ASD ISM 1611 Use break glass accounts only in emergencies

The IT team should designate specific break glass accounts for emergency situations only.

They will need to create these accounts with minimal permissions and securely store the credentials where only authorised personnel can access them in times of crisis.

The system owner should ensure that appropriate personnel know when and how to use break glass accounts.

This can be done by including this procedure in regular training or communication meetings, explaining the specific scenarios when it's permissible to use these accounts.

Managers should enforce strict logging and monitoring whenever a break glass account is used.

This means ensuring that every use is tracked with details such as user, time, and reason for access, ideally with automated alerts to flag any unusual activity.

Senior management should periodically review the necessity of each break glass account with the IT department.

They can do this by assessing how often these accounts are used and confirming that their use aligns with documented emergency scenarios.

The cyber security officer should implement a regular audit to ensure break glass accounts are kept secure and not used for non-emergency access.

They can do this by checking logs and conducting surprise checks to verify adherence to security protocols.