A sole operator holds every credential, every relationship, and every piece of knowledge. The realistic threat is unavailability rather than intrusion, and the fix is documented access somebody trusted can use.

The risk that actually applies

Security advice for small businesses is written as though the threat is an attacker, and for a one-person business the more likely disruption is simpler.

An accident, an illness, a family emergency, or a phone lost on holiday. In each case the business stops, not because anything was compromised, but because everything requires one person and that person is unavailable.

That is a security question in the sense that matters: whether the business can continue to operate.

What only you can currently do

Worth listing, because the list is longer than most owners expect.

That last item is the compounding problem. Two-factor authentication protects the accounts and also means the phone is now a single point of failure for everything at once.

Recovery codes, which almost nobody saves

The specific fix for the two-factor problem and it takes an afternoon.

Every service offering two-factor also offers backup or recovery codes, generated once, usable if the phone is unavailable.

Those need to be printed and stored somewhere physical and secure, not on the phone, not in the email account they protect, and not in a file on the laptop that may be lost alongside it.

A sealed envelope in a home safe, or with a lawyer or accountant, is adequate and considerably better than the usual arrangement of nowhere.

The same applies to the password manager's own recovery key, which is the one credential that unlocks everything else and which is frequently stored only on the device it protects.

The person who could get in

The uncomfortable decision worth making deliberately.

Somebody should be able to access the essentials if you cannot. A spouse, a business partner, an accountant, or a trusted colleague.

That does not mean handing over passwords now. Most password managers offer an emergency access arrangement where a nominated person can request access, with a waiting period during which you can decline.

That mechanism is designed exactly for this and is under-used. It gives somebody a route without giving them current access.

Where that is not available, a sealed envelope with instructions, held by somebody trusted, achieves the same thing with more manual steps.

What the person would need to know

Access alone is insufficient. Somebody with your passwords and no context can still not run anything.

A single document, updated occasionally, covering: which accounts matter and where they are, who the current customers are and what is outstanding, who your suppliers and accountant are, where the money is, what recurring payments exist, and what would need cancelling or postponing.

A page or two. It is not a business continuity plan and it is the difference between a pause and a collapse.

Worth writing as though for somebody who does not know the business, because that is who would be reading it.

The ordinary protections still apply

Briefly, since they are not the point of this post.

Two-factor on email, the registrar, the bank, and anything financial. A password manager rather than reused passwords. Backups that are tested. Software updated.

The one worth emphasising for a sole operator is the device. A single laptop or phone holding everything, with no backup and no encryption, is the largest practical exposure, and both device encryption and automatic backup are settings rather than projects.

Insurance and the practical side

Worth checking rather than assuming.

Whether you hold any coverage that responds to your own inability to work, and what your obligations to customers would be if you could not complete booked work.

Also worth having: a relationship with a comparable business who would cover urgent customer work in an emergency, on the understanding you would do the same. Many trades have this informally, and having it explicitly is better.

That arrangement protects customers, protects your reputation, and costs nothing until it is needed.

The afternoon that covers most of it

  1. Generate and print recovery codes for every account with two-factor.
  2. Set up emergency access in your password manager, or seal an envelope.
  3. Write the two-page document and tell somebody where it is.
  4. Turn on device encryption and automatic backup.
  5. Agree an informal cover arrangement with a comparable business.
  6. Diarise a review once a year.

That is a single afternoon against the scenario that is genuinely most likely, and it starts with knowing what accounts exist at all, which is the inventory described in knowing who can get into what.

Frequently asked questions

What is the real risk in a one-person business?

Unavailability rather than intrusion. An accident, illness, or lost phone stops the business because everything requires one person.

Why does two-factor make it worse?

It protects the accounts and makes the phone a single point of failure for all of them at once, since that is where the codes arrive.

What is the specific fix?

Recovery codes, generated once for every account and stored somewhere physical and secure, not on the phone and not in the email account they protect.

How do I give somebody access without giving them access now?

Most password managers offer emergency access, where a nominated person can request it after a waiting period during which you can decline.

What would that person need besides passwords?

A page or two covering which accounts matter, current customers and what is outstanding, suppliers, where the money is, recurring payments, and what to cancel.

What else is worth arranging?

An informal cover arrangement with a comparable business who would handle urgent customer work in an emergency, on the understanding you would do the same.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Everything in one phone with no recovery codes anywhere?

We spend an afternoon on the scenario that is actually most likely, which is you being unavailable rather than anybody attacking you.

Start a Conversation