Should I just give a trusted employee my password?

No. A shared password still depends on your own two-step sign-in, leaves no separate record of who did what, and stops working the day you change it. Use named admin or owner accounts and shared business vaults for ordinary coverage. Microsoft emergency accounts are a separate last-resort safeguard.

Can Google or 1Password let someone into my account if I'm unavailable?

Not quickly, and not simply on request. 1Password states that it has no access to account passwords or Secret Keys and cannot reset or recover them. Google turns super admin self-recovery off by default for most current and all new customers, and its other recovery routes depend on proving control of your domain. Set up a second authorized person before relying on provider recovery.

How long should the wait period be for emergency access?

Long enough for you to notice and deny a request that should not have been made, short enough to help in a real absence. Proton offers 1, 2, 3, 7, 14 or 30 days, and Bitwarden's minimum is one day. We suggest a week as a starting point for most small businesses.

What should an owner-absence instructions sheet include?

Who the second person is, which password manager the business uses and how they get in, the admin account they use for email, the accounts that matter most and where each login is kept, who to call (IT provider, accountant, bank, attorney), and what must keep running: payroll, rent, key suppliers, renewals and client messages. It should not contain passwords or recovery codes.

Is this the same as a business succession plan?

No. A succession plan deals with who owns and runs the business long term, and belongs with your attorney and accountant. This plan is narrower: it makes sure someone you trust can reach email, passwords and key accounts while you are away, without you handing over your own credentials.

If the Owner Is Out: A One-Page Small Business IT Plan

If you were unreachable for two weeks, could someone else keep business email and essential accounts running? This plan gives a named colleague their own access to the systems they need, records the handoff on one page, and tests it every 90 days. Reserve shared emergency accounts for the rare case when normal admin access fails.

Start with the access your colleague needs for ordinary work. Then prepare recovery routes for a lockout or longer absence.

The plan on one line each

Choose one person and tell them they are the one.
Give them their own access to your email system and the shared business passwords.
Write one page that says where things are and what to do first, then seal it.
Test it every 90 days, with them doing the signing in.

What stalls when the owner is away

In many small businesses, one person holds the domain, the email admin console, the password manager and the bank portals. That is efficient until they are travelling, on leave, unwell or simply out of reach. Then routine work waits: a renewal notice sits in their inbox, a shared folder can only be opened up by its owner, a payroll approval code goes to their phone, and a supplier's request to change bank details has nobody to check it.

None of these is a security failure. Each is a single point of access. Five questions show where yours are:

Who, other than you, can sign in to the email admin console (Google Workspace, Microsoft 365 or Proton) with their own account?
If you lost your phone and laptop on the same day, how would you get back into the password manager?
Which account codes and alerts go only to your phone?
Does anyone else know where the list of important accounts is kept?
When did someone other than you last prove they could get in?

If the answer to the first question is "nobody", start with Step 2 for your email system. It matters most because password resets for almost every other account are sent there.

Handing someone your password can look like the quick fix. In practice it creates three problems, and each one tends to show up just when the access is needed.

Two ways to cover an absence

Your key, or a key in their name

Named admin accounts and shared business vaults support the second column; emergency recovery works differently.

Shared password

Lending your own key

Two-step sign-in gets in the way

The code or prompt still goes to your phone or security key.

No separate record

Everything they do looks like you did it.

Stops after a change

It stops working the day you change your password.

Their own access

A key issued in their name

Their own two-step sign-in

Their phone or security key, not yours.

Logged as them

Admin activity shows who did what.

Revocable on its own

You can remove it without changing anything for anyone else.

Calling support is not a quick substitute either. 1Password states that it has no access to account passwords or Secret Keys, so it cannot reset or recover them. Google says that for most current and all new customers, super admin account recovery is off by default, and its other routes depend on proving control of your domain, which takes time and assumes someone else can reach your DNS settings. These limits protect the business from impostors. Arrange normal delegated access before you need account recovery.

Step 1: Choose one person and tell them

Pick one person. A business partner, an operations or office manager, or a family member you would trust with the business's money are the usual choices. An outside accountant or IT provider can also fill the role, with a written agreement that says what they may do.

Avoid someone who usually travels with you. If you are both away at the same time, the plan does not help.

Then have a short conversation. They need to know three things: that they are the one, where the sealed page is kept, and that they will sign in every 90 days to prove it still works.

