A small business gets a website built, it works, and it then requires no attention for a long time. That is the normal and desirable outcome, and it is also how the business quietly loses track of it. Some years later, the site goes down, or needs a change, or starts showing a warning about an expired certificate, and it turns out that nobody at the business can get into it. The person who built it has moved on, changed email address, or simply no longer works in the field. The hosting is paid by a card that was replaced. The domain is registered to an address that nobody checks. Nothing was stolen and nothing broke maliciously; the knowledge just went out of the door while the site kept running.
The reason this is worth attention is that a website has three separate parts, each of which can be held by a different party, and the failure of any one of them takes the site down. There is the domain name, which is the address; there is the hosting, which is the machine the site runs on; and there is the site itself, which is the files and the system that manage its content. Most business owners think of these as one thing, because from the outside they behave as one thing. When something breaks, this is the first discovery: that there are three accounts, three suppliers, three renewal dates, and the business may control none of them.
The domain deserves particular attention because it is the piece that can be lost outright rather than merely fixed late. A domain has a registration that expires and a registered contact who can move or sell it. If it is registered in somebody else's name - a former developer, an agency, a friend who helped - then the business does not control its own address, and recovering it depends on that person's cooperation and continued existence. Hosting can be rebuilt, files can be recreated, but a domain that has lapsed and been taken by somebody else is usually gone for good, along with every link, listing and business card pointing at it.
So the question worth answering while nothing is wrong is short: for each of those three parts, which company provides it, which account is it under, who can log in, and when does it renew. Write the answers down somewhere the business keeps, not in an individual's head. If the answer to any of them is a person outside the business, that is the item to deal with first, and it is usually a straightforward transfer if asked while the relationship is good. This is a half-hour of dull administration that produces nothing visible, which is exactly why it is never urgent until the morning it is the only thing that matters.