Break Glass Account
What is Break Glass Account?
An emergency access account that bypasses normal access controls during critical situations, with strict monitoring and post-use review procedures.
Frameworks that govern break glass account
What the standards actually require on break glass account
Requirements naming break glass account across 6 standards, quoted from the control text.
Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed. Required at Maturity Levels Two and Three of the Restrict administrative privileges mitigation strategy (Appendices B and C);
acsc-essential-eight::E8-ADMIN-ISM-1685 · Restrict administrative privileges (ISM-1685): Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed →Break glass accounts are only used when normal authentication processes cannot be used.
ISM-1611 · Break glass use only when normal authentication fails →Establish procedures for obtaining necessary ePHI during an emergency. NIST recommends break-glass accounts, time-bounded activation, and full logging.
164.312(a)(2)(ii) · Emergency Access Procedure (Required) →Establish procedures for obtaining necessary ePHI during an emergency. NIST recommends break-glass accounts, time-bounded activation, and full logging.
164.312(a)(2)(ii) · Emergency Access Procedure (Required) →Agencies must not permit shared credentials to be used for accessing administrator or other privileged access accounts. Break Glass (emergency) accounts are exempt; the Emergency accounts (Break Glass accounts) section gives further guidance on them.
new-zealand-information-security-manual-nzism::16.1.27.C.02 · 16.1.27.C.02 No shared credentials for privileged or administrator accounts →Review privileged rights routinely under a role-based least privilege model; log all privileged access over secure, encrypted, authenticated protocols; disable unneeded management protocols and change default passwords at initialisation (M2).
uk-telecommunications-security-act-2021::M2 · M2.01 to M2.06, M6.01 to M6.05 Privileged access basics: review, logging, secure protocols, unique accounts, MFA and no default or hardcoded accounts →Questions people ask about break glass account
What is Break Glass Account?
Why is Break Glass Account important for compliance?
Which compliance frameworks address Break Glass Account?
Where can I learn more about Break Glass Account?
See how Break Glass Account applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.