# Operations & Administration

Systems inventory, security controls, HR and personnel management.

# Systems Inventory

This page lists the technology systems SHHA uses. For each system, we document what it does, who administers it, and how it is accessed.

*Items marked **TODO** need information filled in by someone with direct knowledge of that system.*

## 1. Microsoft 365

Microsoft 365 is SHHA's primary platform for email, mailing lists (Microsoft Groups), shared role mailboxes, and file storage (SharePoint).

<table id="bkmrk-typecloud-based-%28mic"><tbody><tr><td>**Type**</td><td>Cloud-based (Microsoft-hosted)</td></tr><tr><td>**Primary admin**</td><td>Anna (office staff) handles day-to-day membership changes; IT admin handles mailbox permissions and configuration</td></tr><tr><td>**Backup admin**</td><td>**TODO:** Identify and document a backup administrator</td></tr><tr><td>**Login**</td><td>[admin.microsoft.com](https://admin.microsoft.com) (admin), [outlook.com](https://outlook.com) (email), SharePoint links (files)</td></tr><tr><td>**Licensing**</td><td>Only office staff and IT admin need paid licenses; volunteers are free external guests</td></tr></tbody></table>

## 2. QuickBooks

Used for SHHA financial accounting.

<table id="bkmrk-typecloud-based-prim"><tbody><tr><td>**Type**</td><td>Cloud-based</td></tr><tr><td>**Primary admin / user**</td><td>**TODO:** Who is the primary user? (Treasurer? Office staff?)</td></tr><tr><td>**Backup**</td><td>**TODO:** Is there a backup user with access?</td></tr><tr><td>**Login**</td><td>**TODO:** URL and login method</td></tr><tr><td>**Notes**</td><td>**TODO:** Version (Online vs Desktop), billing, who pays for the subscription</td></tr></tbody></table>

## 3. Membership Database

**TODO:** Document the membership database system.

<table id="bkmrk-system-nametodo%3A-wha"><tbody><tr><td>**System name**</td><td>**TODO:** What system/software is used?</td></tr><tr><td>**Type**</td><td>**TODO:** Cloud-based or local?</td></tr><tr><td>**Primary admin**</td><td>**TODO:** Is Ryan the primary outside admin?</td></tr><tr><td>**Backup admin**</td><td>**TODO:** Is there a backup?</td></tr><tr><td>**Data stored**</td><td>**TODO:** What member data is in this system? (names, addresses, dues status, etc.)</td></tr></tbody></table>

## 4. Gusto

Used for payroll and employee benefits administration.

<table id="bkmrk-typecloud-based-prim-1"><tbody><tr><td>**Type**</td><td>Cloud-based</td></tr><tr><td>**Primary admin**</td><td>**TODO:** Who manages Gusto? (Office manager? Treasurer?)</td></tr><tr><td>**Backup**</td><td>**TODO:** Is there a backup admin?</td></tr><tr><td>**Login**</td><td>[app.gusto.com](https://app.gusto.com)</td></tr><tr><td>**Notes**</td><td>**TODO:** How many employees are on payroll? Billing responsibility?</td></tr></tbody></table>

## 5. SHHA Website

The public-facing website at [sandiahomeowners.org](https://sandiahomeowners.org).

<table id="bkmrk-typetodo%3A-what-platf"><tbody><tr><td>**Type**</td><td>**TODO:** What platform/CMS runs the website? (WordPress, Squarespace, custom?)</td></tr><tr><td>**Hosting**</td><td>**TODO:** Where is it hosted? Cloud-based?</td></tr><tr><td>**Primary owner**</td><td>**TODO:** Who manages content updates?</td></tr><tr><td>**Backup owner**</td><td>**TODO:** Is there a backup person?</td></tr><tr><td>**Outside consultant**</td><td>**TODO:** Is there a web consultant? If so, who? How are they paid?</td></tr><tr><td>**Login**</td><td>**TODO:** Admin URL and login method</td></tr></tbody></table>

## 6. GRIT Newsletter

The GRIT is SHHA's community newsletter, currently produced monthly.

<table id="bkmrk-production-tooltodo%3A"><tbody><tr><td>**Production tool**</td><td>**TODO:** What software is used for layout? (InDesign, Canva, Google Docs, etc.)</td></tr><tr><td>**Distribution method**</td><td>**TODO:** Print, email, or both?</td></tr><tr><td>**Editor / layout person**</td><td>**TODO:** Who currently does layout and editing?</td></tr><tr><td>**Gmail account**</td><td>shhagrit@gmail.com — **TODO:** document what this Gmail is used for (submissions? Google Drive access? legacy?)</td></tr><tr><td>**Related page**</td><td>See the *GRIT Layout Monthly Guide* in the Specialty Topics chapter for the step-by-step production process</td></tr></tbody></table>

## 7. Square

Used for Sandia Tram ticket sales and advertising payments.

