Rehearse lost access.

By Tyler Mayberry · Cirlet. Published October 22, 2026. This is a preparation worksheet; the worked examples are fictional.

Run a short discussion using fictional details: your usual email account is unavailable, and an urgent client request is waiting. The exercise tests whether people know the approved recovery route. It does not test your live account or prove that backups work.

Prepare a contact record.

Primary provider contact and a separately verified alternative route.
Agency decision owner and backup owner.
Where the approved incident and recovery procedure can be accessed when email is unavailable.
What identity checks the provider requires before recovery.
Who records actions and preserves relevant evidence.

Keep the contact record in an approved location. Do not put passwords, recovery codes, customer data or private account screenshots in this worksheet or our action-plan tool.

Walk through the scenario.

Who notices the access problem and starts the approved procedure?
How do they reach the provider without using the unavailable account?
Who verifies that a person claiming to provide recovery help is genuine?
Who decides what agency work can continue while access is being restored?
How is the final provider confirmation recorded and reviewed?

Record what happened.

For each question, write the expected owner, the answer actually found, the evidence still needed and the next review date. “We found the contact record” is a narrow result. It is not proof that the account can be recovered within a particular time.

A fictional outcome

The team finds its provider’s primary number but cannot locate the approved backup contact outside email. The agency owner assigns the provider to confirm that route and records a follow-up date. No live credentials are changed during the tabletop.

For a suspected active compromise, use your established incident-response provider and procedure. This worksheet does not provide emergency response or establish coverage/compliance obligations.