What actually happens, step by step.

You add the AWS root credentials, the domain registrar login, the Entra ID break-glass account, or the recovery codes for the identity provider everything else depends on.

You choose the holders — say five people — and the threshold, say three. Your browser encrypts the value, splits the key into five shares, and encrypts each share to one holder’s public key. We receive ciphertext and five opaque blobs.

We refuse a threshold of one, because that would let a single person open a team secret alone. We also refuse a threshold equal to the number of holders where there is any alternative, because “all five must be present” is a lockout waiting for the first holiday.

Someone sends an emergency message. It targets contacts, groups, or whoever currently holds a given team role, and it follows an escalation ladder: push and email at once, SMS at ten minutes, a phone call at thirty.

Each step chases only the people who have not acknowledged, and stops for each person the moment they do. If the whole ladder runs out with nobody answering, the sender is told and — if configured — an incident opens automatically. That silence is a finding in itself, and it is nearly always a stale phone number rather than a person ignoring a page.

A holder opens a request and writes why. Every other holder gets it by email and SMS, reads the reason, and decides. Approving decrypts their share locally and re-encrypts it to the requester.

Because the requester supplies their own share, a 3-of-5 secret needs two approvals. When the threshold is met the requester’s browser reassembles the key and decrypts the value. If enough holders decline that the threshold becomes unreachable, the request fails immediately rather than leaving someone waiting during an incident for approvals that can never arrive.

Playbooks are branching runbooks — steps, decisions with real branches, and endings. Recovery plans are phase-oriented restoration procedures with RTO and RPO targets. Both can link a step directly to the secret it needs, so a responder opens the request from exactly where they are instead of hunting the vault.

Running one records each step as complete, skipped or failed, with who and when. A skipped step requires a note, because that is the thing everyone regrets not having in the post-incident review.

Scheduled drills open a practice incident and start a drill run of the real document on your cadence — monthly, quarterly, whatever you commit to. Drill traffic never reaches an external contact and never yields real secret material, so practising is safe.

On Business plans, facilitated tabletop exercises log injects, decisions and actions with timestamps, and close with a summary, identified gaps and owned action items.

Export an evidence pack for any period: secrets and their quorums, every access request with its reason and approvals, membership changes, drills run, incidents and their time to resolve, and how current your contact list is. One self-contained file, no external dependencies, mapped to the controls your framework names. See the mapping.