<table id="bkmrk-typecloud-based-prim-2"><tbody><tr><td>**Type**</td><td>Cloud-based</td></tr><tr><td>**Primary user**</td><td>**TODO:** Who manages Square transactions?</td></tr><tr><td>**Backup**</td><td>**TODO:** Is there a backup?</td></tr><tr><td>**Login**</td><td>[squareup.com](https://squareup.com)</td></tr><tr><td>**Notes**</td><td>**TODO:** What specific transactions go through Square? Revenue amounts?</td></tr></tbody></table>

## 8. Other Systems

**TODO:** Are there additional systems not listed above? Examples might include:

- Bulk email / email blast service (Mailchimp, Constant Contact, etc.)
- Google Workspace (shared Google Calendar for Board reminders uses Gmail — is there a full Google account?)
- Domain registrar for sandiahomeowners.org — **TODO:** who manages DNS and domain renewal?
- Any other SaaS tools or vendor portals

# Controls & Security

This page documents access controls, cybersecurity practices, and data backup procedures for SHHA systems.

*Items marked **TODO** need information filled in. These questions originated from Andrea's controls review.*

## Access Controls — Who Has Access to What?

### Microsoft 365 Admin Access

<table id="bkmrk-global-administrator"><tbody><tr><td>**Global Administrator**</td><td>**TODO:** Who currently has Global Admin access? (There should be a primary and a backup.)</td></tr><tr><td>**User / Group management**</td><td>Anna (office staff) manages day-to-day membership. IT admin handles mailbox permissions.</td></tr><tr><td>**Who manages access?**</td><td>**TODO:** Is there a documented process for granting/revoking admin access? Who approves changes?</td></tr></tbody></table>

### Other System Access

<table id="bkmrk-systemprimary-access"><thead><tr><th>System</th><th>Primary Access</th><th>Backup Access</th></tr></thead><tbody><tr><td>QuickBooks</td><td>**TODO**</td><td>**TODO**</td></tr><tr><td>Membership Database</td><td>**TODO**</td><td>**TODO**</td></tr><tr><td>Gusto (Payroll)</td><td>**TODO**</td><td>**TODO**</td></tr><tr><td>SHHA Website (admin)</td><td>**TODO**</td><td>**TODO**</td></tr><tr><td>Square</td><td>**TODO**</td><td>**TODO**</td></tr><tr><td>Domain registrar</td><td>**TODO**</td><td>**TODO**</td></tr><tr><td>Google accounts</td><td>**TODO**</td><td>**TODO**</td></tr></tbody></table>

## Cybersecurity

### Current Practices

- **TODO:** Do we enforce multi-factor authentication (MFA) for Microsoft 365 admin accounts?
- **TODO:** Do we enforce MFA for all licensed users?
- **TODO:** How do we handle password policies? (complexity requirements, rotation schedule)
- **TODO:** Is there an incident response plan if an account is compromised?
- **TODO:** Do we have phishing awareness guidelines for staff and volunteers?

### Data Access

- **TODO:** How do we manage overall data access security? (e.g., conditional access policies, device restrictions)
- **TODO:** Are there any data classification policies (confidential vs. public)?
- **TODO:** How is sensitive financial data protected? (QuickBooks access, payroll data in Gusto)

## Data Backup

### Cloud-Based Systems

Most SHHA data resides in cloud services. Each provider has its own backup/redundancy:

<table id="bkmrk-systembackup-approac"><thead><tr><th>System</th><th>Backup Approach</th></tr></thead><tbody><tr><td>Microsoft 365 (email, SharePoint)</td><td>Microsoft provides built-in redundancy and retention policies. **TODO:** Do we have a separate backup solution (e.g., third-party M365 backup)? What are our retention policy settings?</td></tr><tr><td>QuickBooks Online</td><td>Intuit maintains backups. **TODO:** Do we also export periodic backups locally?</td></tr><tr><td>Gusto</td><td>Gusto maintains payroll records. **TODO:** Do we keep local copies of payroll reports?</td></tr><tr><td>SHHA Website</td><td>**TODO:** Who backs up the website? How often? Where are backups stored?</td></tr><tr><td>Membership Database</td><td>**TODO:** How is the membership database backed up?</td></tr></tbody></table>

### Local Data

- **TODO:** Is any critical data stored only on local computers (office PCs) and not in the cloud?
- **TODO:** If so, how is that data backed up?

## Other Security Considerations

- **TODO:** Do we have cyber liability insurance?
- **TODO:** When was the last security review or audit of our systems?
- **TODO:** Are there any compliance requirements (e.g., state HOA data retention laws)?

# HR & Personnel Management

This page covers staff management, outside consultants, and volunteer administration. Much of this is non-IT operational information.

