Client-owned recovery methods and break-glass access plan

Create a documented, client-controlled emergency access plan that balances avoiding account lockout with the client retaining ownership. Define clear recovery methods, who holds break-glass credentials, and the exact activation sequence. Test annually and after major admin changes.

Define recovery ownership and activation conditions

Decide which email, phone number, and MFA devices are client-owned vs agency-controlled. The decision boundary: client-owned means the client retains recovery credentials and can revoke agency access without agency intervention; agency-controlled means the agency manages credentials and must follow a documented escalation path. Record activation conditions (e.g., loss of primary admin, legal hold, or critical incident) and the minimum evidence required before activating break-glass (signed request, corporate POA, or two independent client approvers). This reduces ambiguity during incidents and preserves client control.

Specify technical recovery methods and limitations

List the concrete recovery methods to use for each product (primary admin account, recovery email, recovery phone, MFA seed, delegated admin). For each method, note provider-specific caveats and evidence limits: some providers allow account transfer but require proof of ownership; others allow temporary access via the admin console audit trail 1. Where provider behavior is uncertain or evolving, state that the plan requires confirmation with the product vendor before activation. Include stop conditions: if credential compromise is suspected, do not reuse the same recovery contact until it is rotated and verified.

Break-glass credentials, storage, and rotation

Define who holds break-glass credentials (client custodian, legal, or an independent trustee) and where they are stored (hardware vault, corporate password manager with strict ACLs, or physical safe). The practical sequence: create credentials, record the creation date and purpose, store only the minimum secret (e.g., recovery seed or emergency account), and restrict access with multi-person authorization. Require rotation after use or on a scheduled cadence (example: annually) and after any suspected compromise. Label rotation as mandatory: a break-glass sequence is complete only after verification and credential rotation.

Activation and handoff procedure with evidence trail

Provide a step-by-step activation script: (1) Client submits a signed break-glass request following the documented template; (2) Agency verifies two independent approvers and records time-stamped evidence; (3) Agency activates only the pre-authorized recovery method; (4) Agency logs every action to an immutable audit trail and notifies the client custodian immediately. The decision boundary is strict: activation without full evidence or beyond pre-authorized methods is not permitted. Preserve artifacts for an agreed retention period to support audits and offboarding.

Testing, validation, and offboarding interplay

Test the recovery path on a scheduled basis (quarterly or semi-annually depending on risk profile) and after any major admin change. Testing should be scoped to avoid real disruption: use a test account or scheduled maintenance window, verify that the recovery method works end-to-end, and confirm audit logs capture the event. Tie this plan to the administrator-of-record and offboarding processes so that custodianship updates trigger validation and, if necessary, credential rotation 1. Tests and results should be recorded and reviewed by client leadership.

Practical checklist

• Record which recovery contacts are client-owned vs agency-controlled and document proof requirements for activation.
• Assign a single client custodian for break-glass credentials and an alternate approver; record contact details and authority evidence.
• Store break-glass credentials in a hardened vault with multi-person release controls; require approval from two approvers to access.
• Document the exact activation script and required evidence; include timestamps for every step in the audit trail.
• Schedule and run recovery tests at least semi-annually; log test scope, outcome, and remediation tasks.
• Rotate break-glass credentials after any use or suspected compromise and on a fixed schedule (e.g., annually).
• Limit emergency access to pre-authorized methods; do not expand access during an incident without documented approvals.
• Link recovery plan updates to administrator-of-record changes and offboarding events; require verification after each change.
• Retain activation and test artifacts for the agreed audit period and make them available to client leadership on request.

Where RepMail fits

Use this guide as a checklist and decision aid when preparing outbound communications or client onboarding packages that include emergency access terms. Include the documented activation script and contact points in client-facing materials to reduce back-and-forth during incidents. Do not infer that RepMail automates or enforces these controls; treat the article as operational guidance to standardize messaging and checklist compliance.

Continue with A/B Testing Cold Email With Small Samples for the next step in the workflow.

Related RepMail guides

• Agency permission matrix for client, contractor, and vendor roles
• Agency report QA checklist before client delivery

Sources