Break-Glass Account Control Checklist

Verifies emergency accounts are secured, monitored, tested and reset after every use.

Available soon

Format: Excel
Size: 74 KB
Length: 13 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Accounts and tests
Account checks
Uses
After use
Summary
Rules
Lists
Definitions
Framework References

What changed

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: each account's tests, next test due and count against PA-12; the ten checks for every account with evidence and follow-up; each use timed against PA-12's deadlines with the review delay in working days; the five after-use steps with the example's completion; and a Summary with readiness, PAM-06 and a signature block.
1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the as-at date and the values PA-12 sets at the top of the Summary sheet. The EXAMPLE uses 2026-09-30.
2	List each break-glass account on Accounts and tests: its platform, system, owner, where its credential is kept and its second factor. The count check compares the accounts on each system with the number PA-12 sets.
3	Test every account every [[3]] months: open the safe with two people, sign in, confirm the alert reached the named people, change the password, and reseal. Record the date, whether sign-in worked, the minutes the alert took and the reseal date. The next test due calculates.
4	Run the 10 checks for every account on Account checks at every test and after every use, as the standard sets them, and look at them again at each control review. Look at the evidence, not at what people say. A Fail or Not applicable needs its evidence or reason; a Fail needs a finding.
5	Record every use on Uses the day it happens: who used it, why, when it started and ended, when and to whom it was declared, when the alert arrived, when the credential was changed and when the session was reviewed. The deadlines and the on-time checks calculate.
6	Record each of the five steps on After use as it is done, with the evidence. The record is closed only when the cause is fixed and the Head of Information Security has reviewed the session.
7	Read the Summary: readiness for each account, PAM-06 for the quarter, and the sign-off. A use not reviewed within [[1]] working day puts PAM-06 outside tolerance: it goes to the next executive committee with its plan.
8	To clear the EXAMPLE, delete the contents of the Example column and of every yellow cell on the four working sheets. Keep the checks, the after-use steps and the formulas.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. It holds 2 break-glass accounts on its cloud identity tenant and 1 on its directory, all tested on 14 Sep 2026. On 5 Sep 2026 a sign-in policy change locked every administrator out, and Beth Owen used bg-cloud-01. The use was declared and the credential changed in time, but nobody reviewed the session until 25 Sep 2026: each side thought the other would (PF-02). The Head of Information Security is now named as the reviewer of every use.

Adapting for a small organisation: keep the number PA-12 sets even if you have one administrator; the second cloud account is what saves you when the first is the one locked out. One safe and one second-site envelope are enough.

Adapting for a regulated entity (NIS2, DORA): the checklist is the record that emergency access is assigned only when needed and controlled (Delegated Regulation (EU) 2024/1774 Article 21(a) and (e)(ii)). Keep every test and every use record.

Adapting where a service provider runs your IT: the provider may hold the on-call role, as in the EXAMPLE. Your Head of IT still owns the accounts and the safe, the alert still reaches your own people, and the review is never left to the provider.

Accounts and tests

One row per break-glass account (PA-12). Yellow columns are inputs; white columns calculate against the as-at date on the Summary sheet.

Example	Account	Platform	System ID	Owner	Credential kept	Second factor	Previous test	Last test	Sign-in worked	Alert after (minutes)	Resealed on	Tested by	Next test due (calc)	Test status (calc)	Gap between tests (calc)	Resealed (calc)	On this system (calc)	PA-12 sets (calc)	Count check, BG-01 (calc)
EXAMPLE	bg-emergency	On-premises directory	PS-01	Mark Ellis	Sealed in the safe		15 Jun 2026	14 Sep 2026	Yes	2	14 Sep 2026	Mark Ellis, with Ruth Okafor	14 Dec 2026	Tested	Within 3 months	In time	1	1	As PA-12 sets
EXAMPLE	bg-cloud-01	Cloud identity tenant	PS-02	Mark Ellis	Sealed in the safe (password and security key)	Sealed security key	16 Jun 2026	14 Sep 2026	Yes	2	14 Sep 2026	Mark Ellis, with Ruth Okafor	14 Dec 2026	Tested	Within 3 months	In time	2	2	As PA-12 sets
EXAMPLE	bg-cloud-02	Cloud identity tenant	PS-02	Mark Ellis	Sealed in the safe (password and security key)	Sealed security key	16 Jun 2026	14 Sep 2026	Yes	2	14 Sep 2026	Mark Ellis, with Ruth Okafor	14 Dec 2026	Tested	Within 3 months	In time	2	2	As PA-12 sets

