When you hand over website support, CMS access soon proves insufficient on its own. Domain renewal, the hosting bill, code and email delivery have separate responsibilities. An inventory of these services helps you see who administers each one and which working access the people involved actually need.

The access inventory documents operational responsibility. The relevant agreements separately determine who may use the domain, code or images.

Separate administration from participation

The business needs clear responsibility for contracts, invoices and recovery. People working on the website need the permissions required for their tasks. Those roles do not have to be identical.

Suitable permissions follow from the work: editors change content, while technical support may need deployment access and error information. Domain administration and payment details can remain with another responsible person. Describing those tasks first lets you choose a role for a specific reason.

OWASP recommends limiting permissions to the tasks a person needs to perform. A successful login does not mean every administrative action should be available. Check the configured permissions instead of making everyone an administrator in advance.

Keep an access inventory without passwords

For each service, record:

  • its purpose and who manages the contract;
  • who works through which individual account;
  • who may grant or remove access;
  • how the responsible person recovers lost access;
  • when the arrangement was last reviewed.

This list describes responsibilities. Passwords, recovery codes and keys belong in the designated protected store. A general project document or contact form is unsuitable.

A private individual account becomes a problem when it is the business’s only connection to a service and that person later becomes unavailable. Appropriate business administration, where the service offers it, can reduce this dependency. Existing accounts also need recovery that a responsible person can actually use: an address in a field is little help if nobody maintains the mailbox.

Ask the important questions for each system

Domain questions include administration, renewal and DNS changes. Hosting involves operation, invoices and agreed technical work. A CMS separates editorial duties from system settings. A source repository needs clear responsibilities for code, releases and backups.

External services belong in the inventory because a contact form can look correct while its mailing connection has expired. Knowing who maintains that connection and how failures are noticed keeps responsibility from falling between website support and the mail provider. A check using identified test data within an agreed scope shows whether the whole flow works.

When someone leaves or a new supplier takes over, comparing tasks with access shows which permissions should end and which the successor needs. The responsible successor must be able to work before administration removes unnecessary personal permissions and records the changes. Otherwise, the handover could interrupt operation.

When handing over to technical operations support, include this inventory and flag unresolved responsibilities. Editorial website maintenance has a different scope; it does not automatically require domain or payment permissions.