A company account register helps you see which services are in use, who is responsible for them and how access should be managed. It is particularly useful for services that sit outside the main email system, such as website hosting, accounting, design, e-signature, cloud storage, payment and supplier platforms.
Record the account and its business owner
For each service, record its name, purpose, business owner, administrator, renewal date, recovery contact and how access is granted. Note whether the account is personal, individually assigned or shared. Keep the register in a company-controlled location with access limited to people who need it.
Do not put passwords in a plain spreadsheet or an unprotected document. If the company uses a password manager, store credentials there and document who can administer the vault and how access is recovered.
Reduce unnecessary shared logins
Use individual user accounts and role-based permissions when a service supports them. Shared logins make it harder to identify who made a change and can complicate access removal. Where a shared account is unavoidable, record its purpose, responsible owner and authorised users, and review access when staff or suppliers change.
Protect account recovery and access
- Use unique passwords for each service and avoid reusing personal passwords.
- Use the company’s approved password manager where available.
- Turn on multi-factor authentication when supported, especially for administrator access.
- Keep recovery email addresses and phone numbers under company control.
- Remove access that is no longer needed and update recovery details when responsibilities change.
Review the register regularly
Review accounts on a regular schedule and before renewals. Confirm that the service is still needed, the listed owner is current, recovery details work and access is appropriate. When someone leaves or a supplier relationship ends, check the affected accounts and transfer business ownership before removing access.
For a related but separate checklist covering Microsoft 365 settings, see our Microsoft 365 security guide for SMEs and cybersecurity baseline. CISA also offers a password safety tip sheet.
A current account register makes ownership and follow-up easier to manage. Connet One can discuss how your business organises IT accounts and access.