Brandie Neagles
Here’s a question that stumps more business owners than you’d think: if your web person, your office manager or the nephew who “set up the website” disappeared tomorrow, could you get into everything your business runs on?
We see it all the time. A client wants to update their Google Business Profile, and nobody remembers which Gmail account owns it. The domain is registered to someone who left three years ago. The website login is a shared password on a sticky note. None of it feels urgent until the day it is.
So we teamed up with Carter Terry of Pop Box, an Atlanta managed IT and security firm, to put together a simple checklist. We cover the marketing side, Carter covers the security side, and you end up holding your own keys.
Why this matters more than it seems
You can’t fix what you can’t get into. Wrong business hours on Google, a broken contact form, a bad review that needs a reply: all of it waits while you hunt down a login.
Shared passwords are an open door. One reused password and no second step to log in is how a lot of small business accounts get taken over.
Your insurance company is asking. Cyber insurance applications now ask about things like multi-factor authentication and backups. If nobody in the building can answer, that’s a sign it’s time to get organized.
What Carter finds at almost every new client
We asked Carter what he runs into most when Pop Box takes on a new client. Three things come up again and again.
No rules about who can log in, or from where. Many businesses have never required multi-factor authentication for everyone, or set up what IT folks call conditional access: rules that block sign-ins from unexpected places or devices. Without them, Carter often finds accounts that would accept a login from Russia, China or anywhere else.
A patchwork of software licenses. Over the years, licenses get bought one at a time, from different places, with nobody keeping track. The result is paying twice for features you already have, and for seats nobody uses.
No real backup plan. A lot of owners assume that if their files are in the cloud, they’re safe. Without a real backup strategy, a ransomware attack or other security incident can wipe out data you can’t get back.
The checklist: 10 keys every business should own
- Your domain name. The registrar account should be in the business’s name, tied to an email you control, with auto-renew turned on. Know when it expires, and know where your DNS settings are managed (often the same place, like GoDaddy).
- Your website hosting and login. You should have your own administrator account, not just your developer’s. Everyone who works on the site gets their own login.
- Your Google Business Profile. You should be the primary owner. Agencies and helpers get manager access, not ownership. (Our Google Business Profile checklist walks through the rest.)
- Your ChatGPT business profile. Businesses can now claim their profile in ChatGPT. Claim it with an account your business controls, then give helpers access. (Here’s what claiming your business in ChatGPT means.)
- Your business email. Whether it’s Microsoft 365 or Google Workspace, the main admin account should belong to the business, with multi-factor authentication turned on.
- Your company files. Business files should live in a shared space the company owns, like Google Workspace or Microsoft SharePoint, with everyone signed in through a company account (you@yourbusiness.com). If an employee builds folders in their personal Gmail and then leaves, you can lose access to everything they created.
- Your social media accounts. Business pages should be owned by a business account, not the personal profile of someone who no longer works with you.
- Your analytics and ad accounts. Google Analytics, Google Ads and Meta ads should be owned by you, with vendors added as users you can remove.
- Your booking, payment and email marketing tools. Scheduling software, your CRM and your email list all hold customer information. Know who has access.
- Your backups. Know where copies of your website and email live, and make sure someone actually tests them. A backup nobody has tried to restore is really just a hope.
Carter adds one more that’s easy to miss: your vendors. Give the people you hire, including your marketing agency, a shared folder you own to save their work in. Your logo files, photos, ad designs and website content are an investment, and they should stay with you if the relationship ever changes.
Three habits that keep your keys safe
Turn on multi-factor authentication everywhere. That’s the extra step after your password, like a code from an app on your phone. If your team still gets text message codes for Microsoft 365, it’s a good time to switch: Pop Box explains why in their post on the end of SMS codes for Microsoft 365.
Use a password manager. Sticky notes and shared spreadsheets are how passwords wander off. A password manager lets you share access with your team without handing out the actual password.
Give everyone their own login, and take it back when they leave. When someone moves on, removing their access should be on the same checklist as collecting their keys to the office.
Make sure you own and control your data, not just your logins. If your company files live in an employee’s personal account, they can walk out the door the day that employee does.
Carter Terry, Pop Box
Start with a simple keys list
You don’t need fancy software to get started. Make a simple list of every account your business depends on: what it is, who owns it, which email it’s tied to, and who else has access. Don’t put passwords on the list. Those belong in your password manager. Then look it over twice a year, and any time someone joins or leaves your team.
Most businesses find at least one surprise the first time they do this. That’s normal, and it’s much better to find it now than in the middle of a crisis.
A free Service Spend Assessment from Pop Box
Remember that patchwork of software licenses? Carter is offering Coyote Creative readers a free Service Spend Assessment, normally a $1,500 value.
Pop Box will review the software subscriptions your business pays for and flag the ones that are redundant, overlapping, over-licensed or no longer needed, so you can cancel or right-size them before they auto-renew. Common culprits: paying for both Zoom and Teams, both Google Drive and Dropbox, or several AI tools that do the same job. According to Pop Box, a typical 10-person company finds at least $5,000 a year in savings.
To claim it, call or text Pop Box at 678-737-1737 or email info@popboxit.com. Ask for the Service Spend Assessment and mention you found them through Coyote Creative.
On the marketing side, we’re happy to help you sort out who owns your domain, website and Google Business Profile. Book a free strategy session and we’ll take a look together.
