Two-Factor Auth Setup Guide

a. User uses one of their pre-generated backup codes to sign in

b. After sign-in, user enrolls a new authenticator device

c. Old device enrollment is revoked

d. New backup codes are generated, old ones invalidated

a. User contacts support with identity verification request

b. Verify identity through secondary method (ID, security questions, manager approval)

c. Apply temporary account hold (24-72 hours cooling period)

d. Reset 2FA and require immediate re-enrollment

e. Log the recovery event for audit trail

a. Requires approval from two administrators (dual control)

b. Document reason for reset in incident log

c. Notify user via verified secondary channel (phone, verified email)

d. Force password change along with 2FA re-enrollment

e. Monitor account for suspicious activity post-reset