Reset a person's second factor

Someone lost the phone or app they use as a second factor and can no longer sign in to management.

Security management deletes the second factor after a strict check of the person's identity. All of the person's sessions end, and at the next sign-in they set up a new factor. A reset opens the door to an attacker if identity isn't established, so TrustBridge requires details of the check and writes them to the security audit log.

1. Verify identity in person or on a video call with ID, using at least two independent attributes.
2. For external people or people who've been away for a long time, also involve their manager.
3. Watch for warning signs: several requests from the same person within 30 days, time pressure, or insistence from the person asking.
4. Reset the factor with the security management role, giving the verification method, the verifier, the attributes checked, and a comment. Without them, the call is refused.

Result. The factor is deleted, and all of the person's sessions have ended. The person and security management receive the „second factor reset“ notification. The details of the check are in the security audit log.

• If the device holding the personal key is lost too, also revoke the key. Revoking it immediately ends every session bound to it.
• Auditors can't hold this role at the same time; such an assignment is refused with 409.

• People and access
• Lift a person's lockout
• Review sign-ins