Keep break-glass credentials in a secondary secrets system that does not depend on the primary one, restrict who can retrieve them, alert on every use, and test them on a schedule. The OWASP cheat sheet advises backing them up in a secondary system and routinely verifying that they work.
What break-glass credentials are
They are emergency accounts or keys that bypass the normal path: a root or owner account for a cloud provider, a local admin for an identity provider, a recovery key for a vault. You use them when normal access fails, which is often during an outage when the normal secrets store is also affected.
The risk is two sided. If they are missing, you cannot recover. If they are easy to reach, an attacker gets a master key.
What the guidance says
The OWASP Secrets Management Cheat Sheet says break-glass credentials should be backed up in a secondary secrets management system and tested routinely to verify they work. It also says restore procedures should be tested frequently, backups should be encrypted with reduced access rights, and secrets for critical operations, especially encryption keys, should be backed up to separate storage such as cold storage.
Design choices
| Question | Good answer |
|---|---|
| Where is the copy? | A system that does not rely on your main identity provider |
| Who can retrieve it? | A small named group, with approval for each use |
| How do we know it was used? | Alerts on sign in and on retrieval |
| How do we know it still works? | Scheduled test, recorded |
| What happens after use? | Rotate immediately and review the session |
Steps
- List the emergency accounts and keys you would need if the main secrets store and identity provider were both down.
- Create credentials that are separate from daily accounts, with strong authentication that does not depend on the failed system, such as a hardware key.
- Store a sealed copy in an independent secondary location, such as a physical safe or a separate encrypted vault, with split custody for the most powerful ones.
- Write a short procedure: who can open it, how to record the use, what to rotate afterwards.
- Alert on any use of these accounts, and review the alert.
- Test each credential at a set interval. Sign in, confirm the permissions, sign out, and record the date.
- Rotate on a schedule and after any use or staff change.
Mistakes to avoid
- Storing the only copy in the system you will need it to recover.
- Sharing one credential among many people with no log of who used it.
- Skipping tests because the account is rarely needed. An untested emergency account is a guess.
- Leaving multi factor enrollment tied to a person who has left.
- Giving the account more permission than the recovery tasks need.
Include it in the restore drill
During a recovery drill, make the team obtain the credential through the real emergency path. Time it. Many teams discover that access, not data, is the slowest step.
Safeguard offers agent identity and policy controls plus compliance evidence automation, which help record who and what can reach sensitive systems. Try the free scan for repositories.
Quick check
How often should break-glass accounts be tested?
Set a regular interval you can keep, such as quarterly, and test after any change to the identity or secrets system.
Should break-glass accounts use multi factor authentication?
Yes, but choose a method that does not depend on the system that may be down, and make sure more than one person can reach the factor.
Sources
Last reviewed: 19 October 2026.
