Field notes
Break-glass accounts after contractor exits | Field notes — Siteridgepoint
Contractor exits often focus on badge return and email deactivation. Break-glass and shared administrator accounts linger because nobody wants to be the person who locks out emergency access.
Inventory first
List every emergency account tied to the contractor’s projects, including passwords stored in sealed envelopes, vault entries, and undocumented local admins on shop-floor servers. Ask outgoing contractors for a walkthrough before their last day whenever possible.
Dual control
Emergency accounts should require dual control for retrieval. If a single person can still open the vault alone after the contractor leaves, the account remains a standing privilege in practice even if policy says otherwise.
Review cadence
Include break-glass accounts in every privileged access review, not only after exits. Test that retrieval procedures still work and that the people named as custodians are current staff.
After revocation
When an account is retired, record the date, the approving owner, and the replacement path for genuine emergencies. Auditors ask for this trail more often than teams expect.