Protect Important Accounts and Plan Your Recovery

Identify the accounts that matter

Start with accounts whose loss would cause serious inconvenience. Your main email is important because it may support recovery of other accounts. Make a short private list of account types and review what each controls.

In this fictional exercise, a learner uses email, a learning portal and a file-storage service. The practice list records only the service type and actions needed. It does not contain usernames, passwords or recovery secrets.

Review the sign-in protection

The NCSC recommends two-step verification for important accounts. It adds another check to sign-in. Follow the service’s official instructions to see which protections and recovery options are available.

For a work account, ask the responsible team before changing its configuration. Record whether a protection is enabled and what question remains, rather than writing the code or secret itself. Do not approve an unexpected sign-in request.

Plan for loss of your usual method

Think through what you would do if your phone were unavailable or replaced. Review the official recovery process while you still have access. The NCSC advises having a backup plan and keeping any backup codes safe.

Keep actual recovery information in an appropriate secure location, separate from a public exercise. The practice record should say whether the recovery method has been reviewed, not expose how another person could use it.

Complete a focused review

Choose one important account and review its official security and recovery settings. Make a note of an action you can complete safely, a question for support and a date to check the outcome.

Use fictional account details for the exercise. Do not deliberately lock yourself out to test a recovery plan. If access is already lost or something seems suspicious, use the service’s trusted support route and the relevant organisational reporting process.

Source and practice note

NCSC guidance explains two-step verification and recovery planning. The examples and exercises are original RDE learning material. Follow your organisation’s procedures for work accounts and devices.

Read the NCSC guidance

Cover image: AI-generated illustrative scene created specifically for this resource.