{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "item": { "id": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "slug": "prepare-ece-recovery-codes-before-normal-secret-access-is-lost", "url": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost.md", "json": "https://update.dsesecurity.com/api/v1/posts/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/" }, "title": "Prepare ECE recovery codes before normal secret access is lost", "summary": "Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "video-surveillance", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:31:50+00:00", "modified_at": "2026-10-15T13:36:14+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 269, "potentially_affected": "Applies to ECE account recovery in Verkada Command. A recovery code is distinct from an organization invitation, and this article does not guarantee recovery when all required key access has been lost.", "dse_recommendation": "DSE recommends completing recovery-code onboarding while normal access works.", "primary_source": { "name": "Verkada Help — Enterprise Controlled Encryption Account Recovery", "url": "https://help.verkada.com/command/security/enterprise-controlled-encryption/ece-account-recovery", "published_on": null, "authority": "help.verkada.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.

\n

Source facts

\n

Verkada ECE recovery codes provide another way for a user to decrypt the customer secret when normal access is unavailable. An account-specific code is emailed after the user accepts an invitation and sets a password, and remains valid until rotated or the account is deleted. An authorized Org Admin can send a new code, which invalidates the old one. Managing recovery codes requires access to the current customer secret and a validated administrator recovery code.

\n

Source: Verkada Help — Enterprise Controlled Encryption Account Recovery.

\n

Applicability

\n

Applies to ECE account recovery in Verkada Command. A recovery code is distinct from an organization invitation, and this article does not guarantee recovery when all required key access has been lost.

\n

DSE recommendation

\n

DSE recommends completing recovery-code onboarding while normal access works. Have each user store the code in an approved protected location and identify a trained administrator who has validated their own recovery path. Record readiness without collecting users’ codes into a general spreadsheet. Include recovery-code rotation when assessing a suspected disclosure and update the recovery instructions afterward. Do not wait for the only knowledgeable administrator to be locked out before discovering the prerequisite.

\n

Verification

\n

Use a disposable or explicitly approved test account to rehearse the documented recovery flow. Confirm the replacement code arrives through the intended channel and that the old code is invalidated when rotated. Keep the outcome and responsible owner in the record, while excluding code values and decrypted key material.

\n

Official reference

\n

Verkada Help — Enterprise Controlled Encryption Account Recovery. Reviewed October 15, 2026.

", "content_text": "Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.\nSource facts\nVerkada ECE recovery codes provide another way for a user to decrypt the customer secret when normal access is unavailable. An account-specific code is emailed after the user accepts an invitation and sets a password, and remains valid until rotated or the account is deleted. An authorized Org Admin can send a new code, which invalidates the old one. Managing recovery codes requires access to the current customer secret and a validated administrator recovery code.\nSource: Verkada Help — Enterprise Controlled Encryption Account Recovery.\nApplicability\nApplies to ECE account recovery in Verkada Command. A recovery code is distinct from an organization invitation, and this article does not guarantee recovery when all required key access has been lost.\nDSE recommendation\nDSE recommends completing recovery-code onboarding while normal access works. Have each user store the code in an approved protected location and identify a trained administrator who has validated their own recovery path. Record readiness without collecting users’ codes into a general spreadsheet. Include recovery-code rotation when assessing a suspected disclosure and update the recovery instructions afterward. Do not wait for the only knowledgeable administrator to be locked out before discovering the prerequisite.\nVerification\nUse a disposable or explicitly approved test account to rehearse the documented recovery flow. Confirm the replacement code arrives through the intended channel and that the old code is invalidated when rotated. Keep the outcome and responsible owner in the record, while excluding code values and decrypted key material.\nOfficial reference\nVerkada Help — Enterprise Controlled Encryption Account Recovery. Reviewed October 15, 2026.", "content_markdown": "Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.\n\n## Source facts\n\nVerkada ECE recovery codes provide another way for a user to decrypt the customer secret when normal access is unavailable. An account-specific code is emailed after the user accepts an invitation and sets a password, and remains valid until rotated or the account is deleted. An authorized Org Admin can send a new code, which invalidates the old one. Managing recovery codes requires access to the current customer secret and a validated administrator recovery code.\n\nSource: [Verkada Help — Enterprise Controlled Encryption Account Recovery](https://help.verkada.com/command/security/enterprise-controlled-encryption/ece-account-recovery).\n\n## Applicability\n\nApplies to ECE account recovery in Verkada Command. A recovery code is distinct from an organization invitation, and this article does not guarantee recovery when all required key access has been lost.\n\n## DSE recommendation\n\nDSE recommends completing recovery-code onboarding while normal access works. Have each user store the code in an approved protected location and identify a trained administrator who has validated their own recovery path. Record readiness without collecting users’ codes into a general spreadsheet. Include recovery-code rotation when assessing a suspected disclosure and update the recovery instructions afterward. Do not wait for the only knowledgeable administrator to be locked out before discovering the prerequisite.\n\n## Verification\n\nUse a disposable or explicitly approved test account to rehearse the documented recovery flow. Confirm the replacement code arrives through the intended channel and that the old code is invalidated when rotated. Keep the outcome and responsible owner in the record, while excluding code values and decrypted key material.\n\n## Official reference\n\n[Verkada Help — Enterprise Controlled Encryption Account Recovery](https://help.verkada.com/command/security/enterprise-controlled-encryption/ece-account-recovery). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "url": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Prepare ECE recovery codes before normal secret access is lost", "item": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/#article", "identifier": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "url": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/", "headline": "Prepare ECE recovery codes before normal secret access is lost", "description": "Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.", "abstract": "Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.", "articleBody": "Validate the administrator recovery path while normal access works, and keep recovery-code values out of tickets.\nSource facts\nVerkada ECE recovery codes provide another way for a user to decrypt the customer secret when normal access is unavailable. An account-specific code is emailed after the user accepts an invitation and sets a password, and remains valid until rotated or the account is deleted. An authorized Org Admin can send a new code, which invalidates the old one. Managing recovery codes requires access to the current customer secret and a validated administrator recovery code.\nSource: Verkada Help — Enterprise Controlled Encryption Account Recovery.\nApplicability\nApplies to ECE account recovery in Verkada Command. A recovery code is distinct from an organization invitation, and this article does not guarantee recovery when all required key access has been lost.\nDSE recommendation\nDSE recommends completing recovery-code onboarding while normal access works. Have each user store the code in an approved protected location and identify a trained administrator who has validated their own recovery path. Record readiness without collecting users’ codes into a general spreadsheet. Include recovery-code rotation when assessing a suspected disclosure and update the recovery instructions afterward. Do not wait for the only knowledgeable administrator to be locked out before discovering the prerequisite.\nVerification\nUse a disposable or explicitly approved test account to rehearse the documented recovery flow. Confirm the replacement code arrives through the intended channel and that the old code is invalidated when rotated. Keep the outcome and responsible owner in the record, while excluding code values and decrypted key material.\nOfficial reference\nVerkada Help — Enterprise Controlled Encryption Account Recovery. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:31:50+00:00", "dateModified": "2026-10-15T13:36:14+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/prepare-ece-recovery-codes-before-normal-secret-access-is-lost/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Prepare ECE recovery codes before normal secret access is lost" }, "articleSection": [ "Video Surveillance" ], "keywords": [ "Video Surveillance", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Video Surveillance", "url": "https://update.dsesecurity.com/topic/video-surveillance/" } ], "wordCount": 269, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Verkada Help — Enterprise Controlled Encryption Account Recovery", "url": "https://help.verkada.com/command/security/enterprise-controlled-encryption/ece-account-recovery" } } ] } }