Account checks

The 10 checks for every break-glass account, at every test and after every use, and again at each control review (CT-11 in the Privileged Access Control Review Workbook passes only if every check here passes). The check and rule columns are fixed; add blank rows for a new account.

Example	Account	Check ID	Check	Rule	Result	Evidence, or the reason for a Fail or Not applicable	Checked on	Finding	Follow-up (calc)
EXAMPLE	bg-emergency	BG-01	The number of break-glass accounts is the number PA-12 sets for the platform, no more	PA-12	Pass	2 on the cloud identity tenant (PS-02) and 1 on the directory (PS-01): the numbers PA-12 sets	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-02	Each is a cloud-only or local account, not synchronised, not tied to one person's device or phone	PA-12	Pass	Account settings read at the test: not synchronised, and no person's device, phone or second factor registered	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-03	Each is left out only of the sign-in policies that could lock every administrator out, and the exclusion is recorded	PA-12	Pass	Sign-in policy exclusions listed at the test: only the policies that could lock every administrator out	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-04	Its credential is sealed in the safe, in numbered tamper-evident envelopes, with a second set at a second site	PA-12	Pass	Envelope numbers checked at the test on 14 Sep 2026, and resealed the same day	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-05	Every sign-in raises an alert to the named people, and the alert fired at the last test	PA-12	Pass	The alert reached the named people 2 minutes after the test sign-in	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-06	It was tested within the last [[3]] months: sign-in works and the alert fired	PA-12	Pass	Tested 14 Sep 2026 by Mark Ellis, with Ruth Okafor: sign-in worked and the alert fired	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-07	After every use or test that opened the seal, the credential was changed and resealed within [[1]] working day	PA-10	Pass	Changed and resealed on 14 Sep 2026, the day of the test	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-08	Every use was declared, and its session reviewed by the Head of Information Security within [[1]] working day	PA-12	Not applicable	No use of this account in the quarter	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-09	It is in the inventory, with the Head of IT as owner	PA-01	Pass	In the inventory as ACC-10, owner Mark Ellis (Head of IT)	24 Sep 2026		OK
EXAMPLE	bg-emergency	BG-10	Everyone who can open the safe is on the list, and the credential was changed when anyone on it left	PA-14	Pass	Safe list checked at the test; the credential was last changed on 14 Sep 2026	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-01	The number of break-glass accounts is the number PA-12 sets for the platform, no more	PA-12	Pass	2 on the cloud identity tenant (PS-02) and 1 on the directory (PS-01): the numbers PA-12 sets	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-02	Each is a cloud-only or local account, not synchronised, not tied to one person's device or phone	PA-12	Pass	Account settings read at the test: not synchronised, and no person's device, phone or second factor registered	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-03	Each is left out only of the sign-in policies that could lock every administrator out, and the exclusion is recorded	PA-12	Pass	Sign-in policy exclusions listed at the test: only the policies that could lock every administrator out	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-04	Its credential is sealed in the safe, in numbered tamper-evident envelopes, with a second set at a second site	PA-12	Pass	Envelope numbers checked at the test on 14 Sep 2026, and resealed the same day	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-05	Every sign-in raises an alert to the named people, and the alert fired at the last test	PA-12	Pass	The alert reached the named people 2 minutes after the test sign-in	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-06	It was tested within the last [[3]] months: sign-in works and the alert fired	PA-12	Pass	Tested 14 Sep 2026 by Mark Ellis, with Ruth Okafor: sign-in worked and the alert fired	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-07	After every use or test that opened the seal, the credential was changed and resealed within [[1]] working day	PA-10	Pass	Changed and resealed on 14 Sep 2026, the day of the test; after BGU-2026-01 the password was changed on 7 Sep 2026	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-08	Every use was declared, and its session reviewed by the Head of Information Security within [[1]] working day	PA-12	Fail	BGU-2026-01 declared by phone and the credential changed in time; the session was reviewed on 25 Sep 2026, 14 working days late	24 Sep 2026	PF-02	Follow up PF-02
EXAMPLE	bg-cloud-01	BG-09	It is in the inventory, with the Head of IT as owner	PA-01	Pass	In the inventory as ACC-17, owner Mark Ellis (Head of IT)	24 Sep 2026		OK
EXAMPLE	bg-cloud-01	BG-10	Everyone who can open the safe is on the list, and the credential was changed when anyone on it left	PA-14	Pass	Safe list checked at the test; the credential was last changed on 14 Sep 2026	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-01	The number of break-glass accounts is the number PA-12 sets for the platform, no more	PA-12	Pass	2 on the cloud identity tenant (PS-02) and 1 on the directory (PS-01): the numbers PA-12 sets	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-02	Each is a cloud-only or local account, not synchronised, not tied to one person's device or phone	PA-12	Pass	Account settings read at the test: not synchronised, and no person's device, phone or second factor registered	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-03	Each is left out only of the sign-in policies that could lock every administrator out, and the exclusion is recorded	PA-12	Pass	Sign-in policy exclusions listed at the test: only the policies that could lock every administrator out	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-04	Its credential is sealed in the safe, in numbered tamper-evident envelopes, with a second set at a second site	PA-12	Pass	Envelope numbers checked at the test on 14 Sep 2026, and resealed the same day	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-05	Every sign-in raises an alert to the named people, and the alert fired at the last test	PA-12	Pass	The alert reached the named people 2 minutes after the test sign-in	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-06	It was tested within the last [[3]] months: sign-in works and the alert fired	PA-12	Pass	Tested 14 Sep 2026 by Mark Ellis, with Ruth Okafor: sign-in worked and the alert fired	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-07	After every use or test that opened the seal, the credential was changed and resealed within [[1]] working day	PA-10	Pass	Changed and resealed on 14 Sep 2026, the day of the test	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-08	Every use was declared, and its session reviewed by the Head of Information Security within [[1]] working day	PA-12	Not applicable	No use of this account in the quarter	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-09	It is in the inventory, with the Head of IT as owner	PA-01	Pass	In the inventory as ACC-18, owner Mark Ellis (Head of IT)	24 Sep 2026		OK
EXAMPLE	bg-cloud-02	BG-10	Everyone who can open the safe is on the list, and the credential was changed when anyone on it left	PA-14	Pass	Safe list checked at the test; the credential was last changed on 14 Sep 2026	24 Sep 2026		OK

