If You Landed in the Hospital Tomorrow, Could Anyone Log In?
The Single Point of Failure Is You
We talk a lot about what happens when your IT person quits. Let’s talk about something more uncomfortable. What happens if you, the owner, are suddenly out?
Car accident on I-95. Surgery that turns into two weeks of recovery. A family emergency that takes you out of state with no laptop. It happens to people all the time, and small business owners are the least prepared for it, because we’re usually the ones holding every key.
Go through this list in your head. Who can log in to:
- The business bank account and payroll
- The Microsoft 365 or Google Workspace admin account
- The domain registrar where your website and email live
- Your accounting software
- The phone carrier account that receives your MFA codes
If the answer to most of those is ‘just me,’ your business stops when you stop.
MFA Locks Out Your Family Too
Here’s the twist. Everything we tell you to do for security makes this problem worse. Turn on MFA, use unique passwords, don’t share logins. All correct. But now your spouse or business partner can’t get into anything either, even with your blessing.
The codes go to your phone. Your phone is locked. Your phone might be in a hospital bag somewhere. Good security without a backup plan is a locked vault with the only key in your pocket.
What Breaks First
From what I’ve seen, it’s usually not the dramatic stuff. It’s the boring deadlines:
- Payroll. Employees need to get paid Friday whether you’re conscious or not.
- Auto-renewals on an expired card. The domain lapses, and suddenly email stops working too.
- Client email. Nobody can read or answer the inbox, so customers assume you closed.
- Vendor bills. Late fees and shutoff notices start stacking up.
None of those are hard to handle. They just need someone who can log in.
Build a Break-Glass Plan
Break-glass means access that sits locked away until there’s a real emergency. Nobody uses it day to day. It’s there for the bad week. Here’s how to set it up without handing everyone your passwords.
1. Make an account inventory
Start with a list of every important account. Not the passwords, just what the account is, what it’s for, and who the vendor is. Most owners are surprised how long this list gets. That list alone is gold for whoever has to step in.
2. Use a password manager with emergency access
Several password managers have an emergency access feature. You name a trusted person. If they ever request access, you get a notice, and if you don’t deny it within a waiting period you choose (say, 48 hours), they’re let in. If you’re fine, you just deny it. If you’re not, they get what they need. Set it up once and forget about it.
3. Add a second admin to your email platform
Create a dedicated emergency admin account in Microsoft 365 or Google Workspace. Long random password, its own MFA method, stored somewhere safe. Don’t use it for daily work. It exists so one locked phone doesn’t lock the whole company out of its email.
4. Print your MFA recovery codes
Most services give you backup codes when you set up MFA. Print them. Put them in a sealed envelope in a fireproof safe or a safe deposit box, and tell your trusted person where it is. If you use a hardware security key, buy a second one, register it, and store it with the codes.
5. Handle the money side properly
For the bank, don’t share your login. Talk to your bank about adding an authorized signer or a second user with their own credentials. And talk to an attorney about a power of attorney and what your operating agreement says about someone stepping in. I’m an IT guy, not a lawyer, but I can tell you the tech side doesn’t help much if the legal side isn’t covered.
6. Write a one-page ‘if I’m out’ sheet
One page. Who to call for IT, banking, accounting, and legal. What’s due every week and every month. Where the envelope is. Which clients need a heads up. Keep it with the recovery codes.
Test It Once a Year
A plan nobody has tried is a guess. Once a year, have your trusted person do a dry run. Can they find the envelope? Does the emergency admin account still work? Did that recovery code expire because you reset MFA six months ago? You’ll find at least one thing that’s broken. Better to find it on a calm Tuesday than during a real emergency.
This Isn’t Morbid. It’s Responsible.
Nobody likes thinking about this. But your employees, your clients, and your family all depend on the business still running if you’re out for a couple of weeks. A few hours of setup now means one less thing on everyone’s plate during a terrible week.
Block off an hour this month and start with the account inventory. That one step gets you halfway there. For more practical IT advice for South Florida business owners, visit yourtech.solutions.