Custody Is Not Ownership: Building a Board-Level Register of Digital Assets

Most companies can produce a fixed asset register for laptops, vehicles and office equipment. Far fewer can say with confidence who controls the domain name that carries their email, which individual’s personal address is the recovery route for the website, or whether a software licence is held by the company or by the person who arranged it.

These are digital assets. They rarely appear on a balance sheet, but they support invoicing, sales, payroll, communication and compliance. When they work, nobody notices. When a renewal lapses or an administrator leaves, the effect can be immediate and commercial. The director’s task is not to become a network engineer. It is to apply ordinary governance: identify what the company depends on, establish who controls it, document ownership, and set a review cycle.

Ownership is a legal question, not a technical one

An asset may be paid for by the company and still be held in another name. A domain name may be registered by an agency. A hosting account may sit under a former employee’s email address. A design tool or accounting add-on may be licensed to an individual rather than to the legal entity. A security certificate may be issued to a trading name that no longer matches the registered company.

For each asset, four questions expose the position:

• Who is the contracting party? Is the account, licence or registration in the name of the company, a director, an employee, a freelancer or an agency?
• Who controls recovery? Which email address, mobile number and authentication device can reset the password or approve a transfer?
• Who pays, and from which account? A company card payment is useful evidence, but it does not by itself prove ownership or control.
• How would the asset be moved? If the current custodian were unavailable tomorrow, could the company transfer, renew or cancel the asset without their personal cooperation?

Where the answer to any of these questions is unclear, the asset should be treated as a governance exception until it is resolved.

Build a register the board can actually use

A digital asset register does not need to be exhaustive. It needs to be accurate, readable and maintained. Keep it to the assets that would stop or materially disrupt trading if lost, locked or allowed to expire.

A practical register would include:

• Identity and web presence: primary and defensive domain names, DNS management, website content management system, email domains and any brand-related handles.
• Infrastructure: hosting, cloud storage, backup services, virtual private servers and content delivery accounts.
• Software and subscriptions: accounting, payroll, customer relationship management, e-commerce, design, security and communication tools.
• Certificates and security services: SSL/TLS certificates, code-signing certificates, email authentication records and endpoint protection administration.
• Access and administration: password managers, single sign-on, payment gateways, bank administration portals and any account with the ability to approve changes.
• Data-dependent services: platforms holding customer records, employee data or statutory records, where access control affects data protection obligations.

For each entry, record the asset name, its business purpose, the legal owner or contracting entity, the named custodian, the recovery route, the renewal or review date, the annual cost, the criticality rating and the location of supporting evidence. Add a deputy custodian for every critical item. A register with one name against each asset simply moves the single point of failure rather than removing it.

The employee-name problem

A common pattern is for a website, domain or hosting account to be set up quickly by an employee, freelancer or agency. The arrangement works for years. The company pays the invoices. Then the individual leaves, becomes ill, disputes a fee or simply stops responding. The company discovers that the recovery email is a personal address, the authentication app is on a former employee’s phone, and the supplier will not discuss the account without the named holder’s authority.

Directors should treat personal-name custody as a risk, not a convenience. The remedy is rarely a single dramatic project. It is a series of small controls:

• Require company-controlled email addresses and company-owned authentication devices for all business-critical accounts.
• Use a business password manager with named users, audit logs and a documented break-glass process rather than shared spreadsheets or personal vaults.
• Record who has administrator rights, review that list at least annually, and remove access promptly when roles change.
• Where an external agency holds an asset, obtain written confirmation of the company’s ownership and the transfer process before the relationship begins — and keep it with the register.
• Ensure at least two authorised individuals can recover each critical account, with the deputy recorded in the register.

For UK domain names, the registrant details matter. A .co.uk domain may be managed through a hosting provider, but the underlying registration sits with Nominet. Directors should know who the registrant is and whether the company can demonstrate its rights if a provider or custodian becomes unresponsive.

Renewals, triggers and exceptions

A register is only useful if it prompts action. Set a renewal calendar with standard alerts at 90, 30 and 7 days before expiry. Include software renewals, certificate expiry, domain renewals and contract break dates, not just direct debits.

The board should also agree escalation triggers — events that require the register to be reviewed outside the annual cycle:

• A custodian resigns, retires, takes extended leave or changes role.
• A supplier is acquired, ceases trading or changes its bank details.
• A renewal notice is missed or an account is suspended.
• The company changes its registered name, trading name or bank.
• A new website, payment platform or customer database is introduced.
• A cyber incident, suspicious login or unexpected password reset occurs.

Exceptions should be reported to the board in plain language: which asset is affected, what the commercial exposure is, who is accountable for resolving it, and by when.

Evidence, review and board minutes

An annual review should test the register rather than merely read it. Confirm that named custodians still hold their roles, that recovery routes work, that invoices match the recorded ownership, and that licence counts reflect actual use. Keep screenshots or confirmation emails showing administrative control and ownership. Store them with the register, not in an individual’s inbox.

Record the review in board minutes. The point is not bureaucracy. It is evidence that directors have identified the company’s dependencies and taken reasonable steps to protect them. That evidence matters if a dispute arises with a former supplier, if an insurer asks about controls, or if a lender or buyer examines the business. Guidance from the National Cyber Security Centre and frameworks such as Cyber Essentials can support the technical side, but the ownership question remains a board responsibility.

Five decisions for the next board meeting

1. Approve a digital asset register and name the person responsible for maintaining it.
2. Identify the ten assets whose loss would most quickly affect trading, and assign a custodian and deputy to each.
3. Require company-controlled recovery routes for all critical accounts, with a timetable for moving any personal-name arrangements.
4. Adopt a renewal calendar and a short list of escalation triggers.
5. Set an annual attestation, signed by a director, that the register has been reviewed and exceptions are being managed.

A company’s digital estate is not less real because it has no physical form. The next silent renewal, locked account or departing administrator will reveal whether the company owns what it relies on — or merely borrows it from someone who happens to hold the keys.