The IT bus factor: what happens when „Mark from IT" disappears

· 7 min read · SilverData team

In most Polish 20–50 person companies, "all of IT" sits in one person's head. His name is Mark, Peter or Anna. As long as they're around, everything works. When they disappear, it turns out nobody else knows where to log in to the router or who actually has access to the backup.

This isn't a problem of laziness. It's the natural course of things in a small company: one person set it all up at some point, one person maintains it, one person keeps the passwords in their head and in a private KeePass. Until the day that person gets an offer from Warsaw or takes a two-week holiday that has to be extended.

In engineering jargon this is called the "bus factor" — how many people would have to be hit by a bus for the project to grind to a halt. In a Polish SME, the answer is usually: one.

What it actually looks like

A specific case from our own turf. An 18-person architecture office (construction sector). The whole infrastructure — VPN to the file server, Autodesk permissions, backup configuration on the NAS, access to the OVH domain panel, the Microsoft 365 admin account — sat in one "Mark's" head. Mark had been there seven years and knew every cable.

Mark got an offer from a bigger firm and gave the statutory two weeks' notice. The owner fell off his chair, but there was nothing he could do — Mark was leaving legally. In the first week of "handover" it became clear there was no documentation at all. Everything was "logical", "intuitive", "I explained it to Kasia once".

The next four weeks after he left looked like this: two days of office downtime because nobody knew how to restart the file server after a power outage. Roughly 42,000 PLN spent on external IT support that had to rebuild knowledge of the environment from scratch. All admin passwords rotated (because Mark knew them). Reset of access to the OVH domain via a verification procedure that took 11 days. The owner later admitted that if Mark had disappeared suddenly — landed in hospital, for instance — the company would have been down for weeks.

The whole thing could have been prevented by maybe 8 hours of solid work a year. Nobody had time.

Measure your bus factor

Before you fix anything, work out where you are. This doesn't need a 20,000 PLN audit. It needs an hour and an honest conversation with yourself.

On a sheet of paper, list the following systems and mark next to each how many people in the company can actually do more than just log in as a user:

For every item, answer: who knows the admin password, who knows where the password is kept, who can rebuild the configuration if something falls apart. If any answer reads "only one person" — your bus factor there is one.

You don't have to get off the "one" everywhere. You have to consciously decide which risks you're willing to carry.

Four things to do

There's no magic here. Four boring tasks do 90% of the work.

First — a shared, company-wide password manager. Bitwarden, 1Password, KeePassXC on a shared repository — doesn't matter, as long as it isn't an Excel on Mark's drive or a Post-it under the keyboard. All admin passwords go into the vault, with access for at least two people (the owner + Mark). Employee change = password rotation, not a guessing game about "where he kept them".

Second — admin accounts registered on company mailboxes, not private ones. An OVH account created against mark.kowalski@gmail.com is a one-way ticket. When Mark leaves, the owner can't recover access without showing KRS entries, invoices and ID scans. An account registered against admin@yourcompany.pl — controlled by the owner — is recoverable in five minutes via password reset.

Third — one sheet of "what to do when things break". You don't need ITIL or Confluence. You need a document (could be Notion, could be Word on SharePoint) that describes: where the file server is, how to restart it, who your internet provider is and what number to call in case of an outage, where the UPS is, what the backup recovery procedure looks like. Four pages. Updated once a quarter.

Fourth — a second person for key roles, even at 20%. That could be an external IT provider on an emergency-support contract (even 4 hours a month on retainer), or a second employee trained in the bare minimum. What matters is that someone besides Mark can log into the router and knows where the documentation lives. Without that, one illness knocks the company out.

When you really can't get off "one"

Sometimes you simply can't afford two people in IT, and an external provider "on standby" feels expensive. Then you at least have to minimise the damage if the bomb does go off.

That means: a quarterly password audit (is everything in the vault), a yearly refresh of the "what to do when things break" documentation, a contract with an external IT partner strictly for emergencies (no retainer, but with a signed NDA and their contact details on file), a backup recovery test twice a year — with someone other than Mark involved. All of that adds up to maybe 10–15 hours of work a year.

If Mark doesn't have time for that — that's a sign the problem is bigger than the bus factor. It means you have someone in the company maintaining a status quo in which they are irreplaceable. Consciously or not. Worth talking about before they walk out with statutory notice again.

What next

Bus factor isn't an "IT project". It's a way of looking at the company. If you suddenly lost one person — the accountant, the head of production, the IT person — does the company keep running? If the answer is anything other than "yes", you have a starting point for a conversation.

If you want, we can measure the bus factor in your IT together — no paid audit, a 30-minute conversation with concrete conclusions.

A company where all IT knowledge lives in one person's head isn't a company with IT. It's a company that has been lucky that person hasn't left yet.

← Back to blog