*Items marked **TODO** need information from someone with direct knowledge (e.g., Jim Stewart, current President, or office manager).*

## Staff Management

### Current Staff

**TODO:** List current office staff positions and names (e.g., Office Manager, Administrative Assistant).

### Evaluation &amp; Compensation

<table id="bkmrk-who-gives-yearly-eva"><tbody><tr><td>**Who gives yearly evaluations?**</td><td>**TODO:** (President? Executive Committee? Office manager for junior staff?)</td></tr><tr><td>**Who sets salaries?**</td><td>**TODO:** (Board approval required? Budget process?)</td></tr><tr><td>**Where are salary and benefits records?**</td><td>**TODO:** (Gusto? QuickBooks? Paper files?)</td></tr></tbody></table>

### Hiring

<table id="bkmrk-who-hires-new-staff%3F"><tbody><tr><td>**Who hires new staff?**</td><td>**TODO:** (President? Executive Committee? Board vote?)</td></tr><tr><td>**What is the hiring process?**</td><td>**TODO:** (Job posting, interviews, background check, Board approval?)</td></tr></tbody></table>

### Work Priorities &amp; Training

<table id="bkmrk-who-assigns-work-pri"><tbody><tr><td>**Who assigns work priorities?**</td><td>**TODO:** (President? Office manager self-directs?)</td></tr><tr><td>**Who trains new staff?**</td><td>**TODO:** (Outgoing staff? Office manager? Written procedures?)</td></tr><tr><td>**President's specific role**</td><td>**TODO:** Does the President have a defined role in day-to-day staff management, or is it delegated?</td></tr></tbody></table>

## Outside Consultants

**TODO:** Document each outside consultant or contracted service provider.

### Legal Counsel

<table id="bkmrk-firm-%2F-attorney-name"><tbody><tr><td>**Firm / attorney name**</td><td>**TODO**</td></tr><tr><td>**Compensation**</td><td>**TODO:** Hourly, per project, or retainer?</td></tr><tr><td>**Who oversees / approves work?**</td><td>**TODO:** (President? Board?)</td></tr><tr><td>**Who manages expenditure rate?**</td><td>**TODO**</td></tr></tbody></table>

### Web Consultant

<table id="bkmrk-consultant-name-%2F-fi"><tbody><tr><td>**Consultant name / firm**</td><td>**TODO**</td></tr><tr><td>**Compensation**</td><td>**TODO:** Hourly, per project, or retainer?</td></tr><tr><td>**Who oversees / approves work?**</td><td>**TODO**</td></tr><tr><td>**Scope of work**</td><td>**TODO:** Website maintenance? Design? Both?</td></tr></tbody></table>

### Other Consultants

**TODO:** Are there other outside consultants (accounting/audit, landscaping, etc.)? List them here.

## Volunteer Management

### Adding Volunteers to Committees

<table id="bkmrk-who-appoints-committ"><tbody><tr><td>**Who appoints committee members?**</td><td>**TODO:** President? Committee chair? Both? (Refer to [SHHA Bylaws](#bkmrk-e%26o-%28errors-%26-omissi) for the formal process.)</td></tr><tr><td>**Process**</td><td>**TODO:** Document the step-by-step process for adding a new volunteer (nomination → approval → IT setup)</td></tr><tr><td>**IT setup when adding**</td><td>Committee chair notifies office staff → staff sends Microsoft invitation → volunteer accepts → staff adds to mailing list. See the *Quick Start for New Volunteers* page.</td></tr></tbody></table>

### Removing Volunteers from Committees

<table id="bkmrk-processtodo%3A-who-ini"><tbody><tr><td>**Process**</td><td>**TODO:** Who initiates removal? (Chair? Volunteer self-removal? Board?)</td></tr><tr><td>**IT cleanup**</td><td>Office staff removes from mailing list; IT removes SharePoint and mailbox access if applicable.</td></tr></tbody></table>

### Replacing a Committee Chair

<table id="bkmrk-processtodo%3A-%28refer-"><tbody><tr><td>**Process**</td><td>**TODO:** (Refer to Bylaws — link needed.) Who nominates the new chair? Board approval required?</td></tr><tr><td>**IT transition**</td><td>Shared role mailbox access is transferred (revoke outgoing, grant incoming). See the FAQ section on email transitions.</td></tr></tbody></table>

## Insurance

<table id="bkmrk-e%26o-%28errors-%26-omissi"><tbody><tr><td>**E&amp;O (Errors &amp; Omissions) insurance**</td><td>**TODO:** Do we have E&amp;O coverage? What does it cover? Policy details?</td></tr><tr><td>**General liability insurance**</td><td>**TODO:** Coverage details? Does it extend to volunteers?</td></tr><tr><td>**D&amp;O (Directors &amp; Officers)**</td><td>**TODO:** Do we have D&amp;O insurance?</td></tr><tr><td>**Cyber liability**</td><td>**TODO:** Do we have cyber liability coverage?</td></tr><tr><td>**Insurance broker / carrier**</td><td>**TODO:** Company name and contact</td></tr></tbody></table>