A property business may depend on only a handful of online accounts, but losing access to one can disrupt enquiries, repairs and payments. Begin by identifying which services the business actually uses and who is responsible for them. An account that works today still needs a clear recovery plan.
Make a simple inventory covering email, listing portals, property software, website access and document storage. Record the business owner of each account and the people who need access. Keep credentials out of that ordinary inventory and use an appropriate secure method for storing and sharing access information.
The National Cyber Security Centre’s small-organisation guidance covers email, important accounts, devices, backups and recognising attacks. Work through those topics with the team rather than treating security as a one-off technical task. Prioritise the email account used to reset other services.
Check that recovery details are current and controlled by the right person. Use strong, unique authentication and additional protection such as multi-factor authentication where supported. Avoid a setup in which an ex-employee’s personal phone or email is the only route back into a business-critical account.
Review access when an agent, contractor or member of staff changes role. Give people the permissions their work requires and remove access that is no longer needed. Shared access should remain accountable, so that a business can understand who can alter a listing or export records.
Agree a verification process for unexpected payment-detail changes. A convincing email should not be the sole basis for redirecting money. Contact the known organisation through a previously established route, and make sure staff know whom to involve when a message appears suspicious.
Keep suitable backups and test whether essential records can be recovered. Finally, write a short incident contact list and store it where it remains available if email is inaccessible. The aim is a manageable routine that protects the everyday work of the property business, rather than a collection of settings nobody understands.
Source and further reading: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security