, on vacation or gone, the answer is frequently nowhere. A short shared document fixes much of that. I call it a systems document. It is a map of where your business's technology lives, who controls it and when it needs attention. It is not a list of passwords, and that distinction matters.
What it is and what it is not
The systems document tells you where things are. It does not hold the secrets themselves. Passwords belong in a password manager with a shared vault, as I describe in my article on password managers for small teams. The systems document names the vault, the account and the person who can recover access. If the document itself is copied, nobody gets into your accounts. That is the rule I follow, and it is why the document can be shared widely enough to be useful.
Section one: accounts and where they live
List every service the business depends on. Start with the ones that stop work when they fail: business email, the domain registrar, the website host, the phone system, the internet provider, accounting, payroll, banking and any line-of-business software. For each one, record the business email that owns the account, the name of the password manager vault where the login is stored, the multi-factor method in use and who can approve a recovery. Name the method, such as an authenticator app or a text to a company phone, but never write down a code.
Section two: vendors and support contacts
For each vendor, record the company name, the account number, the support phone number and the portal address, plus the name of your account representative if you have one. Add a one-line note on what that vendor handles. A line such as "office internet, billed to the main account, provisioning handled by the account rep" saves twenty minutes when it matters most. Keep the support number even if you think you will never need it.
Section three: renewal and end dates
This section often saves the most money. List every domain, certificate, software subscription, support contract, phone and internet contract, and hardware warranty, with its renewal or end date. Set a reminder sixty days before each one, so you have time to compare options instead of accepting an automatic renewal. Review this list at every quarterly check-in. A renewal nobody remembers is a common way a small business keeps paying for something it no longer uses.
Section four: devices and locations
List the important devices and where they sit: the router, the phone system, any server or network storage, the shared printer and the laptops that hold business data. Record who is responsible for each one. For the Wi-Fi network, record the network name and say where the password is stored. Do not write the password itself in the document.
Section five: who can do what
Name the people who hold administrator access to each major system, and name at least one backup for each. A system with one administrator stops when that person is unavailable. If someone leaves, the document tells you which accounts to close and which to transfer. My article on what to do the day an employee leaves covers the order I follow.
What never goes in the document
Keep out passwords, PINs, security question answers, full card numbers, bank login details and recovery codes. Those belong in the password manager or with the person who holds them. The document should answer three questions: where is this, who owns it and when does it renew. Anything beyond that is a sign that the information belongs somewhere else.
Where to keep it
Store the document in a shared location that more than one person can open, with access limited to the people who need it. Do not pass it back and forth as an email attachment, because copies multiply and fall out of date. Keep one offline copy too, such as a printed page in a locked drawer, in case the cloud account that holds the document is the thing that fails. Whatever you choose, make sure that backup does not depend on the same login it describes.
Build it in an afternoon
You do not need to document everything at once. Set aside two hours. Start with the accounts that would stop the business if they failed, then fill in the vendor and renewal sections for those. Ask each person who uses a system to check your entries. Finish the devices and access sections next, and schedule a review for the next quarter. A rough document that gets updated beats a perfect one that nobody opens.
Keep it current
The document goes stale in a few predictable ways. A person leaves and nobody updates the access section. A vendor changes its portal and the old address stops working. A renewal rolls over without review. Make the document part of your routine: check it during the quarterly review, and update it the same day something changes. If you want to see how I run that review, my article on a thirty-minute quarterly technology check-in has the agenda. DirecTech Connect helps Middle Tennessee businesses set up and maintain documents like this as part of managed IT work. Phishing and MFA basics covers the account protections this document should record.
Danielle Lemons is Vice President of Operations at DirecTech Connect, a Nashville provider of business phone systems, managed IT services, websites and digital marketing. More about Danielle.
Read more of Danielle’s writing, or see her profile at DirecTech Connect.
