Digital Assets Every Australian Business Should Document

A 'digital asset' sounds grand. In practice it is anything the business signs into. The domain. The website. The inbox. The accounting software. The point-of-sale terminal. The social accounts customers actually message. If losing access to it would stop a shift, delay an invoice or embarrass the business in front of its customers, it belongs on the register.

The point of the register is not perfection. It is to answer a simple question: on the morning something goes wrong, can we sign in, and if not, who do we call. A business that can answer that question in minutes is in a different operational position to one that spends the first day of a crisis assembling the answer from scratch.

Tier One: Stop-The-Business Assets

The domain is first. It is the address customers type, the base of your email, and the place every link eventually points back to. The registrar account is the real asset here, because whoever controls the registrar controls the domain. For a .com.au or .au this is managed through an auDA accredited registrar.

Business email is second. Whether the business runs on Microsoft 365 or Google Workspace, the mailbox contains the invoices, the password reset emails and the conversations that keep the business moving. The global administrator account for the tenant is the asset, not just the individual staff mailboxes.

The website is third. Most Australian small businesses use WordPress, Shopify, Squarespace, Wix or a bespoke build. The admin login, the hosting account and the backup location are the three parts to document.

The payment account is fourth. Stripe, Square, Tyro, Westpac PayWay, Commonwealth BPOINT, PayPal, or whichever gateway settles the money. Losing the admin account here delays payouts and, during a dispute, prevents the business from presenting its own evidence of a transaction.

The accounting software is fifth. Xero, MYOB or QuickBooks. These are where the BAS is prepared, the payroll runs, and the auditor eventually comes knocking. Advisor access is often held by the bookkeeper or accountant and is easy to forget during a changeover.

Tier Two: Hurt-The-Business Assets

The Google Business Profile. It is the first thing most customers see. A suspended or hijacked profile is a direct hit to new enquiries, especially for local businesses that depend on Search and Maps.

The social accounts. Facebook Page, Instagram, LinkedIn Company Page, TikTok, YouTube. For most small businesses, two or three of these actually matter, and the rest exist but do no work. Document the ones that matter and note the ones that do not, because dormant accounts can still be compromised.

The Facebook Business Manager, now Meta Business Suite, is a separate asset from the Pages inside it. Businesses that have the Pages but not the Business Manager often discover this during a staff change, when the only account with Business Manager access turns out to belong to someone who left.

The booking platform. Cliniko, Timely, Fresha, Calendly, ServiceM8, SimPRO and the industry-specific tools that run the daily calendar.

The customer messaging tools. The SMS gateway, the email marketing platform (Mailchimp, Klaviyo, Campaign Monitor, ActiveCampaign) and the live chat tool.

The CRM. HubSpot, Pipedrive, Salesforce, Zoho, or an industry-specific equivalent. The file storage. Google Drive, OneDrive, Dropbox, or an on-premises file server. The administrator of the business tenant is the asset here, not individual user accounts.

Tier Three: Administrative Assets

The ASIC portal for the company. The ATO Online Services for Business. The myGovID or Digital ID used to access them. The state revenue office portal for payroll tax. The relevant professional registration portal (AHPRA, Tax Practitioners Board, legal practice board, builders' licensing authority).

Insurance portals, the superannuation clearing house, Fair Work records, workers compensation (iCare in NSW, WorkSafe in Victoria, WorkCover Queensland and the various state equivalents). These are rarely urgent, but during a disputed claim or an audit they become very urgent indeed.

Industry-specific tools: for a restaurant, the delivery platforms (Uber Eats, DoorDash, Menulog). For a trades business, the field service platform and the suppliers' trade portals. For a clinic, the practice management system and the Medicare Online portal.

What To Record Per Asset

The provider name. The account identifier (the Place ID, the Facebook Page ID, the tenant ID, the shop URL). The username or administrator email, recorded without storing the password in plain text next to it. Whether multi-factor authentication is on, and the recovery method on file. The internal owner, meaning the person on the team who is responsible for this asset. The backup owner, meaning the person who takes over if the first is unavailable. The external parties who have access, such as the bookkeeper, the marketing agency or the web developer, with the date their access was last confirmed. The date the record itself was last reviewed.

The Shadow IT Problem

Every business has tools that nobody formally approved. A sales person signed up for a free trial of a lead-generation tool. An office manager uses a personal Dropbox to share large files with a supplier. A technician added a QR code generator that now holds all the printed QR codes on the shopfront. These tools do not need to be banned. They need to be seen. A register entry means that when the technician leaves, the business knows to retrieve the QR codes before they are deleted.

The Australian Context

Australian businesses carry a layer of identifiers that overseas tools do not always understand. The ABN. The ACN for incorporated entities. The TFN, which is sensitive and should not be stored on general-purpose shared drives. The myGovID credential, which is personal to a director or employee and should not be used for anyone else's logins. Business names registered under the Business Names Act are a separate record from the company itself. Where a trading name differs from the legal entity, both need to be on the register, because platforms will often ask for one and the business will present the other.

A Short Scenario From Adelaide

A trades business in Adelaide moved offices. During the move, the office manager who had set up Facebook Business Manager eight years earlier left for another job. Nobody realised she had been the only Business Manager administrator. The business later wanted to run ads for a new service line. The agency hired to do the ads discovered that nobody could add them to Business Manager, because the only account with access was an email address at the old job that had been closed. The eventual resolution involved contacting Meta's business support and providing weeks of evidence. A register would have surfaced the problem on the day she handed in her notice.

Keeping The Register Current

A register that is updated once and forgotten quickly loses its value. Set a cadence. Quarterly is a sensible default for most small businesses. The review is short: for each asset, does the internal owner still work here, has anyone external had their access removed, and is the recovery contact still correct.

Trigger events shorten that cadence. A staff departure, an agency change, a supplier change, a change of ownership or an incident each warrant a focused review of the assets they touched. The quarterly rhythm catches drift. The trigger events catch the specific risk the event created.

Owners Are People, Not Departments

A register that lists 'Marketing' as the owner of the Facebook Page cannot be used in a crisis. 'Marketing' cannot reset multi-factor authentication at midnight. Owners are named people, with a backup also named. Where a role rotates, the record is updated at handover. The register is operational, not organisational chart decoration.

How Business Vault Fits

Business Vault provides a structured register where each asset carries its provider, identifier, owners, administrators, recovery contact and the dates these were last confirmed. Entries without an internal owner, with only external administrators, or with unknown multi-factor authentication are flagged so they can be addressed. The register sits alongside monitoring and incident workflows, so when something goes wrong, the people responding already know what the business owns.

A business that can list its assets, name their owners and prove it verified the list last quarter has already done the quiet, boring work that makes a bad week much shorter.