Can your shop recover its accounts if the owner loses a phone?

Begin with an ordinary interruption

A business can lose access to important work without a dramatic cyberattack. The owner’s phone breaks, an employee leaves or the person who knows the website login becomes unavailable.

CISA’s small-business guidance emphasizes multifactor authentication and tested protections; its backup guidance calls for copies kept apart from primary systems. Those principles become more useful when connected to an ordinary shop question: can an authorized person restore the next day’s bookings and contact customers after the main device is gone?

Draw the account map

List the systems that keep the business operating: email, domain registration, booking, payments, inventory and social accounts. For each, record the business owner, the authorized administrator and the recovery route.

Do not put passwords on a public worksheet or send them around a group chat. The map should reveal dependencies, such as a booking account recoverable only through an email inbox that nobody else can access.

Treat payment administration as a distinct responsibility, with access limited to the people who actually need it.

Test a copy, not the live shop

Choose a small, non-sensitive sample and confirm that a backup can be restored into a safe test location. Record how long it takes and which instructions are missing.

Avoid disabling the production account as an experiment during opening hours. For services with recovery codes, follow the provider’s own storage and recovery instructions.

A successful backup message is useful, but a restored file proves something different. Keep both results so the next person can see what was actually checked and on what date.

Give continuity a named owner

Put a short review on the business calendar after staff changes and important system changes. Customers should have a clear alternative contact route during an interruption, but they should never receive internal security details.

For a local directory profile, accurate hours and contact information are the public-facing part of this work. Behind that page, the business needs a recoverable account structure.

That combination helps neighbors keep finding services when an everyday technology failure would otherwise turn into several days of missed work.