Access that must survive.
WHICH ACCOUNTS MATTER
Domain registrar Hosting Site administration Email Payment gateway Bank Social profiles Anything customers depend on
WHAT TO ENSURE FOR EACH
You can recover it if locked out More than one person can access it, where appropriate The recovery address is independent Two-factor recovery codes are stored safely
THE RECOVERY ADDRESS PROBLEM
Accounts recovering to an address on your own domain.
If the domain fails, recovery fails.
Use an independent address for critical accounts.
THE TWO-FACTOR TRAP
Two-factor authentication protects accounts and locks you out if you lose the device.
Store recovery codes separately from the device.
WHAT TO RECORD
Which accounts exist Where they are Who can access them How recovery works
WHERE TO KEEP IT
A password manager, plus an emergency arrangement.
WHAT TO TEST
Whether you could actually recover a locked account.
WHAT PEOPLE DISCOVER
That they cannot.
