# Identity security: phishing-resistant login, usable recovery and verified offboarding

Source: https://www.web3sec.news/blog/identity-mfa-recovery-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Name the inventory owner and independent recovery custodian.
- [ ] Enroll and test a separate backup authenticator.
- [ ] Review every fallback and authenticator-enrollment path.
- [ ] Verify session revocation after a controlled test.
- [ ] Reconcile offboarding across services outside central sign-in.

## References
- [CISA: implementing phishing-resistant MFA](https://www.cisa.gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
- [NIST SP 800-63B: authentication and authenticator management](https://pages.nist.gov/800-63-4/sp800-63b.html)