Uses

One row per use, recorded the day it happens (PA-12). Declared before or at the sign-in; the credential changed and the session reviewed within [[1]] working day. A test that opens the seal is recorded on Accounts and tests, not here.

Example	Use ID	Account	Used by	Why the normal route was unavailable	Started	Ended	Declared to	Declared at	Alert received at	Credential changed on	Session reviewed on	Reviewed by	Outcome of the review	Due (calc)	Declared in time (calc)	Alert fired (calc)	Changed in time (calc)	Reviewed in time (calc)	On time, all steps (calc)	Review late by, work days (calc)	Finding
EXAMPLE	BGU-2026-01	bg-cloud-01	Beth Owen, the managed IT provider's on-call engineer (P06 SUP-001)	A sign-in policy change made at 22:10 required a compliant device that no administration device met, and locked every administrator out of the cloud tenant	5 Sep 2026	5 Sep 2026	Mark Ellis	5 Sep 2026	5 Sep 2026	7 Sep 2026	25 Sep 2026	Ruth Okafor	Every action matched the reason: the policy was rolled back at 22:52 and nothing else was changed.	7 Sep 2026	Yes	Yes	Yes	Late	No	14	PF-02

After use

The 5 steps after every use, in order (PA-12), five rows per use. Steps 1 and 2 are due at the sign-in; steps 3 and 4 within [[1]] working day; step 5 before the record is closed.

