How should security teams decide between disabling MFA and losing backups during a major outage?

Security teams should treat both options as severe, but they are not equal in every scenario. Disabling MFA removes a foundational control and quickly increases the risk of credential abuse, unauthorized access, and compliance failure. Losing backups threatens recovery, ransomware resilience, and data integrity. The right choice depends on which risk is more immediate, containable, and reversible.

How to weigh the two failure modes during an outage

The decision is really about choosing which loss is more immediate, bounded, and reversible. Disabling MFA can create an instant access-control gap, while accepting some backup loss may preserve the control environment needed to keep the organisation operating. In practice, teams should compare blast radius, time sensitivity, and whether the temporary concession can be tightly scoped and quickly unwound.

A useful way to frame it is to ask which option creates the larger downstream security problem if the outage lasts longer than expected. If the answer is “account takeover or uncontrolled access,” MFA should usually stay intact and teams should look for another recovery path. If the answer is “we cannot restore critical systems or data at all,” backup preservation becomes the higher-priority objective.

Prioritise the control whose loss would expose the broadest set of systems, not just the most visible service.
Treat any change as temporary, time-boxed, and explicitly approved.
Restore the original control first, then validate that the emergency workaround did not outlive the outage.

What usually makes disabling MFA the riskier move

Disabling MFA removes a foundational check on access, so the immediate concern is not convenience, it is credential abuse. Once MFA is turned off, stolen passwords, phishing-recovered credentials, and legacy account paths become far easier to exploit, especially during a noisy incident when monitoring is already stressed. The loss is often broader than the one service you are trying to recover.

That is why teams should be very careful about using MFA bypass as a recovery tactic for anything that can reach production data, administrative tools, or backup systems. A short-lived outage can turn into a security incident if emergency access is granted without tight scoping, logging, and revocation discipline.

For deeper background on how MFA gaps turn into real compromise paths, see Microsoft Midnight Blizzard breach and Uber Breach.

How to think about backups, recovery, and emergency access together

Backups are not just a storage concern, they are the basis of recovery, ransomware resilience, and data integrity. If the outage is affecting authentication infrastructure, teams still need a way to preserve backup access, restore points, and the evidence needed to prove what happened. The goal is to keep recovery possible without weakening protection everywhere else.

Practically, that means teams should separate “ability to restore” from “broad interactive access.” If an emergency path is required, prefer the narrowest possible route that lets you validate, export, or restore backups without opening general user or admin access. Keep the window short, record the decision, and verify that access is removed immediately after the recovery action is complete.

Where backup and identity controls intersect, the main failure pattern is overcorrection: teams either disable too much protection or preserve the control so rigidly that recovery fails. A tighter approach is to preserve the recovery function first, then bring MFA back as soon as the critical restore is stable.

For incident coordination and recovery practice, FIRST is useful context, and for baseline control mapping see NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST Cybersecurity Framework 2.0.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA — Identity Management, Authentication and Access Control	MFA and backup access both affect authentication and access control.
	RC.RP — Recovery Planning	The question weighs access-control loss against recovery failure during an outage.
	GV.RM — Risk Management Strategy	This is a risk trade-off decision under outage pressure.
Recommendation — Apply PR.AA controls to keep emergency access narrowly scoped and revocable. Use RC.RP to preserve restore capability while limiting emergency exceptions. Use GV.RM to document which loss is more immediate, containable, and reversible.
CIS Controls v8	6 — Access Control Management	Disabling MFA changes access enforcement and exception handling.
	11 — Data Recovery	Backup preservation and restore ability are central to the choice.
Recommendation — Restrict emergency access paths and remove them immediately after recovery. Protect backup restore points and validate recovery after any outage workaround.
OWASP Non-Human Identity Top 10	NHI-01 — Secret Sprawl and Credential Exposure	MFA bypass and backup access often rely on credentials or recovery secrets.
Recommendation — Keep recovery credentials tightly controlled and rotate any exposed secrets after use.

Practitioner Guidance

What to prioritise: Decide first whether the outage threatens access control or recoverability. If MFA removal would expose production administration or backup systems, avoid disabling it broadly and look for a narrower recovery path.

Decision rule: If the temporary action can be limited to a single recovery task, one trusted operator, and a short expiration, it is more defensible. If the change would create open-ended access, treat it as a higher-risk exception.

What to verify: Confirm who can use the emergency path, what systems it reaches, how it is logged, and exactly when it will be revoked. In a crisis, the most dangerous gap is not the workaround itself, it is losing track of who still has it.

Practitioner takeaway: The right choice is the one that keeps the organisation both secure and recoverable, but only if the temporary concession is tightly bounded and removed before it becomes the new normal.