Know who controls the business accounts

Make an account register

List the business’s website, email, payment, scheduling, social, advertising and other essential accounts. Identify the owner, administrator, recovery process and service provider. Do not place passwords in the register. Use appropriate secure credential management and the protections each service provides.

Distinguish franchisor-controlled systems from accounts the local business controls. Ask which data can be exported and what happens at a transfer or termination. A provider managing an account is different from that provider owning it.

Design access around the role

Give staff and vendors the access needed for their work using named accounts where available. Avoid a shared owner login as the default way to delegate tasks. Ask a qualified technology professional to help configure strong authentication, backups and recovery for the actual environment.

Build an offboarding process for employees and agencies. Review access when responsibilities change, and preserve the business’s ability to retrieve assets and records under the applicable agreements. An old vendor account can become a practical problem long after a project ends.

Prepare for suspicious requests

Train staff to verify unexpected payment instructions, credential requests and urgent account messages through established channels. Record where to seek help if an account is compromised. SBA’s cybersecurity resources emphasize education and protective practices; account control is a concrete place to begin that work.

Put it on paper

• Document ownership and recovery contacts.
• Use appropriate individual access and authentication.
• Review permissions during every handover.

Continue with the franchise research checklist, our FDD guide, and the research directory.