Example	Use ID	Step	What must happen	Within	Done on	Done by	Evidence	Deadline (calc)	On time (calc)
EXAMPLE	BGU-2026-01	1	The user declares the use to the Head of IT, or the Head of Information Security if the Head of IT is unavailable, with the reason, before signing in or at once after	Before or at the time of use	5 Sep 2026	Beth Owen, to Mark Ellis, by phone	Declared at 22:35, before the sign-in at 22:40	5 Sep 2026	Yes
EXAMPLE	BGU-2026-01	2	The alert is confirmed as received; if it did not fire, that is a finding of its own	At the time of use	5 Sep 2026	Mark Ellis	Alert at 22:41, 1 minute after the sign-in	5 Sep 2026	Yes
EXAMPLE	BGU-2026-01	3	The Head of Information Security reviews every action the account took against the stated reason, from the log the account cannot change	[[1]] working day	25 Sep 2026	Ruth Okafor	Every action matched the reason: the policy was rolled back at 22:52 and nothing else was changed.	7 Sep 2026	Late
EXAMPLE	BGU-2026-01	4	The password is changed, a new security key registered where one was used, and both resealed; the old envelope is kept with the record	[[1]] working day	7 Sep 2026		Password changed and the envelope resealed; the old envelope kept with the record	7 Sep 2026	Yes
EXAMPLE	BGU-2026-01	5	The cause is fixed so the normal route works, and the record is closed with the reviewer's name	Before the record is closed	25 Sep 2026	Ruth Okafor	The policy change was rolled back during the use, and re-tested before re-applying it on 24 Sep 2026 (E-05)	Before closing	Done
		1	The user declares the use to the Head of IT, or the Head of Information Security if the Head of IT is unavailable, with the reason, before signing in or at once after	Before or at the time of use
		2	The alert is confirmed as received; if it did not fire, that is a finding of its own	At the time of use
		3	The Head of Information Security reviews every action the account took against the stated reason, from the log the account cannot change	[[1]] working day
		4	The password is changed, a new security key registered where one was used, and both resealed; the old envelope is kept with the record	[[1]] working day
		5	The cause is fixed so the normal route works, and the record is closed with the reviewer's name	Before the record is closed
		1	The user declares the use to the Head of IT, or the Head of Information Security if the Head of IT is unavailable, with the reason, before signing in or at once after	Before or at the time of use
		2	The alert is confirmed as received; if it did not fire, that is a finding of its own	At the time of use
		3	The Head of Information Security reviews every action the account took against the stated reason, from the log the account cannot change	[[1]] working day
		4	The password is changed, a new security key registered where one was used, and both resealed; the old envelope is kept with the record	[[1]] working day
		5	The cause is fixed so the normal route works, and the record is closed with the reviewer's name	Before the record is closed
		1	The user declares the use to the Head of IT, or the Head of Information Security if the Head of IT is unavailable, with the reason, before signing in or at once after	Before or at the time of use
		2	The alert is confirmed as received; if it did not fire, that is a finding of its own	At the time of use
		3	The Head of Information Security reviews every action the account took against the stated reason, from the log the account cannot change	[[1]] working day
		4	The password is changed, a new security key registered where one was used, and both resealed; the old envelope is kept with the record	[[1]] working day
		5	The cause is fixed so the normal route works, and the record is closed with the reviewer's name	Before the record is closed

Summary

Summary and sign-off

The values PA-12 sets, readiness for each account, PAM-06 for the quarter, and the sign-off. Yellow cells are yours; everything else calculates.

