Handovers and audits.

The questions that come up

• Where is the domain registered and on whose account
• When did we last change hosting provider, and what were we on before
• How long has this certificate been renewing automatically
• What did our terms page say in March of last year
• Were we running that third-party script during the period of the incident
• Has this been monitored, and by whom, and since when

Each of these has a definite answer. Almost none of them can be produced on request, because the record that would contain them was never kept.

Three situations where this becomes urgent

A person leaves. The domain is on their account, the certificate renewal runs on a server they configured, the mail provider was set up with their login. None of it is written down because it never needed to be while they were there.

Someone is buying, insuring or auditing you. The request is not for the current state, which is easy, but for evidence over a period. Assurances do not satisfy it. Dated records do.

Something went wrong and the question is when. An incident, a dispute over what was advertised, a claim that mail was never received. The answer depends entirely on whether anything was recorded at the time.

Why reconstruction usually fails

Some of it can be pieced together from registrar emails, invoices and old backups, given a few days. Much of it cannot. Nobody can tell you what a DNS record contained before it was edited, or what a page said on a specific date, unless somebody kept a copy at the time.

This is the specific reason a record has to run continuously rather than being assembled when needed. By the time you need it, the window to create it has closed.

The minimum worth keeping

• Where each thing is registered or hosted, and on which account rather than which person
• Renewal dates somewhere other than in a provider's email
• What changed, when, and what the value was beforehand
• Some dated evidence that the above has been watched rather than assumed

The wider version of this problem is covered in inherited infrastructure.

This is one symptom of a wider gap: nobody owns your domain.