Make migration and recovery repeatable
The checklist should let an authorized reviewer reproduce the process without seeing passwords. It must cover ownership, destination choice, validation, backup, recovery, cleanup and periodic review.
Six months after migration, the original operator is unavailable. A recovery custodian follows the documented runbook, restores a representative archive copy and identifies active credentials that belong in the password manager rather than the file archive.
Use a controlled sequence
- 01Define scope, owners, approvals and a stop condition before work starts.
- 02Attach the inventory, duplicate decisions and destination rationale.
- 03Record validation, encryption, backup and restore evidence.
- 04Document every source and derivative-copy cleanup action.
- 05Schedule credential rotation, recovery tests and archive review.
Leave evidence without copying secrets
The final record should include approval, scope, exceptions, selected systems, custodians, validation evidence, backup and restore result, cleanup evidence, review date and exit plan.
Pause and review when
- The runbook contains passwords, recovery codes or master secrets.
- Success is declared without a restored-and-opened sample.
- No owner is responsible for future review or product migration.
Encrypted files are not a password manager
Encrypted-file storage is not password autofill, browser sync or a general credential manager. Match the system to the user task and test recovery before removing the source.
Run the final independent check
Before sign-off, hand the runbook to an authorized person who did not perform the migration. They should be able to identify the authoritative archive, explain which credentials belong in a password manager, locate the separate backup and complete a harmless restore without oral hints. Record misunderstandings as defects. A runbook is ready only when it works for the next custodian, not merely its author.
Resolve these before acting
Should the checklist contain the master password?
No. Document custody and recovery procedures without placing secrets in the operational record.
How often should recovery be tested?
Use a risk-based schedule and test after material product, device, account or storage changes.
Sources for this decision
- Microsoft Support: repair and recover workbooks
- NIST SP 800-63B: authentication and authenticator management
Links support the specific decision on this page and do not imply endorsement. Organizational policy and qualified advice control the real migration.