Single-person dependency in IT: what happens when the person who knows the passwords leaves?

In many businesses the same person has run IT for years: an employee, an acquaintance or a one-person company. They hold the firewall password, they know which account the domain name sits in, and only they remember why the server was set up the way it was. That person may be well-meaning and competent; the risk lies not in intent but in the only copy of the knowledge sitting in one human memory.

When does single-person dependency become a risk?

• When the person leaves, or cannot be reached for a long time
• When there is a disagreement; access can turn into a bargaining chip
• When an auditor asks “who granted this permission, and when?”
• When the domain name or a licence turns out to be registered to the person’s private account

Four steps to move the knowledge to the organisation

• Ownership: we move the domain, Microsoft 365 administration, hosting and licence accounts into the company’s name and onto a company email address.
• Password vault: we bring all administrator passwords into a corporate vault that at least two authorised people can access.
• Documentation: the network diagram, IP plan, server roles, backup arrangements and supplier list are put in writing.
• Records: every change made is logged with its date and reason.

In the managed service model these four items are part of the contract: the documents belong to you and stay with you even if you stop working with us. You can tell a good service provider by how easy they make it to leave. See our Managed IT Services page for details.