The primary reason I help charitable and not for profit groups is because they have the least resources and are often limited on what they can achieve with their budgets through the normal IT channels such as web design and development. They are all largely dependent on external help either through volunteers or through contractors.
When I first enter into a relationship with a client, there are a few questions that get asked to establish how much control they have over their current website and IT systems. Often I find that they do not know the answers, or there is someone else that knows the answers. In one case some years ago the person that owned their domain name had passed away. So it was likely with no action taken their website and email systems would fail when the domain name was not renewed.
Tips on what you need to know
Make sure you know the answers to these questions, if you don’t and cannot find anyone that does, it represents a problem for you that may be part of a crisis later. So, make a note of them, and store them somewhere safe, and reference them from your IT policy.
1). Where is my domain name held?
Why?
The domain name is like the golden set of keys to everything. You should know where it is located, and have access to it. If for any reason you needed to leave a relationship with a developer or hosting organisation, it starts with moving the domain name out to somewhere else. You need to know the web address, the password and the email address/ user account. If you do not have access to the email account associated with the domain registration, change it to one you do have access to.
2). Who is the registered owner of my domain name?
Why?
In the event that something goes wrong, for example a rogue developer has locked you out of your website, you can go back to the registration organisation and seek to recover the domain name. If it has your email address associated with it, then it is very easy to do this. Ideally the registered name needs to be someone within your organisation in order to be in control. Here of course there is another problem. People come and go. This is the reason I ask this question. In some cases we have had to track down an owner. In one case I tracked them down to Kenya via Facebook!
3). Where is my website hosting located?
Why?
You should have strict control of the hosting. You should know the login address, the user name and the password to get into the account. You should also have control of the registered email address as well, just in case you need to recover the password. From a GDPR perspective, you should also know exactly who has access to the hosting and control it. The most common problem here when it occurs is the hosting has expired, and nobody knows how to resolve it. You have lost your website and email if this happens.
4). Is my email held in a different location?
Why?
Not all email is held within the website hosting account. If you are working with a local IT specialist, they may have set you up with an Office365 account and your mail is hosted by Outlook.com. Additionally, in some cases your email may be directed to a 3rd party location service for filtering before it arrives at your inbox. Make sure you know who has access to your email accounts, where they are, how they are accessed and who has access. As with the other cases above. You need to have credentials on file so someone in your organisation can access this should the need arise.
5). Do we have an administrative account on the website?
Why?
Some developers may prevent you from doing anything, or some things, to your websit. Make sure you have at least two administrative accounts on your website where you have access to everything. This is absolutely essential for any website that is published and live. You need more than one account because if something goes wrong the main admin may be out of the office. Both accounts need to be tied to email addresses you control from within the organisation.
A few days ago I received a request to get into a WordPress website because of a potential legal situation which needed to be resolved ASAP. Nobody knew how to access the site. Nobody had a login for it. They were stuck. Fortunately they had access to the hosting account. I managed to regain control of the wordpress website and set up accounts for members of the organisation. This is not a situation you want to find yourselves in. If in this case I could not access the hosting, we would have been stuck.
6). Who is renewing my domain name?
Why?
If your domain name is not renewed, after approximately 30 days, your website will be removed from the web and you will lose your email. This can and does happen from time to time for a variety of reasons. The most common one is the warning message that it is about to expire, or needs to be renewed has not been actioned by someone.
Summary
I fully understand that in pretty much most of the organisations I am working with they are all max’ed out, working very hard with few resources in a tough environment. Knowing the answers to these questions (there are many more if you spread the net wider to other IT systems the organisation needs to use), may prevent a problem becoming a crisis later.