Break Glass Procedure

What a break glass procedure is

A break glass procedure is an emergency-only access path that bypasses normal restrictions when urgent recovery or continuity work cannot wait. The control is designed to remain exceptional, tightly logged and reviewable, so the organisation can restore service without abandoning least-privilege or zero-trust principles in routine operations.

Why break glass exists in zero trust environments

Zero trust assumes access should be continuously verified and narrowly granted, but real operations still face outages, lockouts and other conditions where standard access workflows fail. A break glass procedure preserves the security model by making emergency access a formally governed exception, rather than an informal workaround. In practice, the procedure must define when it can be used, who can invoke it, and how the action is recorded for later review.

The idea is not to make emergency access easy in the general case, but to make it possible under documented conditions when ordinary routes are unavailable. That distinction matters because the control only works if teams treat it as a recovery mechanism, not as a convenience path for routine administration.

How break glass access is controlled

Effective break glass design usually combines strong authentication, tightly scoped privileges, short-lived use and explicit audit trails. The access path should be separated from everyday administrator access so it can be monitored independently, and it should be available only to a small set of authorised responders. Many organisations also require post-use review because the emergency condition itself is part of the risk story, not just the access event.

Good implementation is also about pre-planning. Teams need to know where the emergency credentials or access method are protected, how they are released, and what evidence proves the access was legitimate. Without those controls, the procedure can become either unusable in a real incident or too permissive to be trusted.

When break glass procedures fail

Break glass fails when the emergency path is treated as an ordinary admin account, when monitoring is weak, or when the recovery process depends on the same systems that are already unavailable. It also fails when organisations do not test the procedure, because an untested emergency path can be locked, stale or operationally unusable at the moment it is needed.

Another common failure mode is overuse. If staff reach for break glass too often, it usually indicates the normal access model is too fragile, the approvals are too slow, or the operational design is missing a safer day-to-day access path.

Break glass procedure and privileged access governance

A break glass procedure is best understood as part of privileged access governance rather than as a standalone exception. It should sit inside the broader model for administrator accounts, emergency recovery, session oversight and access review. Privileged Access Management Guide covers the wider control set that normally surrounds emergency access, including zero standing privilege and session controls.

For emergency-only access design and operating patterns, Break-Glass and Emergency Access Account Guide is the most directly relevant internal reference for how these accounts are designed, protected and tested.

External guidance on zero trust and authentication helps anchor the control model. NIST SP 800-207 Zero Trust Architecture explains why emergency access must remain an exception inside a continuously verified architecture, while NIST SP 800-63 Digital Identity Guidelines supports the need for strong, high-assurance authentication around sensitive access events.

Related resources from NHI Mgmt Group

• What breaks when break-glass access is not tightly governed?
• How do security teams know whether break-glass access is actually working?
• What breaks when break glass accounts are treated like everyday admin access?
• Why do break glass accounts need separate governance from normal IAM controls?