Account recovery
Account recovery is the process of restoring a user's ability to authenticate when they no longer control the authenticators required for their account's level of assurance.
Getting back in after losing an authenticator
A lost phone can leave an employee unable to sign in. Account recovery is the process for deciding whether to restore access and which replacement authentication method to attach to the account.
NIST distinguishes recovery from replacing a forgotten password when the user can still authenticate another way. Its requirements depend on the account’s assurance level and whether the user went through identity proofing. A recovery procedure needs to fit the account it protects.
For someone who has lost their only authenticator, the help desk follows the approved recovery procedure before allowing a replacement. If the available information is not enough to verify the request, the next step is escalation, not enrollment.
Getting the employee back in is only part of the job
NIST requires a notification after account recovery so the account holder can spot an unexpected change.
If the account may have been compromised, restoring the employee’s access does not necessarily remove the attacker’s. The account owner and incident responder also need to check whether any unauthorized access remains.