Make the client and its business assets the management unit
Start with the client owner, websites, domains, hosting, email routes and important integrations. Identify the business workflows that matter, such as enquiries, bookings or store checkout. The same plugin on two websites can support very different dependencies and consequences when a change fails.
Record who owns billing, recovery and administration for the relevant accounts. An agency may maintain a website while a former supplier controls the domain or an employee personally owns the payment integration. Those relationships need a decision, not a reassuring “managed” label in the portfolio spreadsheet.
Keep the register appropriately protected and reference credentials in their approved store rather than copying them into project notes. The portfolio view should help assign work and spot missing ownership. It should not become a convenient collection of every client’s passwords, full customer records and unrestricted share links.
Translate the client promise into owned operational checks
Describe the service in terms the client can use: what is checked, what is changed, what evidence is produced and what requires separate approval. Avoid a blanket “security included” statement that leaves the agency and client imagining different responsibilities.
Use this original register to connect a repeated task with the actual website and owner. A result can be verified, incomplete, blocked or outside scope. Treat those states distinctly so a portfolio’s high completion rate cannot hide one unresolved business-critical item.
| Area | Client-specific record | Result and next owner |
|---|---|---|
| Access | Relevant identities, roles and recovery contacts | Necessary access verified; unnecessary grants assigned for review |
| Changes | Component set, approver and business dependencies | Agreed update accepted or exception recorded |
| Integrations | Purpose, account owner and external actions | Required route verified within the authorized scope |
| Recovery | Covered data, retained history and restore evidence | Known recovery capability and remaining gaps |
| Alerts | Recipient, service hours and expected next action | Delivery and follow-up responsibility established |
| Exit and continuity | Client-owned accounts, licenses and handover material | Access removal and continuation duties recorded |
Prevent one client’s access from becoming another client’s risk
Review individual accounts, service identities and tools used across the portfolio. A person assigned to one website should not acquire unnecessary reach into another client merely because the agency uses a shared management interface. Inspect actual supported permissions and account recovery routes rather than relying on folder names.
The joint managed-provider advisory from ASD ACSC and partners advises separating customer data and avoiding reused administrator credentials. Apply those principles to the agency’s actual tools and client environments, with evidence of the available controls and explicit limitations.
Include evidence handling in the same boundary. A report template should contain only the intended client’s information, and a screenshot should not expose another client’s browser tab or account details. Define who may receive the material and remove temporary access through an owned completion process.
Manage updates as changes that need acceptance
Document the proposed component set, relevant compatibility concerns and a recovery route. Use a protected test environment where appropriate and define the critical workflow checks for that client. “Updates ran” and “the agreed business functions were verified afterward” describe different outcomes.
WordPress’s updating guidance covers preparation and backup as part of the process. The actual environment may add store, gateway or other integration requirements. Coordinate external actions and test inputs so a controlled check does not email customers, charge a payment method or create a real dispatch.
Keep the record of what was changed, observed and left open. Where a supported configuration cannot be updated or a dependency blocks acceptance, assign a decision and an owner. Do not leave the exception invisible until the next person assumes the website is fully maintained.
Make alerts, licenses and recovery survive staff or supplier changes
A working alert needs an appropriate recipient, an understood meaning and an agreed action route. Test delivery through a controlled scenario and record service-hour limitations. Installing monitoring does not establish that someone investigates every notification or is available outside the agreed schedule.
Check who owns licenses, backups, accounts and exported work when the agency relationship changes. A client should understand which functions depend on a provider-controlled subscription and which records must be handed over. Coordinate authorized revocation without destroying evidence or removing the only viable recovery route.
Report decisions and unresolved work instead of a decorative score
A useful client update identifies the reviewed scope, completed changes, verification, open findings and decisions needed from the client. Link each open item to its consequence and owner. Separate an assessment recommendation from a correction that was actually implemented and checked.
CyberFixCrew is an Israeli cybersecurity company serving agencies and businesses worldwide. Our practical Israeli website and digital-infrastructure knowledge can support a specifically defined gap in the agency’s delivery. Start with the client’s environment and the work the agency already owns; keep credentials and customer exports out of the initial enquiry.
Review the operating record when websites, suppliers, staff or business processes change. The purpose is a repeatable responsibility model that remains useful across the portfolio. It is not certification, an automatic response service or a promise that every managed client is protected against every future incident.
