Write the Run Book Before You Need It

Not hypothetically - actually walk it through. What's your email password? It's in the password manager. Where's the password manager? On the laptop. What's the recovery path? A code sent to your email. Which you can't open. Most owners hit a loop like that inside two minutes, and the room goes quiet.

Big operations solve this with something unglamorous called a run book: the document that lets a stranger operate the system when the person who built it isn't there. On the data centres and stadium projects I worked across for thirty years, the run book was a deliverable - nobody would accept a handover without one. Your business has a handover coming too. You just don't know the date yet.

What goes in a run book

A run book is a map of your business's machinery, written for a bad day. Mine - and the version I talk owners through - covers six things:

1. Your suppliers and services - who hosts the website, who registered the domain, who provides the internet, the phones, the accounting software, the email. For each one: the account name, the support number, and which email address the account lives under.
2. Your subscriptions and what they cost.
3. Your domain names and their renewal dates.
4. Who holds admin on what - which staff member or contractor controls each account.
5. Where the backups live and how to reach them.
6. The recovery paths - where the spare MFA codes are, which accounts can reset which other accounts, and the order that works in.

You'll be surprised how many of these you can't name cold. The earlier exercise about who looks after your website usually surfaces three suppliers nobody remembered.

What does not go in it: passwords. A run book is a map, not a key. The keys stay in your password manager; the run book tells a stressed version of you - or your business partner, or your family - that the manager exists, where its emergency kit is, and what to ring first.

Where it lives

A document that only exists on the laptop that was just stolen has failed its one job. Keep the run book in three places: a printed copy somewhere sensible at the office, a printed copy somewhere that isn't the office, and a digital copy in storage you can reach from any machine. Yes, printed. Paper has one property the cloud doesn't: it works during the exact category of disaster that takes your systems down.

Then put a recurring hour in the calendar - quarterly is plenty - to read it and fix what's drifted. Suppliers change. Numbers change. Staff move on and take logins with them. A run book that's two years stale will mislead you with confidence, which is worse than no run book at all, because you'll burn your first hour trusting it.

Why this is a security document

I can hear the objection: this isn't cybersecurity, it's admin. I'd put it differently. Security has three jobs - keeping your information secret, keeping it correct, and keeping it available. The industry obsesses over the first one because that's where the products are. But walk back through the businesses I've watched have their worst week, and the thing that hurt most was rarely the secret getting out. It was the hours and days of not being able to operate.

A run book is pure availability. It converts "we're down and I don't know who to call" into a sequence of phone calls you've already written in order. No subscription, no consultant, no software. An hour to draft, an hour a quarter to keep honest.

The handover-day version of this lesson cost real money every time I watched an organisation learn it: the contractor leaves, the documentation doesn't exist, and the next person pays to rediscover what the last person knew. A five-person business runs the same risk with higher stakes - there's no next person. There's just you, a borrowed computer, and whatever you wrote down.

So run the exercise. Laptop's gone; borrowed computer; get back in. Where did you stall? That stall point is the first line of your run book - and you get to write it this week, calmly, with coffee, instead of discovering it the other way.

---

Sources

• Red Bridge Cyber, perspective: Nobody Is Coming to Fix Your Website
• Red Bridge Cyber, perspective: The Third Word in the Definition of Security