Make recovery possible when the usual administrator is away

What this means for your practice

Provide documented recovery access for authorised roles through the organisation's approved security process. Keep recovery instructions usable during the type of outage they address.

How to review the arrangement

Ask an authorised deputy to follow the recovery instructions without the usual administrator. Where does progress depend on private knowledge or an unavailable account? Resolve those dependencies through your security process. The practice needs a reliable route for authorised people, not shared credentials circulating informally in case somebody is away.

Make the alternative route usable and authorised

Identify a primary and an alternative role through the organisation's approved access arrangements. The alternative needs enough information to begin recovery, but that does not mean distributing passwords informally. Ask the responsible administrator how approved access is obtained and checked when the usual person is unavailable.

Rehearse a fictional outage with an authorised deputy. Include the situation where the normal system holding instructions cannot be reached. Can the deputy find the right contacts, understand the recovery sequence and obtain the approved access needed? Note any step that relies on a personal device, private memory or a departed supplier. Resolve those gaps through the proper account process and update the instructions. Repeat the relevant check after significant staff or supplier changes. A recovery plan is stronger when a second authorised person has demonstrated using it, rather than merely being named as a deputy on a document.

How to check the result

Measure recovery steps blocked by unavailable people, accounts or instructions.