Settings

Setting	Value	Note
As-at date	30 Sep 2026	EXAMPLE: the quarter end. Type it, never a formula.
Months between tests (PA-12)	3	[[3]] in the Privileged Access Standard. Change it there first.
Working days to review and change after a use (PA-12)	1	[[1]], counted from the day of the use.
Accounts for each cloud identity tenant (PA-12)	2	And for each administration portal that could lock every administrator out.
Accounts for each on-premises directory (PA-12)	1
Quarter start (calc)	1 Jul 2026	The first day of the quarter ending in the as-at date's month: PAM-06 counts the uses from here.

Readiness by account

Account	Test status	Pass	Fail	Not applicable	Readiness	Next test due
bg-emergency	Tested	9	0	1	Ready	14 Dec 2026
bg-cloud-01	Tested	9	1	0	Ready, with actions	14 Dec 2026
bg-cloud-02	Tested	9	0	1	Ready	14 Dec 2026

Not ready: the test is overdue or failed. Ready, with actions: a check failed; follow its finding. Incomplete: a check is not done. Ready: every check passed or does not apply, with the reason.

PAM-06 Break-glass uses reviewed on time

Measure	Value	Break-glass uses in the quarter that were declared, reviewed by the Head of Information Security and followed by a credential change, each within [[1]] working day, out of all uses. Tolerance: Same as the target: every use.
Uses in the quarter	1
Declared, reviewed and changed, each in time	0
Result	0 of 1
Target (a share, 1 = all)	100%		A use outside tolerance goes to the next executive committee with its plan (PA-18).
Tolerance limit	100%
Status	Outside tolerance
Longest review delay on the Uses sheet, in working days	14

Sign-off

Role	Name	Date	Signature or approval reference
Checked by (the person who ran the test)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reviewed by (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accepted by (Head of IT, owner of the accounts)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Next test due	[[Within 3 months of the last test]]	[[YYYY-MM-DD]]

Rules

Rules this workbook applies

The rules come from the Privileged Access Standard and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.

Rule	Requirement	Where this workbook applies it
PA-01	Every privileged account, human and non-human, must be in the inventory with a named owner, its tier, its purpose, where its credential is kept and when it was last changed. An account found that is not in the inventory is disabled unless an owner claims it within [[5]] working days. For a service account, assign an interim owner within that window to control its use while dependencies are checked under PA-11; the 30-day limit is not permission to leave it uncontrolled.	Account checks, BG-09: every break-glass account in the Privileged & Service Account Inventory, with the Head of IT as owner.
PA-10	Shared, service and break-glass credentials must be kept in the vault or managed by the platform, and changed as the rotation table sets, after every use where it says so, and at once on suspicion of compromise.	Account checks, BG-07; Accounts and tests: the reseal after every test. Uses: the credential changed after every use.
PA-12	There must be [[2]] break-glass accounts for each cloud identity tenant and [[1]] for each on-premises directory, sealed in the safe, alerting on every sign-in and tested every [[3]] months. They are used only when the normal route is unavailable, and every use is declared, reviewed and followed by a credential change within [[1]] working day.	Accounts and tests: the count, the tests and the next test due. Account checks: BG-01 to BG-08. Uses and After use: every use declared, reviewed and followed by a credential change.
PA-14	Privileged access must be removed on the day a person leaves or moves, or at once for an urgent departure. Shared, service and break-glass credentials the person could read are changed within [[1]] working day.	Account checks, BG-10: the credential changed when anyone on the safe list leaves.
PA-18	Any departure from this standard must be a P02 exception, scored and approved by the approver its band sets (EX-05); a Critical exception is approved by the board or its equivalent. The headline measures are reported monthly to the security and IT leadership team.	Summary: PAM-06, reported monthly; a use outside tolerance goes to the executive committee.

