Best practices for maintaining emergency contact information

Treat this as controlled incident-response data, not an informal address book. Assign a primary owner and backup, then keep one authoritative directory containing each contact’s role, primary and alternate phone/email, time zone, escalation order, and last verified date. Require confirmation at least quarterly and whenever someone joins, leaves, or changes role.

Limit access to responders and retain change history. Store only information needed during an incident. Keep a protected read-only offline copy in the incident kit, with another copy in a separate secure location, so a Microsoft 365 or network outage does not remove access. Test retrieval during tabletop exercises and correct any gaps.

Keep credentials out of the directory. For Entra recovery, maintain at least two cloud-only emergency access accounts, secure their credentials separately, alert on every sign-in, and test them at least every 90 days. After each drill or incident, update contacts, escalation paths, and ownership.