Step 2: Set up their own access in email and the password manager

Set this up on two systems: your email system, which receives many account resets, and your password manager, which should hold shared business logins in a vault or collection the second person can open. Do not assume an admin role automatically grants access to a private vault or the owner's inbox. Use the rows for the tools you run. If you are still choosing a password manager, our business password manager comparison covers how each one handles shared vaults and admin roles.

Platform	What the vendor recommends	What to do
Google Workspace	More than one super administrator account, each managed by a separate individual. Super admins keep a separate account for daily work, enroll more than one security key, and print backup codes.	Create a super admin account for your second person, separate from their everyday account. Have them enroll two security keys and keep their own backup codes in secure offline storage.
Microsoft 365	Assign a named administrator the least privileged role needed. Separately, Microsoft recommends two or more emergency access accounts: cloud-only accounts on the onmicrosoft.com domain, with the Global Administrator role and phishing-resistant sign-in.	Give your second person their own admin account and role for the tasks they must cover. Separately, have your IT provider set up two monitored emergency accounts with FIDO2 security keys, stored in different secure places. These shared break-glass accounts are for failure of normal admin access, not routine absence.
1Password Business	You can't recover your own account, so add at least one other person to the Owners group. Owners, administrators and custom groups with the Recover Accounts permission can recover team members.	Add your second person to the Owners group. Separately grant their account access to the shared business vaults they need; an Owner role alone does not open your private vault. They can help recover your account if you cannot sign in.
Bitwarden	Emergency Access for premium users, including members of paid Families, Teams and Enterprise organizations. It covers your individual vault. View access lets the contact read it; Takeover replaces your master password and removes your two-step login methods.	Give your second person their own organization account and access to the collections they need. Emergency Access with View permission is an optional, delayed route into your individual vault; it does not replace collection access. Confirm the invitation and test the normal account.
Proton	Emergency access on all paid plans, with up to five contacts and a wait period you choose. Proton organizations can also have more than one administrator.	For Proton for Business, give your second person an organization admin account if eligible and check the rights it provides. Emergency access is a separate delayed route into your own Proton account. Add a contact with a Proton Mail address only if that wider access is intended.

A few details decide whether this works in practice.

Google Workspace: keep the backup codes current. Each set has 10 single-use codes, and creating a new set makes the old one inactive. If the second person generates a fresh set, their earlier printed codes stop working. Have them check the stored set during the 90-day test; never copy it into the handoff envelope.

Microsoft 365: separate normal admin access from break-glass access. Emergency accounts are intentionally not linked to an individual or employee phone, so their use is less attributable than a named account. Record who may retrieve each key, alert on every sign-in, and review the logs after use. Microsoft says to exclude them from Conditional Access policies that could block sign-in; ask your IT provider to verify the policy and test both accounts.

1Password: keep your own Emergency Kit separately. The second Owner can help recover your account; their separately granted shared-vault access covers day-to-day business logins. Your Emergency Kit holds your sign-in address, email address and Secret Key, with a space for your account password and a setup code. 1Password suggests writing your account password on at least one printed copy and, if two-factor authentication is on, the 16-character secret beside the QR code. Because a completed kit holds your own credentials, keep it somewhere only you control, such as a home safe or safe deposit box, not in the envelope for your second person. If your organization disables Emergency Kits, or your own account uses single sign-on, you may not be able to save one. 1Password says Owners keep Emergency Kits when other members use SSO. Check the Owner account itself before assuming a kit exists. Our 1Password Business review explains how Owners, SSO and recovery fit together.

Bitwarden: finish the handshake. Your contact needs a free or premium Bitwarden account on the same server region, must accept the invitation within five days, and you then confirm them. Until both steps are done, they cannot request access. If your organization turned on the Automatic confirmation policy, Emergency Access is not available to your account.

Choosing an emergency access wait period

Bitwarden and Proton work differently: they let a trusted contact request access, then start a wait period that you set. You are notified, you can approve or deny during the wait, and if you do nothing, access is granted when it ends. Proton offers waits of 1, 2, 3, 7, 14 or 30 days; Bitwarden's minimum is one day.

The wait period is your protection against a request that should not have been made. Pick one long enough for you to notice an email and refuse, and short enough to help during a real absence. We suggest a week as a starting point for most small businesses. A Proton emergency contact must have a Proton Mail address. With Proton, one invitation gives access to the account as a whole, including mail, passwords and files, so choose the contact with the same care as a second admin. Our Proton Pass business review covers how emergency access fits with Proton's other recovery options.

Step 3: Write the one-page instructions sheet

The instructions sheet holds no passwords or recovery codes. It tells your second person where things are, how they get in, and what to do in the first few days. Copy this table into a document, fill it in by hand and print it. A printable version is part of the free Chapter 18 sample of our IT handbook.

