Clear Path step · Business · Accounts you know and control
Name an owner and map what you'd lose
One person owns security, and a single page shows every account, admin, device and outside company with a way in.
Why it matters: You can't protect accounts you don't know exist, and in small businesses the dangerous ones are usually forgotten admin logins and old vendor access. Everything else in the path builds on this list.
Do it
- Name the owner, often the owner-operator or office manager, and give them an hour a month.
- List accounts: email, bank, payroll, accounting, cloud storage, domain registrar, website, social media, AI tools.
- For each, note who is an admin and who can approve or send payments.
- List devices that touch company data, including personal phones.
- List outside companies with access: IT provider, bookkeeper, web developer, software vendors.
Say this: If we add an account, a tool or a vendor, it goes on the list the same day.
Check it worked: One named person owns security, and a one-page list shows every account, who has admin rights, who can move money, every device, every AI tool and which outside companies can get in.
Simply put
It's like a landlord's key log: who holds which key, and who can open the safe. You can't change locks you don't know about, and every later step on this path works from this list.
In detail
NIST's Cybersecurity Framework 2.0 Small Business Quick-Start Guide and CIS Controls Implementation Group 1 both begin with governance and inventory. Listing who can move money is easy to skip, and it's exactly what fraud crews look for.
If this is new to you: It doesn't need to be perfect. Start with email, the bank and payroll, then add the rest as you remember them. One page is fine.
Points toward the Long View: a business that knows every account, person, AI tool and outside company with access.