I work with a small startup in the beginning of it's life cycle. I recently raised some security concerns involving business continuity and emergency preparedness.
I have been trying to make a case for the importance of having a plan for incident response, such as the ability to have critical sign-ins and passwords or other credentials accessible in the event of a security incident or catastrophe (also including documents or procedures containing sensitive information to cover things such as needing to redeploy our environment) or have access to certain critical services or accounts without relying on the availability of specific individuals who own those accounts as we are a multinational team. Currently, we don't have a lot of organization regarding this area. There are accounts with owners that no longer participate in the teams and many instances of "if it breaks, we gotta hope this one guy in insert country here will be available in the middle of the night."
I looked through some options, and password managers seem to fit the bill for at least some of this. A few people recommended KeePassX in related questions but I can't tell if it would be useful for multiple team members and I'd have to research it to see if it's something that would be easily portable. There doesn't seem to be much documentation and parts of their website are down which makes me wonder how legitimate it is. I personally use 1Password and they seem to have a team focused plan that includes an Administrator dashboard to manage permissions and access but lacks auditing options like change/access logs without upgrading to the business plan at twice the cost. Cost is a big factor in any solution as any budget increase (even small ones) is difficult to negotiate at this point, but if there is a costly solution that is hands-down the best, I can pitch it and hope for the best.
Does anyone know any better options?
Am I thinking in the right direction or am I focusing too much on password managers where another solution might be a better fit? Am I creating additional security issues by trying to put all this sensitive information in one spot?
Is it better to consider a physical solution (e.g. buy a safe) even though none of us are in the same location?
My aim is to understand what my options are, which option/service/product best fits our needs, to research how to use the best options and to pitch this final decision to my superiors.