The small-business password cliff (and how owners climb down safely)

Modern security is good at keeping strangers out-and accidentally keeping loved ones out. The cliff hits when no one knows which phone receives the SMS code or where backup codes are printed.

Document recovery paths, not just passwords

A resilient manual names devices, backup email addresses, support URLs, and who at the company can reset what. It assumes MFA exists and explains how a trusted person should escalate if locked out.

Pair technical truth with human language

Stillago sections prompt you to translate IT reality into sentences a non-technical partner can execute-or hand to a professional without forty follow-up calls.

MFA is wonderful until it becomes a wall

Multi-factor authentication protects against strangers and also against your spouse at 3 a.m. if nobody documented recovery paths. The password cliff is not “we forgot a password.” It is “we cannot reach the device that receives the code.” Recovery documentation must include backup codes location, alternate MFA methods, and the support phone numbers that actually work.

Owners often assume their IT person “knows everything.” In emergencies, that person may be unreachable, under contract limits, or legally unable to help without authorization. Your manual should name escalation paths and what can be done without you personally approving each click.

Translate security policies into human steps

Pair this article with passwords, devices, and trusted contacts for a practical template mindset.

Travel and voluntary unplugging still need guardrails

If you step away intentionally, read travel and unreachable owners so continuity covers sabbaticals-not only tragedy.

Why Stillago treats emergency access as a deliberate product decision

Handing over everything instantly is rarely the right first move. Graduated access, scoped read paths, and clear audit trails reduce both security risk and family conflict. That philosophy should match how you write recovery instructions: proportionate, testable, and kind.

For security framing, see security posture for sensitive manuals.

Test recovery paths before you need them

Once a year, do a boring drill: log out, attempt recovery using only what your partner has, and fix gaps. Drills feel silly until they prevent a real lockout. Document what failed and what you changed so the manual improves continuously.

If you use shared password managers, document the emergency export policy and where backups live. If you refuse to store certain secrets digitally, name the physical location and who is allowed to retrieve it.

Write for the support agent on the other end of chat

Support conversations go faster when your designated person can quote account identifiers, prior ticket numbers, and the exact product tier. Those details belong in continuity documentation because they are not memorable under stress.