You just became the admin of a small company's entire digital estate — the passwords, the DNS, the backups, the billing logins. Nobody hands you a map. The failure mode of the first week is not a hack; it is ignorance wearing confidence: changing things you do not yet understand, promising restore times you have never tested, and discovering in month three that the only backup is a hard drive in the founder's drawer.
This runbook is the opposite: five days, one deliberate act per day, and a strict rule — in week one you learn and you prove, you do not rebuild.
Day 0 — the read-only inventory
Walk the estate without changing anything: where the admin credentials live, who owns the DNS registrar, where backups land, which card pays for which SaaS. The fastest complete map of a small team's stack is the last three months of card statements — every recurring line item is a system with an owner, a login, and data. Then interview the founder, finance, and the most senior non-technical person. Three questions each: what ruins your week when it breaks? what do you back up and where? what happens if I'm unavailable tomorrow?
Day 1 — prove ONE backup restores
The single most important act of your first week. Pick the most business-critical dataset and do a real restore — file, database, or mailbox — into an isolated location, with a stopwatch. A backup you have not restored is a rumor. Record the restore time and the recovery-point gap in writing while you control the wording, and check the 3-2-1 shape while you're in there. Sync is not backup. Replication is not backup.
Day 2 — the access audit + break-glass
Diff every admin list against today's org chart: former employees, former contractors, and "temporary admin since 2023" accounts are doors with no reason to be open. Build the break-glass emergency account while you're still motivated. Enforce MFA on the crown jewels this week — email, identity, DNS, finance — and stage the long tail for next month. Enforcing everything on day two is how the new admin becomes the villain of the week.
Day 3 — alerts that page vs emails nobody reads
Find every alerting channel, send a test to each, and ask who actually read last week's alerts. A dead alerting channel manufactures false confidence at 2am. Then write one page: what wakes a human, what waits for morning, what goes to a weekly digest — tied to your severity matrix. Build the escalation tree out loud: when you're unavailable, who is next?
Day 4 — DNS and the things that end businesses
Domain expiry and registrar hijack are business-ending failures no server monitoring ever catches, because they happen at the registrar — usually nobody's monitored system. Check owner, expiry, auto-renew, registrar lock, and who else can edit records. Export every DNS record with its purpose. Then calendar the silent killers: cert expiry, renewals, the next quarterly restore test.
Day 5 — the bus-factor document
One page, stored where leadership can reach it without you: where the credentials live, how to reach break-glass, how to restore and how long it takes, who the vendors are and how to escalate, and what to do in the first 30 minutes of a breach. Hand it over in person, with a rehearsal. An out-of-date bus-factor doc is a false map, and false maps are worse than none.
What NOT to do in week one
- Don't rip and replace. Month one is for plans; week one is for learning and proving.
- Don't buy tools before you've inventoried what you own. Most small teams have an adoption gap, not a tool gap.
- Don't skip the boring days. The AI project is worth zero if a former employee's account is still active and the backup doesn't restore.
By day 30: password manager rollout done, MFA everywhere, patch cadence running, first weekly ops report delivered in the business's language, and a day-30 self-drill on the calendar — which is itself proof the week worked.
The full day-by-day runbook (with the checklists wired in) lives on ops-notes — free, no signup. If you're the person who just inherited the keys: day one is the restore test. Everything else can wait a day.
Top comments (0)