SOC 2 production access and break glass accounts: a practical design

Give most engineers no standing access to production. Grant it on request, for a stated reason and a limited time, through individual accounts with MFA. Keep one or two emergency break glass accounts sealed, alerted on use and reviewed after each use. Log everything.

What the criteria expect

CC6 covers logical access: restricting access to authorized users, registering and removing users, role based access and protecting against outside threats. The criteria do not say how to build production access. They ask that it be controlled and evidenced.

Standing access versus just in time

Standing access means a person keeps production rights all the time. It is simple and risky. Just in time access means the person asks, someone approves, and the right expires.

For a small team, a middle path works: a small named group has standing read access for debugging, while write or administrative access is requested per task.

Design the tiers

• Read only access to logs and metrics for on call staff.
• Limited write access through deployment pipelines, not human logins.
• Administrative access to cloud accounts and databases by request, time boxed.
• Break glass for emergencies when normal access paths fail.

Prefer pipelines for changes. If humans rarely log in to production, your evidence story gets simpler.

Request and approval

Use a ticket or chat approval flow that records who asked, why, who approved and for how long. Link it to an incident or change when possible. Remove the right at the end, and let the system do it automatically if it can.

Break glass accounts

A break glass account exists for the day your identity provider or normal access fails.

• Store credentials in a sealed place, such as a vault with dual control or a physical safe.
• Use strong, unique passwords and hardware backed MFA where possible.
• Alert on any sign in, to a channel several people watch.
• After use, rotate the credentials and write a short review: why, who, what was done.
• Test access periodically so it works when needed.
• Keep the number of accounts small.

Review and evidence

• A current list of who has each tier, reviewed on your access review cycle.
• Samples of approved production access requests with timestamps and expiry.
• Logs of production sessions or administrative actions.
• Break glass use records with the post use review.
• Alert rules and test results.

See logical access control ideas and the quarterly access review process.

Common mistakes

• Shared admin accounts with a password in a document.
• Access granted for an incident and never removed.
• Break glass credentials used for routine work.
• No alert on administrative sign in.

Quick check

Sources

• SOC 2 Trust Services Criteria overview

Last reviewed: 19 October 2026.