How should you manage account access, security, and impersonation risk?

Keep each executive account under its legitimate owner's control, give every operator named and revocable access, and require a tested recovery path before publishing begins. A capable PR partner should be able to work without receiving the executive's password. The buyer should reject any setup that cannot identify the account owner, access approver, day-to-day operator, and incident-response owner.

Every account needs an owner, an operator, and a recovery path

Ask the provider to build an access register during onboarding. It should cover social profiles, email, newsletters, domains, websites, podcast feeds, analytics, schedulers, cloud folders, media databases, and advertising accounts. For each system, record:

• the legal or practical owner;
• the primary and backup administrators;
• each user, role, connected app, and reason for access;
• the authentication and recovery methods;
• where recovery codes are held;
• the available content, audience, and archive exports; and
• the event that triggers access review or removal.

Use native roles or an approved publishing service when the platform supports them. X, for example, offers owner, administrator, and contributor roles without password sharing. If a platform has no suitable role, use a vetted tool with revocable authorization and the narrowest permissions available. Confirm permissions in the live product because platform controls change.

Authentication strength should match the account's risk

Require unique credentials in an approved password manager and multifactor authentication for every account that offers it. Prioritize the linked email, domain registrar, ad account, and mobile carrier account because they can become recovery paths into the public profile.

CISA advises businesses to use the strongest available method and aim for phishing-resistant MFA, especially on administrative and sensitive accounts. Its business MFA guidance identifies physical security keys as an option. When hardware keys are impractical, use the strongest method the service supports. LinkedIn identifies an authenticator app as its preferred two-factor method.

High-profile executives face risk through both personal and company systems. The UK National Cyber Security Centre advises high-risk individuals to use corporate accounts and devices for work where possible, avoid password sharing, and use management services for professional social accounts in its high-risk individual guidance.

Personal and company control require an explicit three-party test

The executive owns identity proof, personal-account consent, and personal recovery choices. The company owns its systems, records, security policy, and incident response. The day-to-day manager grants operational access and keeps the register current. The provider must disclose every employee, subcontractor, tool, and connected application that can reach an account.

The payer does not gain a personal password merely because it funds the program. LinkedIn's User Agreement says the member owns the account as between LinkedIn and an employer. Conversely, a company-owned channel should not depend solely on an executive's personal email or phone. Put account ownership, recovery authority, content archives, and transfer duties in the contract.

Impersonation response starts with independent verification

The incident runbook should distinguish a compromised authentic account from a copycat account. Name verified contacts for the platform, company security, legal, communications, and law enforcement. Define who may preserve evidence, revoke sessions, rotate credentials, disable connected apps, pause scheduled posts, warn stakeholders, and submit impersonation reports.

Do not approve urgent requests based only on a display name, familiar writing style, caller ID, or voice. The FBI has reported malicious texts and AI-generated voice messages used to impersonate senior officials. Its current alert recommends verifying identity through a known contact method and refusing to share authentication codes.

Test recovery at onboarding, after changes to administrators or recovery methods, and before high-risk events such as launches or travel. Offboarding should revoke users, sessions, API tokens, connected apps, forwarding rules, and scheduled content, then confirm the archive transfer. Make those steps part of the offboarding decision.

PressFriendly sells executive PR services, so apply these access and exit tests to us as rigorously as you would to any other provider.