How the break-glass accounts are set up (PA-12)

No.	What PA-12 requires	Set-up
1	[[2]] for each cloud identity tenant or administration portal that could lock every administrator out, and [[1]] for each on-premises directory	Number of accounts
2	Break-glass accounts are cloud-only accounts, not synchronised from the directory, not tied to any one person's device, phone or second factor, and excluded from any sign-in policy that could lock every administrator out.	Not tied to one person
3	[[The password and the security key sealed in numbered tamper-evident envelopes in the office safe, with a second set in the safe at a second site]]; opening the safe needs [[two people]]	Storage
4	Every sign-in alerts [[the Head of IT and the Head of Information Security]] at once, by [[email and text message]], and the alert is itself tested	Alert
5	Where a break-glass account must be left out of a sign-in policy so that a fault in that policy cannot lock everyone out, the gap is covered by the seal, the two-person safe, the alert on every sign-in, the test and the reset after use. It is never covered by leaving the account without a second factor when the platform lets a sealed security key be used.	Sign-in policy exclusions

Lists

Result	YesNo	Platform	SysID	SysName	CheckID
Pass	Yes	Cloud identity tenant	PS-01	Directory and its administrator groups	BG-01
Fail	No	On-premises directory	PS-02	Cloud identity tenant (email and office, P06 SUP-005)	BG-02
Not applicable			PS-03	Backup service console (P06 SUP-011)	BG-03
			PS-04	Endpoint protection and device management consoles	BG-04

BG-05

BG-06

BG-07

BG-08

BG-09

BG-10

Definitions

Definitions

Term	Meaning in this workbook
Break-glass account	An emergency account used only when the normal administration route is unavailable, such as when every administrator is locked out. Sealed, watched, tested and reset after every use (PA-12).
Use	Any sign-in to a break-glass account other than a planned test. Every use is declared, reviewed and followed by a credential change (PA-12).
Test	A planned sign-in, every [[3]] months, that proves the account works and the alert fires. It opens the seal, so the credential is changed and resealed after it.
Seal	Numbered tamper-evident envelopes holding the password and, where one is used, the security key. A broken or renumbered envelope is a finding.
Declared	Told to the Head of IT, or the Head of Information Security if the Head of IT is unavailable, with the reason, before signing in or at once after.
Session review	A check, by someone other than the administrator, that privileged activity in a period matches approved tickets and the rules, with anything unexplained followed up (PA-09).
Vault	Where shared, service and break-glass credentials are kept: a password manager or vault that records who opened which credential and when, open only to named administrators. A break-glass credential is also sealed in a safe.
Rotation	Changing a credential: a new password, secret or key, with the old one no longer working.
Phishing-resistant sign-in	A sign-in method that a fake sign-in page cannot capture and replay, because it proves possession of a key bound to the real site: a security key, a passkey on a managed device, or a certificate on a smart card or managed device (PA-05).
Working day	Monday to Friday. Add your public holidays to the WORKDAY and NETWORKDAYS formulas if you need them. A use on a Saturday is due on the next working day after it.
Readiness	Ready, Ready, with actions, Incomplete or Not ready, from the test status and the checks.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 8.2 — Privileged access rights	The whole checklist: emergency privileged access allocated, sealed, tested, used only when needed and reviewed after use
NIST CSF 2.0	PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties”	Account checks and Uses: emergency permissions limited to the number set, enforced by the seal and reviewed after every use
NIS2 — Directive (EU) 2022/2555	Article 21(2)(j) — “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate”	Accounts and tests: the emergency accounts' sealed second factor, and the alert on every sign-in
DORA — Delegated Regulation (EU) 2024/1774	Article 21(a) — “the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access”	Uses: emergency access assigned only when the normal route is unavailable (financial entities)
DORA — Delegated Regulation (EU) 2024/1774	Article 21(e)(ii) — “assignment of privileged, emergency, and administrator access on a need-to-use or an ad-hoc basis for all ICT systems”	Uses and After use: emergency access on an ad-hoc basis, declared, reviewed and closed (financial entities)
ISO/IEC 27001:2022	Annex A 8.16 — Monitoring activities	BG-05 and Uses: every sign-in raises an alert to named people, and the alert is itself tested

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.