Support recovery can become a separate route around technical controls. It needs evidence, bounded privileges and records.
Evaluation approach
Use appropriate additional approval and separation of duties for consequential changes. Staff should not request user secrets.
Application example
A new phone number should not be registered solely from personal details supplied in a request.
Limits and considerations
Collecting more personal data does not always produce stronger identity evidence.
Auditing recovery authority
Record who changed which account using what evidence. Apply necessary duty separation without expecting staff to learn passwords.
Checks and decisions
- Limit authority
- Record changes
- Avoid requesting secrets
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.