Shared accounts and who has the keys

Small public institutions run on shared logins: the website admin, the town's social media pages, the email newsletter, the domain registration, vendor portals, the camera system. Each one was set up by someone, years ago, often with their own email address.

When that person leaves, retires or stops answering, the institution can lose its own voice. This lesson is about making sure every account belongs to the institution.

How institutions lose their own accounts

• The recovery email is a former employee's personal address. Password resets go to them.
• Only one person ever knew the password, and it lived in their head or their phone.
• Two-step sign-in is tied to one person's phone number.
• Domain renewal notices go to a volunteer who moved away. The domain lapses, and the website and email stop working.
• A vendor set up the account in the vendor's own name, and the contract ended.

None of these needs a hacker. They are housekeeping failures, and they are fixable on a quiet afternoon.

The rules for every institutional account

1. The institution owns it. The login and recovery addresses are institutional, ideally a role mailbox such as webmaster@ or clerk@ that more than one person can read. Never a personal Gmail.

2. Two named people can get in. An owner and a backup. Where the platform supports it, give each person their own login with a role, instead of one shared password. Most social media and website platforms let you add several administrators.

3. It lives in the password manager. Where a password must be shared, keep it in a shared vault in the institution's password manager, not in email, text messages or a notebook.

4. It has two-step sign-in that does not depend on one phone. Use each person's own second step where accounts are individual. For a truly shared login, use a method the backup person can also reach, such as a code stored in the shared vault or a second security key.

5. Someone knows it exists. An account nobody remembers cannot be protected or recovered.

Your web address deserves special care

Your domain name, the part after "www," carries both your website and usually your email. Whoever controls the registrar account controls both.

If your institution is a U.S. government organization, you may be eligible for a .gov domain. CISA manages .gov, and .gov domains are free for eligible U.S.-based government organizations. Whatever your domain, know which registrar holds it, which email gets its renewal notices, and when it expires.

The day someone leaves

Offboarding is the same day, not "when we get to it":

1. Remove their personal access to every system.
2. Change every shared password they knew.
3. Move any account in their name to the institution.
4. Update recovery emails and phone numbers that pointed to them.
5. Collect devices and security keys.

A kind departure still gets this list. It protects them as much as the institution: nobody can later claim they did something with an account they no longer had.