A business can pay for its domain, website, email and software subscriptions without knowing who can actually control them. Digital service ownership is not established by an invoice or an administrator login alone. To understand your position, check four things separately: who holds the registration or contract, who can make decisions, who has technical access and how the organisation could recover or transfer the service if circumstances change.
This distinction matters well before a supplier relationship ends. A service can work perfectly today while depending on a former employee’s email address, an agency’s customer account or one person who knows the recovery procedure. The practical goal is not to own every piece of infrastructure. It is to know which rights and responsibilities exist, what evidence supports them and where continuity depends on someone else.
A working service can conceal an ownership gap
Imagine a small organisation whose website has been managed by the same agency for several years. The organisation pays an annual invoice and can edit pages in its content management system. Everything appears to be under control. But the domain may be registered through the agency’s account, DNS settings may be managed elsewhere, and the hosting agreement may name a different contractual customer.
None of those arrangements is automatically wrong. Managed services are often sensible, and an external specialist may be exactly the right person to administer technical systems. The problem arises when nobody has documented who is entitled to request changes, approve a transfer, renew a contract or regain access if the usual contact becomes unavailable.
There is also an important difference between owning a company and holding rights to a particular digital service. A domain registration, for example, is governed by registration agreements and applicable policies. A software subscription usually grants contractual rights to use a service, subject to its terms. Treating every service as property that can simply be ‘taken back’ obscures the checks that really matter.
Four questions worth answering for every critical service
Who is the registered or contractual holder? Look for the party identified in the provider’s records, registration or service agreement. An agency may pay on a client’s behalf, or a business may reimburse someone else, without that transaction alone establishing the rights associated with the service. For resold services, distinguish the company sending the invoice from the provider operating the underlying platform.
Who has decision authority? Someone within the organisation should be authorised to approve renewals, contractual changes, access requests and supplier transitions. This may be the director, an operational manager or another designated role. Decision authority is an organisational responsibility, not a synonym for possessing an administrator password.
Who has technical control? Identify the people or roles that can manage accounts, change DNS records, deploy website updates, export data or alter security settings. Technical control can appropriately sit with a supplier, but the organisation should know the scope of that access and what happens when the relationship changes.
Who can restore continuity? Normal access is not the same as a verified recovery route. Check the provider’s supported process for a lost administrator account, the existence of a second authorised contact, and any practical restrictions on exporting or transferring essential information. Do not assume that a backup exists, or that an available export will work in another system, without evidence.
These questions are consistent with the wider governance approach in the NIST Cybersecurity Framework 2.0, which addresses inventories of software and external services, supplier relationships and clear responsibilities. The framework does not, however, determine who legally owns a particular customer account or domain.
How to check your five most important digital services
You do not need a complex asset-management platform to make a useful start. Take the five services whose loss would most disrupt your organisation. For many small businesses, these include the domain and DNS, business email, website or hosting, customer or financial software, and backups or cloud file storage.
- Identify the provider and the service. Record what the service does, who sends the invoice and, where different, who operates the platform. Use recent contracts, renewal notices and authorised account records rather than relying on memory.
- Check the holder and decision-maker. Write down the party named in the relevant contract or registration, plus the internal role authorised to approve changes. If a supplier appears as the holder, check the applicable agreement before drawing conclusions about rights or transfer.
- Record administrator access by role. Note whether an internal team, external agency or another authorised party manages the service. Record where approved access procedures can be found, not the passwords or recovery codes themselves.
- Verify the recovery and exit route. Find the provider’s official recovery instructions and ask how data exports, domain changes, service transfer or restoration would work. Mark any untested assumption as unverified.
- Assign an action to every important unknown. Give each gap a responsible person, a next action and a review date. ‘Unknown’ is an acceptable initial finding; an unsupported guess is not.
A simple record can use fields such as service, provider, contract or registered holder, decision owner, technical administrator, recovery or exit route, evidence source and verification status. Keep it accessible to authorised colleagues, review it after significant changes, and do not store passwords, private recovery keys or identity documents in the inventory.
Why domain names deserve particular care
Domains illustrate why public records, commercial arrangements and technical access must not be confused. For relevant generic top-level domains, ICANN’s Registration Data Access Protocol (RDAP) provides access to registration information, but available details can be limited. A public lookup is therefore a starting point, not definitive proof of your organisation’s contractual position.
There is an additional distinction between privacy and proxy registration arrangements. As ICANN explains, a privacy service can mask contact information while the customer remains the registered holder. Under a proxy arrangement, the proxy provider can be the registered holder of record and make the domain available under an agreement. The specific arrangement and applicable rights need to be checked with the registrar and relevant parties.
For practical governance, ask more than ‘Is the domain ours?’ Ask which registrar manages it, who is recorded as the holder, who can change DNS settings, who receives renewal notices and what authorised process would apply if access were lost. An unexpected answer is a reason to investigate, not to attempt an unauthorised transfer.
Turn uncertainty into a manageable decision
Not every missing detail demands immediate escalation. Prioritise by two factors: how seriously the organisation would be affected if the service became unavailable, and how little evidence exists about its holder, access or recovery. A business email service tied to a single personal recovery account may deserve attention sooner than a low-impact subscription with a documented administrator and exit procedure.
Suppose your bookkeeper knows which platform holds financial records, but nobody can confirm who may request an export. The next action is not to replace the platform. It is to ask the provider or authorised account holder about supported export formats, contractual conditions and the people permitted to initiate the process. Likewise, when a website agency controls the domain account, first establish the actual registration and support arrangements before considering changes.
Some of these findings may inform a later digital supplier handover, but an ownership review serves a different purpose. A handover deals with a transition; a review makes decision rights and dependencies visible while normal operations continue. Neither exercise guarantees a transfer, recovery, security outcome or legal entitlement.
Clear responsibility is more useful than assumed ownership
A healthy digital setup does not require every service to be self-hosted or every administrator to work internally. Organisations can use managed hosting, SaaS platforms, specialist agencies and external support responsibly. What matters is that the arrangement is understood: who holds the relevant rights, who may act, who is accountable and what happens when access or a supplier relationship changes.
Start with five services and verify what can be verified. Where the records are incomplete, document the uncertainty and assign a next step. That modest exercise can turn a vague sense of control into a clearer, more dependable basis for decisions.
