Who owns the essential accounts?
The organization should be able to identify the legal registrant, billing owner, administrative users, recovery methods and renewal responsibilities for its domain, hosting, email, analytics and critical platforms.
Digital infrastructure
The systems your business depends on.
Domains, business email, websites, analytics, access and recovery planned as one connected operating environment.
Digital infrastructure
A connected operating system for the business behind the website.
Digital infrastructure includes the domains, DNS, business email, websites, analytics, identity, integrations, backups and administrative access that keep digital operations working. The service maps ownership and dependencies before changes are made so one repair does not quietly break another system.
What depends on what?
A domain can control the website, email routing and authentication records. Website forms may rely on external mail or customer systems. Dependency mapping reveals the operational effect of a change before it reaches production.
How would the business recover?
Recovery requires more than a backup file. The organization needs tested access, documented restoration steps, account recovery, current configuration records and a decision owner who can act during an outage.
How is the system measured?
Availability, successful transactions, email authentication, form delivery, access changes, backup tests and qualified customer actions provide more useful evidence than a general claim that the technology is working.
How the work moves from uncertainty to an accountable decision.
Inventory domains, systems and owners
The assessment records domain registrars, DNS providers, hosting, mail systems, analytics, consent tools, forms, customer platforms, payment integrations and other dependencies. Each item receives an owner, administrator, billing contact and renewal status.
Unknown ownership is treated as an operational risk because the business may be unable to renew, migrate or recover the service when a former supplier or employee is unavailable.
Map identity and administrative access
Administrative accounts are separated from everyday use where practical. Multi-factor authentication, recovery methods, role assignments and access removal procedures are reviewed. Shared credentials make accountability and safe offboarding difficult.
The access map identifies who can change DNS, read business email, publish website content, view customer data or alter measurement. Privilege should match responsibility.
Protect business email continuity
Mail flow depends on correct DNS routing, provider configuration, user accounts and sender authentication. SPF, DKIM and DMARC have different functions and must be evaluated together with legitimate sending services.
Migration planning covers coexistence, data transfer, routing, aliases, devices, historical messages, cutover and rollback. No authentication record guarantees inbox placement because recipient systems make their own filtering decisions.
Operate the website as infrastructure
A business website connects content, forms, analytics, consent, security, hosting, domains and customer response. Releases therefore require backups, acceptance tests, monitoring and documented rollback criteria.
Performance and accessibility are tested around real pages and tasks. A high laboratory score does not compensate for an unclear offer, a failed form or a customer journey that staff cannot fulfil.
Create dependable measurement
Analytics and conversion tracking are configured around defined business outcomes. Events are tested through the full journey and reconciled with downstream records where lawful and available.
Consent choices, browser restrictions, offline activity and missing identifiers create gaps. Reporting should preserve unknowns instead of manufacturing complete attribution.
Prepare recovery and controlled change
Recovery planning identifies backup frequency, retention, storage separation, restoration steps, responsible people and acceptable interruption. Backups are useful only when they can be accessed and restored.
Change records document what was altered, when, by whom, why and how it was validated. This history reduces guesswork when a later failure appears across connected systems.
A structured path with visible decision points.
- 01
Infrastructure inventory
Confirm systems, account ownership, administrators, billing, data locations and renewal dependencies.
- 02
Risk and dependency map
Identify single points of failure, access gaps, unsupported services and changes with cross-system consequences.
- 03
Controlled implementation
Sequence repairs or migration with backups, test cases, communication, rollback and accountable owners.
- 04
Operations handover
Deliver documentation, monitoring rules, recovery procedures and a schedule for continuing review.
Deliverables designed to be used after the engagement.
System ownership register
A practical account record covering providers, roles, billing, recovery and renewal responsibility.
Dependency and data-flow map
A view of how domains, email, websites, forms, analytics and third parties exchange data or rely on one another.
Risk-prioritised remediation plan
Actions sequenced by operational impact, security exposure, dependency, effort and validation method.
Recovery and change runbook
Documented backup, restore, cutover, rollback, monitoring and escalation procedures for critical systems.
Scope discipline
What responsible advice must make clear.
Professional work separates verified facts, interpretation, assumptions, client responsibilities and decisions controlled by third parties.
- No provider can guarantee uninterrupted availability; architecture, monitoring and recovery reduce impact and improve response.
- Email authentication supports identity and policy signalling but does not guarantee delivery or inbox placement.
- Security review reflects the access and evidence available at the time and cannot prove that a system has no vulnerabilities.
- Privacy, retention and regulatory obligations require advice appropriate to the organization, data and jurisdiction.
- Third-party platforms control their services, verification processes, outages, limits and account decisions.
Authoritative material supporting this guidance.
NIST Cybersecurity Framework 2.0
Risk-management guidance organized around governance, identification, protection, detection, response and recovery.
Review source CISA Cyber Guidance for Small BusinessesU.S. government cybersecurity resources for small and medium organizations.
Review source W3C Web Accessibility InitiativePrimary web accessibility standards, guidance and educational resources.
Review sourceAnswers needed before choosing a provider.
Is a website considered digital infrastructure?
Yes when it supports customer acquisition, service delivery, payments, enquiries or essential communication. Its dependencies and recovery needs should be documented.
Should the business own the domain account?
The organization should retain durable control appropriate to its legal and governance structure, with current billing and recovery information.
Can email be migrated without interruption?
Planning can reduce interruption, though no migration is risk-free. Routing, data transfer, devices, authentication, coexistence and rollback need testing.
How often should backups be tested?
The interval depends on change rate, criticality and recovery objectives. Restoration tests should occur often enough to reveal access or integrity problems before an emergency.
Does multi-factor authentication solve account security?
It is an important control. Recovery processes, phishing resistance, device security, privilege management and offboarding still matter.
Can the work cover systems from several providers?
Yes. Cross-provider ownership and dependency mapping is central because business operations commonly span several services.
Related guidance
Explore more about Digital Infrastructure
Explore related DSDillon guidance, services and next steps.
