Free course · Module 2 · Lesson 2 of 4
What you pay for
What you'll decide
Every app and online service the business uses, what each one holds, who owns it, and whether two-step login is on.
A business with 15 people typically runs on 20 to 40 online services. The owner can name about ten of them. The rest were signed up for by someone, for a good reason, and then forgotten. The one that leaks is usually one of the forgotten ones.
Plain-English terms
Online service. Software you use through a browser or an app, run on the vendor's computers: Microsoft 365, QuickBooks Online, Square, Canva, Mailchimp. Security people say SaaS.
Owner (of an app). The person in your business who answers for it: knows what it's for, decides who gets access, notices the bill.
Holds. What of yours is inside it. Money, email, customer data, files, or nothing sensitive.
Admin console. The settings area of a service where you manage users. Microsoft 365 and Google Workspace each have one that also lists other apps people have connected to their work accounts.
The app you forgot about
The receptionist set up a free online booking tool two years ago because the phone kept ringing. Customer names and phone numbers went into it. She left. Nobody else knew the login, the tool kept running, and the free plan never sent a bill that would have reminded anyone.
Then the tool's maker has a breach. You find out from a customer who got a scam text mentioning their appointment. You can't answer the obvious questions: what was in there, who could log in, has anyone changed the password since she left. You don't even know the account's email address.
That's the whole reason for this tab: so you can answer those questions in five minutes. It isn't there to police what people sign up for.
Four places to look
Card and bank statements
Twelve months of them. Every recurring charge to a software company is a service you use. Look for the small ones: $8 a month is how a forgotten tool announces itself.
Email receipts
Search the company mailboxes for "Welcome to", "Your receipt", "Your trial is ending", and "Your subscription". Free plans show up here even though they never appear on a statement.
The admin console
Microsoft 365 and Google Workspace both list third-party apps people have connected to their work login ("Sign in with Google" leaves a trail). This catches tools that never sent a bill.
Ask everyone
One question at the next team meeting: "What do you log in to for work?" Ten minutes. People know what they use; they just never had a reason to tell you.
What to record
For each service:
- What it's for, in a few words.
- Who owns it in the business, and who can log in. A name or a role, not "everyone".
- What it holds. Money, email, customer data, files, or nothing sensitive. This is the column Module 1's rules run on.
- Two-step login. On, off, or the service doesn't offer it. If it holds money or customer data and two-step is off, that's this week's job.
- Who fixes it. For an online service, that's the vendor. Your job is the settings.
- Still used? If not, it's this month's job: get any data out, then close the account.
Cancel what you don't use
An app you stopped using still holds your data and still has logins into it. Closing it is one of the cheapest security improvements there is, and it saves money. Export anything you need first, delete the data if the service lets you, then close the account. Write the date in the Notes column.
Scenario
Yours to list, or not?
Six things turned up while you were looking. Where does each one go?
1Canva Pro, on the company card, used by whoever does the marketing that month.
Show the answer
Goes on this tab. It holds your brand files and possibly customer photos, several people share the login, and it's paid for. Give it an owner and turn two-step login on.
2The free booking tool the old receptionist set up, with customer names and phone numbers. Nobody has used it since she left.
Show the answer
List it, then close it. It's still holding customer data behind a login nobody knows. Get the account back through the vendor's password reset to the receptionist's old mailbox (that's one reason to keep mailboxes for 30 days), export anything you need, delete the data, close it.
3The office printer.
Show the answer
Another tab. It's a device, so it goes on the Devices tab in Lesson 3. Same for the router, the cameras and the card terminal.
4Zoom, on the owner's free plan, used for supplier calls.
Show the answer
Goes on this tab. Free counts. It has a login, it's connected to the owner's calendar and contacts, and it's how the business talks to suppliers. Two-step login is available on free plans.
5Your IT provider.
Show the answer
Another tab. They're a vendor: an outside company that runs things for you and holds your data. Vendors get their own tab in Lesson 4. Their admin account in your email system, though, went on the People tab in Lesson 1.
6QuickBooks Online.
Show the answer
Goes on this tab, near the top. It holds money and customer records, so it's a top system from Module 1. Owner: whoever runs the books. Two-step login: on for every user, including the outside accountant.
0 of 6 sorted
Remember
- The forgotten app is the one that leaks. This tab exists so you can answer "what was in it and who could log in" in five minutes.
- Four places to look: card and bank statements, email receipts, the admin console's connected-apps list, and asking everyone.
- Record what it holds and whether two-step is on. Close what you don't use, after getting your data out.
Build your file
Tab 2: Apps and services
Open the Apps and services tab. Add one row per service, including free ones. For each: what it's for, who owns it, who can log in, what it holds, two-step login, who fixes it, and whether it's still used. Leave the Level column for Lesson 4.
Start with the statements and receipts, then the admin console, then ask the team. Expect the list to be two or three times longer than you guessed. That's normal, and it's the point.
The Read me tab counts apps that hold money or customer data without two-step login. Work that number down first.
Where this goes next
Steps 7 and 16 of the Security Starter follow directly from this tab: a password manager for all those logins, and cancelling what you don't use. In the VM Program Kit, this is the Assets tab of the Prioritization Model, where every system gets a tier and an owner.