How to Prepare for a Digital Account Emergency

A digital emergency has a familiar texture. A key account is suddenly inaccessible. A listing has vanished. The website is throwing an error nobody has seen before. The inbox is forwarding mail to an address nobody at the business recognises. Whichever flavour it takes, the pattern of a well-handled response is almost always the same: the people involved know what the business owns, where the evidence is kept, who is authorised to call the provider, and what to say first.

That calm response is not a matter of personality. It is a matter of preparation. The businesses that recover quickly are the ones that did a small amount of boring work on a quiet week, months before anything went wrong.

What Counts As A Digital Emergency

A Google Business Profile suspension. A hacked business email account. A domain that has expired. A website that is defaced, offline or showing a payment skimmer. A compromised cloud tenant. A Facebook Page that has been removed. A sudden claim from a staff member that they can no longer sign into something they used to administer. A ransomware event on a workstation that held business documents.

Each of these has its own technical response. The preparation that supports all of them is similar in shape.

The Four Packs

Preparation is easier to think about if it is grouped into four small bundles. The identity pack. The location pack. The platform pack. The people pack.

The Identity Pack

The identity pack is the collection of documents that proves the business is a legitimate legal entity. A current extract from the Australian Business Register showing the ABN, trading names and GST registration. A current extract from ASIC for incorporated entities, showing the ACN, the registered office and the directors. A copy of the trust deed if the business operates through a trust. A copy of the partnership agreement if relevant.

Each of these documents has a date. Older than twelve months, and some providers will ask for a fresher copy. The identity pack is reviewed annually at a minimum.

The Location Pack

The location pack is the collection of documents that proves the business is at the premises it claims. A recent lease, licence to occupy or title deed. A utility bill in the business name, dated within the last three months, for the business premises. A phone or internet bill in the business name. For a storefront, a dated photograph of the signage, the street number and the entrance. For a service-area business, a photograph of a signed vehicle or a copy of the relevant trade licence.

Where the business has moved recently, the location pack needs to be updated promptly. Platforms notice address changes and will ask for fresh evidence.

The Platform Pack

The platform pack is the collection of account identifiers, usernames and recovery information for the services the business depends on. The Place ID for the Google Business Profile. The Business Manager ID for Facebook. The tenant ID for Microsoft 365 or Google Workspace. The shop ID for Shopify. The merchant ID for the payment gateway. The customer number at the hosting company.

The platform pack does not store passwords in plain text next to the identifier. Passwords live in a password manager (1Password, Bitwarden, Dashlane, Keeper or similar) that staff access individually, with multi-factor authentication on the password manager account. The platform pack stores enough identifying information to open a support case, request a recovery, or prove the account is yours.

The People Pack

The people pack is the short list of who is authorised to do what. Who can speak to the bank. Who can speak to Google. Who can speak to the hosting company. Who signs for the business during an incident. Who the backup is when the first-named person is unavailable. The names, roles and phone numbers of the two or three staff members who can act in each of these capacities.

The people pack also includes the external parties. The IT provider's incident number. The web developer's phone number. The lawyer's number for serious matters. The insurer's claim line for a cyber policy. The accountant for anything financial.

Severity Definitions

Severity labels help staff respond proportionately. Critical means trading or customer contact is materially affected now. High means a major asset is at risk but still operating. Medium means a control gap needs action this week. Agreeing on these labels in advance stops the business treating every alert like the end of the world, and stops it treating a genuine emergency as a normal Tuesday.

Communications In An Incident

An incident almost always has a customer-facing side. The website is down and callers do not know why. The booking system is not accepting new bookings. The email is not being replied to because the inbox is locked. Prepare a short holding statement in advance that can be sent to customers quickly, posted on social media, or placed on a holding page.

The holding statement does not need to explain the cause. 'We are temporarily experiencing a technical issue and are working to restore service. For urgent matters please call us on [number].' is more than most businesses manage during the first hour of a crisis.

The Decision About Public Comment

Decide, before an incident, who is authorised to speak publicly. For a serious event, especially one that involves customer data, the person speaking should be a director or senior manager, not whoever happens to be running the social accounts that day. Record that decision in the people pack.

Drills

A drill is a scheduled exercise that tests whether the preparation is actually usable. There are two useful kinds.

A tabletop drill is a conversation. The team gathers for forty-five minutes and talks through a scenario: the Google Business Profile has been suspended, what do we do. Each person describes what they would do next, what they would need and from whom. The gaps are written down. The exercise usually ends with a short list of records to update, people to add to the register, and documents to refresh.

A technical drill is more involved. The team actually attempts a controlled recovery: can we restore the website from backup to a staging environment, can we reset the administrator password on the hosting account, can we add a new administrator to the Google Business Profile without breaking the existing one. These are run quarterly or half-yearly and often reveal that something that worked in theory does not work when attempted under time pressure.

The Post-Incident Review

After any real incident, hold a short, honest review. What did we see first, what did we do, what worked, what did not, what would we do differently. Write it down. Store it with the incident record. The next incident, which may be years away and involve different staff, will go faster for having that record to read.

Update the plan within a week. Delayed lessons are lost lessons, and the memory of what went wrong fades quickly once the business is trading normally again.

A Short Scenario From Inner Sydney

A florist in inner Sydney noticed the morning of Mother's Day week that the website was returning a 500 error. The developer was on leave overseas. The hosting account's primary email was the developer's personal address. The business had not touched the account in two years. The owner spent four hours of a very busy morning trying to establish who held what, and the eventual recovery involved paying the hosting company to reset access using identity documents the owner then had to assemble on the fly.

A preparation pack with the hosting account details, a scanned ABN extract and a monitored business email on the account would have reduced the response to a thirty-minute phone call. The lost sales during the website outage were not recovered.

A Second Scenario From Melbourne

A plumbing business in Melbourne had its office email account compromised through a phishing email that captured credentials and a session token. By the time the compromise was noticed, a filter rule had been set to forward incoming mail to an external address and delete it from the inbox. A $40,000 invoice to a long-standing commercial client had been intercepted, and the client had been quietly told that the bank account had changed. The intervention of the IT provider, the bank and the client's own accounts team prevented the fraud at the last minute.

The business responded by changing its policy on authentication to use passkeys or hardware tokens for all administrator accounts, by rotating the SPF, DKIM and DMARC records on the domain, by introducing a phone-callback rule for any payment change, and by documenting the incident so the staff who were not involved could learn from it.

Who Approves Emergency Spending

Decide in advance who is authorised to spend money during a recovery. Some provider support, emergency IT help or forensic engagement needs fast approval. Ambiguity on this one point slows response more than almost anything else. A short written delegation, kept with the people pack, resolves it.

How Business Vault Fits

Business Vault structures the identity pack, the location pack, the platform pack and the people pack into a single register, with document dates, review reminders and an incident workspace that pulls the relevant records together when an event is declared. The register is where the preparation lives. The incident workspace is where the response happens. Business Vault does not act on your behalf with any provider; the authorised people on your register still open the appeal, speak to the bank and sign the sworn statements.

Preparation is a small cost against the alternative. The business that does the quiet work on a slow Thursday is the business that handles a bad Wednesday without losing a trading week.