Start with the accounts that can reset other accounts or move money: primary email, your Apple, Google or Microsoft account, your mobile carrier, your password manager and your bank. CISA advises taking inventory of valuable accounts, including email and social media, then enrolling them in FIDO authentication.
Why an inventory first
CISA's guidance for highly targeted individuals says to take inventory of valuable accounts, including email and social media, and to review any account where information leakage would benefit threat actors. The point is to spend effort where a takeover costs the most.
Build the list in thirty minutes
Open your password manager and sort by last used. For each important account, note:
- What it can reset (email and carrier accounts reset nearly everything)
- What it can move (bank, brokerage, payroll, expense tools)
- What it exposes (photos, documents, deal files, messages)
- How it signs in today (password only, SMS, app, passkey, key)
- How it recovers (phone, backup email, codes)
The five to fix first
- Primary email. The reset path for most accounts.
- Your device ecosystem account (Apple, Google or Microsoft). It holds backups, passkeys and location.
- Mobile carrier account. Controls your number. See setting a carrier PIN.
- Password manager. Holds the rest. See the vault passphrase.
- Banking and brokerage. Where money moves.
What to do on each
- Enroll in FIDO authentication, with a passkey or hardware key. CISA names Microsoft, Apple and Google accounts specifically.
- Disable weaker second factors once the stronger one works. See turning off the SMS fallback.
- Replace the password with a long generated one.
- Save recovery codes and review recovery options.
- Register a spare key, as in the two key plan.
The next ring
After the five: social media accounts that carry your name, cloud storage, calendar and travel tools, tax and payroll portals, and any account linked to a family member. Rank by the same questions.
Old accounts you forgot
Look for accounts you no longer use. Delete them or lock them down. Old accounts with reused passwords are an easy way into the rest. We have not cited a source for this beyond CISA's point on reuse, which says one breach can expose other accounts.
Keep it current
Review the list twice a year, and after a job change, a move or a lost phone. Add a calendar reminder.
Share the right parts
Your assistant, spouse or lawyer may need to know which accounts exist, though not their passwords. See our digital legacy plan.
Quick check
Which account is most dangerous to lose?
Usually primary email, since most password resets go through it.
Do I need a hardware key for every account?
No. Prioritise the accounts that reset or move things. CISA says authenticator codes are fine for less valuable accounts.
Sources
Last reviewed: 19 October 2026.