Section	What to write
Owner	Your name and personal phone number
Second person	Who this envelope is for
Password manager	Which one, which shared vaults or collections they can open, and any emergency-access route into your own vault, with the wait period you chose (Bitwarden, Proton)
Email admin	The named admin account your second person uses. For Microsoft 365, record where each separately stored emergency account and key can be found by an authorized person.
Accounts that matter most	Domain registrar, bank, payroll, website, phone provider, with where each login is kept
Who to call	IT provider, accountant, bank contact (and who can sign), attorney
Keep paying	Payroll date, rent, key suppliers
Keep running	Domain and email renewals, client messages, your inbox auto-reply

If you are not sure who controls your domain, settle that first; our guide to checking who owns your business domain name walks through it.

Put the printed page in an envelope and seal it. Keep each person's backup codes with that person's own recovery materials; do not copy their codes into the shared handoff. Store any Microsoft emergency credentials and keys separately under an agreed access procedure. A signature across the seal can show that the page was opened, but it is not a substitute for access controls.

Store it where your second person can reach it without you. For emergency credentials, Microsoft recommends secure, fireproof safes in separate locations. Pick locations the authorized people can actually reach when you are away. A bank safe deposit box or attorney's file is useful only if access has been arranged in advance.

One money rule belongs on the sheet too. Requests to change a supplier's bank details are a common route for invoice fraud, so write down that any such change is confirmed by calling the supplier on a number you already have. Our guide to vishing and payment fraud covers how that check works.

Step 4: Test it every 90 days

Microsoft recommends validating emergency access accounts at least every 90 days, and again after IT staff changes or subscription changes. This plan uses the same rhythm for everything. Put a repeating calendar event for you and your second person called "Emergency access test."

Every 90 days

A quarterly access test

Your second person does most of the signing in. A plan only counts once someone other than the owner has used it.

1
Email
Admin sign-in
They sign in to the email admin console with their own account and their own two-step sign-in.
2
Vault
Shared passwords
They open the shared business vaults or collections and find the listed accounts.
3
Kit
Your own check
If you use 1Password and have an Emergency Kit, verify you can sign in from it on a new device.
4
Recovery
Recovery routes
Each person checks their own recovery method; the authorized team validates both Microsoft emergency accounts.
5
Update
Refresh the page
New bank, new IT provider, new phone number: update the sheet and reseal it.

Open the instructions envelope during the test, then update and reseal it. Do not trigger a timed emergency-access takeover merely for a routine check.

The test exists to catch quiet drift: backup codes replaced when someone reset their account, a security key that went into a drawer, a contact whose emergency-access invitation expired, or an accountant who moved firms. If an employee with admin access leaves, run the test as part of their offboarding.

What this plan does not cover

This is an IT plan. It does not decide who can sign for the business at the bank, or what happens legally if you cannot act. Those are questions for your bank and your attorney, which is why the sheet has a line for each. Ask your bank what it needs for someone else to act on the business's accounts.

It is also not a business succession plan. Succession planning deals with ownership and long-term leadership. This plan covers the practical layer underneath both: email, passwords and the accounts the business runs on. It is the part of business continuity planning that most small businesses can finish in an afternoon.

Common mistakes

Recovery codes kept only on a phone. If that phone is lost, so are the codes. Each account holder should keep their own codes in secure offline storage.
The second admin's two-step sign-in goes to the owner's phone. It must use their own phone or security key.
The only Emergency Kit is in the owner's email. If the owner is locked out of email, the kit is locked out with it. Keep a printed copy somewhere only the owner controls.
Set up once, never tested. Accounts change, people leave, keys get lost. The 90-day test is what keeps the plan current.

If your business also relies on an outside IT provider, our IT handover checklist covers the wider question of who holds admin access, and the annual office walk-through ends with a shorter version of this sheet.

Best Password Manager for Business — How 1Password, Bitwarden, NordPass and Proton Pass handle shared vaults and admin roles.
1Password Business Review — Owners, recovery and admin controls in more depth.
Proton Pass vs Bitwarden — Two password managers with emergency access, compared for business use.
Who Owns Your Business Domain Name? — Make sure the domain your email depends on is under the business's control.
What to Do When Your IT Person Quits — The same single-point-of-access problem, when the person leaves for good.
Small Office IT Checklist: Annual Walk-Through — Twelve stops, ending with a short "if I'm away" sheet.