Temporary and break-glass access is a tightly controlled way to grant elevated permissions for a short time during urgent work or emergencies. In IAM and PAM, it uses approval, time limits, strong authentication, and full logging to reduce standing privilege while preserving rapid access when normal controls would block critical recovery.
How Temporary and Break-Glass Access Works
Temporary and break-glass access is a controlled exception to normal privilege rules. It is usually granted only after approval, bound to a short duration, and paired with stronger authentication and audit logging so the exception is visible and reversible.
The design goal is to avoid standing privilege while still allowing critical work to continue when routine approval chains, role assignments, or access workflows would slow recovery. In practice, the access path should be clearly named, tightly scoped, and easy to distinguish from ordinary admin use.
Why It Exists in IAM and PAM
This model matters because urgent operations are where organisations are most tempted to keep permanent elevated access “just in case.” temporary access reduces that temptation by making privilege time-bound and task-bound rather than always available.
In PAM programs, it is a core pattern for admin elevation, emergency repair, and privileged recovery. It also helps separate ordinary operational access from exceptional intervention, which improves governance and makes privilege review more meaningful.
For a broader view of the privilege model behind these patterns, the Privileged Access Management Guide covers how vaulting, session control, zero standing privilege and break-glass design fit together.
Typical Controls and Design Choices
A sound implementation usually combines approval, short expiry, step-up authentication, and strong session visibility. The access should be granted to the smallest practical scope, such as one system, one role, or one recovery window, rather than broad permanent admin rights.
Organisations also need a clear break-glass path for true emergencies, including account protection, monitoring, and periodic testing. Without testing, the emergency path can fail when it is most needed, which turns a resilience control into an operational dependency.
The Break-Glass and Emergency Access Account Guide focuses on protecting and validating emergency accounts, while the Just-in-Time Access and Zero Standing Privilege Guide explains how temporary elevation supports a move away from standing privilege.
What Good Practice Looks Like in Recovery and Operations
Temporary access works best when it is part of a broader operating model, not an ad hoc favour granted during pressure. That means the process should be documented, the approver should be explicit, and the access should expire automatically rather than depending on someone remembering to revoke it.
In recovery scenarios, the main question is not only “can we get in?” but “can we do so without creating a lingering privilege path afterward?” Good practice also includes post-use review, because emergency access often reveals weak points in normal identity workflows, service ownership, or recovery design.
When temporary elevation supports backups or restore paths, the Backup Identity Isolation Guide and the Disaster Recovery Plan Template show how emergency privilege fits into restore order, recovery roles, and identity-first restoration.
Risk and Threat Considerations
Temporary and break-glass access is valuable precisely because it bypasses normal friction, but that same bypass creates risk if it is too broad, too long-lived, or too easy to trigger. If emergency access is not tightly monitored, it can become a durable backdoor that attackers will target or insiders will overuse.
Failure mechanism: Weak approval, poor expiry enforcement, or insufficient logging can turn an exception into persistent elevated access, especially when the same account is reused across incidents or systems.
Impact: A compromised or abused break-glass path can expose privileged systems, accelerate lateral movement, and undermine confidence in recovery controls after an incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Temporary and break-glass access depends on short-lived credentials and controlled authenticator handling. |
| AC-6 — Least Privilege | The term centers on granting elevated rights only for a bounded, exceptional need. | |
| AU-2 — Event Logging | Break-glass access requires traceable activity for post-use review and accountability. | |
| Recommendation — Limit authenticator lifetime, rotate emergency credentials, and revoke them immediately after use. Enforce least privilege and allow elevation only for the approved time window. Log emergency access approvals, activation, and privileged actions for later review. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Temporary elevation and emergency access are access-control governance problems. |
| CIS-8 — Audit Log Management | Emergency access must be visible so misuse and post-incident actions can be reviewed. | |
| Recommendation — Inventory privileged access paths and remove standing admin rights where possible. Centralize and retain logs for all break-glass activations and privileged sessions. | ||
Practitioner Guidance
Governance implication: Treat temporary and break-glass access as a separately owned control, not a convenience feature of general admin access. The key decision is whether the organisation can prove who granted it, why it was granted, when it expires, and whether it was actually used.
Practitioner takeaway: The control is only as strong as its revocation path and its audit trail, so test both before you need them in a live recovery.