Emergency Access
What is Emergency Access?
Procedures for granting immediate temporary access to critical systems during emergencies when normal access control procedures cannot be followed.
Terms that appear alongside emergency access
Each of these is named in at least one of the same controls as emergency access. The number is how many controls name both.
- authentication 9 shared controls
- audit 7 shared controls
- authorization 6 shared controls
- access control 6 shared controls
- least privilege 5 shared controls
- separation of duties 4 shared controls
- multi factor authentication 4 shared controls
- oauth 3 shared controls
Frameworks that govern emergency access
What the standards actually require on emergency access
Requirements naming emergency access across 6 standards, quoted from the control text.
Define a documented break-glass procedure for emergency access that bypasses normal SSO when the IdP is unavailable, with strong MFA, monitoring and post-use review.
SEC03-BP03 · Establish emergency access process →Control and record emergency ('break glass') access to a healthcare recipient's My Health Record, used only where permitted and subject to audit.
MYHR-SEC-6 · Emergency access controls →A method of emergency access to systems and their resources is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur.
ISM-1610 · A method of emergency access to systems and their resources is documented and tested at le →Set up emergency access accounts so an outage of the normal identity path cannot lock the organisation out of critical cloud infrastructure, and protect and monitor those accounts tightly.
ASBv3-PA-5 · Set up emergency access →Establish procedures for obtaining necessary ePHI during an emergency. NIST recommends break-glass accounts, time-bounded activation, and full logging.
164.312(a)(2)(ii) · Emergency Access Procedure (Required) →Establish procedures for obtaining necessary ePHI during an emergency. NIST recommends break-glass accounts, time-bounded activation, and full logging.
164.312(a)(2)(ii) · Emergency Access Procedure (Required) →Questions people ask about emergency access
What is Emergency Access?
Why is Emergency Access important for compliance?
Which compliance frameworks address Emergency Access?
Where can I learn more about Emergency Access?
See how Emergency Access applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.