The Keys Are in One Pocket: A Bus-Factor Plan for Small UK Teams

Picture a six-person studio in Bristol. The managing director is away — nothing dramatic, just a week in Cornwall before the silly season starts. On day two, the card that pays for the invoicing tool expires. On day three, the domain renewal reminder lands in an inbox nobody else can open. By day four, a client is asking why their staging site has gone dark and the only person who knows how the DNS is wired is somewhere with patchy signal and a dog to walk.

None of this is a disaster. It is just expensive: a scrambled afternoon, an apologetic email, a rush fee from a registrar. But it is entirely predictable, and small teams keep predicting it right up until it happens.

The awkward truth is that most organisations of ten to fifty people have a single human point of failure for a surprising amount of infrastructure. Not because anyone is a control freak — usually because they were there first. The handover pack below is how you fix that without turning it into a three-month governance project.

Start with a map, not a password

Before you touch a vault, list the things that would hurt if the keyholder vanished tomorrow. Not everything. Just the ones with a deadline attached.

Common candidates: the cloud billing account, domain registration and DNS, the finance or accounting platform, the shared inbox admin, the e-commerce backend, the password manager itself, the phone contract, the payroll portal, and whatever tool the sales team would riot over losing.

Write them on one page. Rate each as blocks work today, blocks work this week or annoying but survivable. You will usually find that six or seven entries sit in the top two columns, and the rest can wait.

That page is your scope. Keep it to a page. A sprawling asset register nobody updates is worse than a short list that stays current.

The vault is the boring bit — so make it boring

Store credentials in a proper secrets manager, not a spreadsheet, not a note in someone's phone, not a shared document called passwords FINAL v3. Most UK teams already pay for something that does this: a password manager with a business tier, or the vault built into their identity provider.

The mechanics matter less than three rules:

• Two people hold break-glass access. Not five. Not the whole company. Two named humans, one of whom is not the keyholder.
• The vault has an emergency access flow with a delay — 24 to 48 hours — so a leaver can't quietly open everything at 2am but a genuine absence can be covered.
• Every credential in the pack is a service account or a delegated login, not somebody's personal one. This is the part teams skip and regret, because a shared human account makes audit trails useless and offboarding miserable.

Rotate the break-glass credentials once a year and whenever someone leaves. Put the date in a calendar. That is the whole discipline.

Runbooks that a stranger can actually follow

A runbook is not documentation of how the system works. It is a sequence of steps that gets a specific job done by someone who has never done it.

Good ones are short, numbered, and written in the second person. Open the registrar dashboard, find the domain under Manage, click Renew. If the card fails, ring the billing line on the number below and quote account 4471.

Write five to start with: renew the domain, add a user to the finance system, restore a backup, take down a public page in a hurry, and pay an urgent supplier invoice. Each should fit on a single screen. If it does not, split it.

Test them. Hand one to a colleague who has never touched that system and watch silently while they follow it. The moment they hesitate is the moment your runbook is wrong.

The escalation ladder and the decision log

Two artefacts do most of the work in a real absence.

The escalation ladder is a single table: who to contact, for what, in what order, with phone numbers and expected response times. Vendor support lines, the accountant, the bank's business team, the registrar, the hosting provider, and the one person outside the company who knows how the thing is wired. Include account numbers. Include a note on who is allowed to authorise spend up to what amount.

The decision log is a running document where the keyholder records the calls they make that aren't obvious: why the DNS points where it does, why one vendor was rejected, what the agreed workaround is for the client who insists on something odd. Two lines per entry, dated. It is the difference between a colleague making a sensible judgement call and a colleague making an expensive guess.

The 90-minute drill

Run this before anyone books annual leave. Book a room, pick a system, and set a timer.

1. Minutes 0–10. The keyholder picks one live task that needs doing this month — a licence renewal is ideal.
2. Minutes 10–40. A stand-in works through it using only the pack. No phone-a-friend, no screen sharing, no just this once. If they get stuck, note where.
3. Minutes 40–60. Fix the gaps. Update the runbook, add the vendor number, correct the account reference.
4. Minutes 60–80. Repeat with a second, different task. It should be noticeably smoother.
5. Minutes 80–90. Confirm the vault's emergency access works, and check that both break-glass holders can get in.

Do it quarterly. It takes less time than the average incident, and it is far less embarrassing.

The one-page handover sheet

When someone does go away, hand over a single page. Not the whole pack — a summary that points into it.

• Who is covering, and their contact details
• The three things likely to need attention this fortnight, with dates
• Where the vault lives and who the second break-glass holder is
• The escalation ladder, copied in full
• Spend authority for the covering period, in plain numbers
• One line on what to do if something breaks that isn't on the list: stop, log it, call [name]

That page is the seal on the pack. It tells the stand-in that they are trusted, bounded, and not expected to know everything.

The point of all this

Bus-factor planning is not about distrust. It is the opposite: it is how you let one person take a proper holiday without their phone buzzing on a beach. The pack takes an afternoon to build, ninety minutes a quarter to keep honest, and it pays for itself the first time someone gets flu in February.

Start with the map. Everything else follows.