Which accounts should appear in the inventory?
Begin with accounts your organization owns or authorizes for business use. Ask communications, IT and records teams to reconcile their lists instead of treating a website footer as the complete inventory. Include dormant accounts, campaign accounts and accounts run by an agency on your behalf. Record uncertain ownership explicitly; do not silently assign it to the person compiling the spreadsheet.
Work through a realistic example
A district knows about its central Facebook Page but discovers athletics and school-level accounts during a staff handover. Put each account on its own row with an owner and an unresolved-scope flag. That creates a review queue without claiming that every account has been approved, connected or historically captured.
Run the workflow
- Collect account URLs, platform identifiers, business purposes and active or dormant status. Keep display names separate from stable identifiers because names can change.
- Identify the business owner, authorized administrator, archive-connection owner and alert recipient. Record roles or approved work contacts, never passwords or recovery codes.
- Reconcile the inventory with the archive connection list. Investigate missing, duplicate and unfamiliar accounts before marking the scope as verified.
Check the evidence
| Check | What to verify | Evidence to keep |
|---|---|---|
| Ownership | Business owner agrees the account belongs in scope. | Owner approval and date. |
| Connection | The inventory row matches a specific archive connection. | Connection identifier and verification date. |
| Exceptions | Unowned or inaccessible accounts remain visible. | Named resolver, next action and due date. |
Record the decision and its limits
Use separate fields for discovered, approved, connected and verified. These states answer different questions. Ask an accountable owner to approve the baseline and store a versioned copy alongside the procurement or operating record.
Keep in mind: An inventory is not a credential store. Keep authentication secrets in the approved access-management system and limit the inventory to the information needed for ownership and scope decisions.
Further reading and scope
Reviewed October 14, 2026. These practical exercises are editorial guidance, not a guarantee of platform coverage or a substitute for your approved records policy.
- CISA: social media account protection — Account-security background; use your organization’s approved access process.
Common questions
Should dormant accounts be included?
Include them in discovery so the owner can decide how historical access, account closure and records responsibilities will be handled. Dormant does not establish that records are no longer needed.
Who maintains the list?
Assign one accountable maintainer and a change process. Account creation, renaming, supplier changes and staff departures should trigger a review of the relevant rows.
Put the guide to work
Use the downloadable workbook to record your requirements, test results and questions for shortlisted providers.