Preserve Evidence During a Shared Credential Migration

1. Define the queue boundary

Describe shared credential migration support as a bounded administrative lane before assigning it. The intake must identify system identity, authorized user list, migration window, credential owner, test result, and revocation proof. The written boundary says which records the assistant may read, which fields may be prepared, and which actions require the identity owner. It also names the safe holding state for incomplete evidence so speed never substitutes for authority.

Checkpoint 1 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

2. Create stable identity fields

Give every shared credential migration support item a stable reference that survives exports, email forwarding, and ownership changes. Match the reference to the authoritative record before copying any status. Similar names, dates, or amounts are comparison clues, not proof. Record conflicts explicitly and preserve both sources for the identity owner.

Checkpoint 2 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

3. Separate preparation from approval

Use distinct states for received, evidence checked, prepared, awaiting decision, approved, executed, verified, and closed. In shared credential migration support, a polished draft is not an approved action and a sent message is not proof of the intended outcome. The record must show who changed each state and the evidence that justified it.

Checkpoint 3 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

4. Route exceptions without invention

Define reason codes that reflect this lane: missing source, identity mismatch, obsolete version, inaccessible file, conflicting instruction, unavailable owner, rejected destination, or changed scope. The assistant records the observable condition and routes it; the assistant does not infer security design, access approval, incident response, and exception acceptance.

Checkpoint 4 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

5. Apply minimum necessary access

Provide only the systems, records, and fields needed to prepare shared credential migration support. Keep sensitive source material in its approved system and put stable references, not unrestricted copies, in the tracker. Review temporary permissions after the pilot and remove access that the evidence shows was unnecessary.

Checkpoint 5 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

6. Reconcile the population

At each cutoff, reconcile opening items, new receipts, transfers, completions, withdrawals, and the ending queue. Investigate unexplained differences before reporting throughput. For shared credential migration support, publish age bands and exception reasons beside volume so an apparently healthy completion count cannot conceal stranded or force-closed work.

Checkpoint 6 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

7. Verify destination acceptance

Define completion from the receiving system or accountable owner. Save a transaction ID, accepted status, signed acknowledgement, publication URL, or comparable destination evidence. If shared credential migration support is returned or rejected, reopen the same reference with the reason rather than creating a fresh item that hides rework.

Checkpoint 7 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

8. Review a representative sample

Review every high-risk exception and a documented random sample of routine shared credential migration support cases. Compare the original source, prepared result, approval, execution reference, and destination evidence. Classify corrections by cause and revise the instruction only after the identity owner confirms the changed boundary.

Checkpoint 8 for shared credential migration support should be rehearsed with an ordinary record and a deliberately adverse record involving missing evidence, conflicting versions, an unavailable owner, or a rejected destination. Preserve system identity, authorized user list, migration window, credential owner, test result, and revocation proof, the exact instruction version, the actor, the local and UTC timestamps, the permitted action, and the reason the item moved or stopped. A second reviewer should be able to reach the same queue state without private chat history. If that reviewer cannot, return the record for clarification rather than filling the gap from habit. The identity owner then accepts the correction, residual limitation, and next review date before this checkpoint becomes a reusable operating rule.

Questions and operating boundary

Source

cisa.gov provides authoritative background and does not endorse this service.