During a 3 a.m. outage it emerges that the only person who knows the local emergency administrator password is on a flight and unreachable. Which arrangement should have been made while everything was calm?

Emergency credentials are an availability control, and availability controls die of the single-point-of-knowledge failure this outage demonstrated. The standard arrangement is sealed escrow under two-person custody: the credential held sealed - a managed vault or witnessed envelopes with a logged trail - retrievable through a defined process when justified, and rotated after use so escrow cannot leak into everyday life. Copies defeat the purpose: a personal copy per rota member multiplies the copies that leak, nothing can be recalled at the incident's end, and attribution dissolves - the password behaves like a room key, not a credential. A runbook is the most widely read document in the operational estate; embedding a live password in the document that describes the login guarantees permanent disclosure and unlogged rotation; runbooks should point at the escrow, never contain it. Routing emergency administration through the backup application's integration account fails on both privilege and design: integration identities carry scoped, application-specific rights rather than the full appliance administration an outage can demand, and abusing them breaks the backup path mid-firefight. Exam caveat: escrow is only proven by rehearsal - schedule a retrieval drill and treat the first real retrieval as an audited event. Operational check: rehearse the escrow retrieval, exercise the credential once in a maintenance window, confirm the audit trail captures the use, and rotate.