Running RecoveryCodes as a service, IAM Access Control

RecoveryCodes Agency Implementation, Monetizing MFA Inventory and Compliance Audits

Learn how to deliver MFA inventory, coverage reporting, and offboarding attestation as a recurring service to security consultancies and MSPs. This course covers account and authenticator mapping, reverse lookups to identify device risks, and exporting compliance evidence for audit cycles.

Open the decision record for RecoveryCodes

What does running RecoveryCodes for clients commit you to?

Published figures for this service. Blank fields are not published.

Monthly tool cost
Vendor cost basis is the RecoveryCodes entry tier under its published tiered pricing; exact plan amounts are not enumerated in the supplied data, so confirm the lowest plan price in your account. No setup fee is published.
Time to first value
Not published, setup_complexity is low and time_to_value is days, but no explicit hour or engagement duration is published.
Payback
Not modeled, client price, labor, usage, overhead, and expected volume are not supplied.

Is RecoveryCodes worth running as a client service?

The evidence supports a viable managed service: RecoveryCodes covers a real gap for off-IdP accounts with inventory, reverse lookup, MFA coverage reporting, one-device risk identification, offboarding attestation, and an audit log, and it is audit-ready with low setup complexity. What remains unknown is vendor cost at each tier, deliverable labor per client, and any white-label or reseller economics, RecoveryCodes is not rebrandable, so the agency sells service labor around a visibly branded tool.

An agency-fit judgement for reselling this service. It is separate from the tool description on the decision record.

Before you start

What has to be in place before the first client engagement.

Tools and subscriptions

  • RecoveryCodes workspace with member roles
  • Google, GitHub, or GitLab accounts for the client's off-IdP surfaces being inventoried
  • OIDC/SAML/SCIM/LDAP identity context from the client's IdP to define what falls outside it
  • Client-side authenticators to enumerate: TOTP apps, security keys, SMS
  • Webhook endpoint or monitored inbox for risk and sensitive-access alerts

People and inputs

  • Documented naming taxonomy for domains and authenticators (drives reverse lookup and coverage reporting)
  • Intake template capturing account details, authenticator details, recovery codes, and user identities
  • Offboarding workflow definition to run before client access is removed
  • Reviewer for audit-ready evidence: MFA coverage report, access and change log, JSON export

Included with the course

7 working documents for delivering this service.

  • MFA Coverage Gap Assessment Worksheetworksheet
  • Offboarding Attestation SOP for Client Departuressop
  • RecoveryCodes Inventory Onboarding Checklistchecklist
  • One-Device Risk Report Templatetemplate
  • Recovery Code Storage and Access Control Guideguide
  • Compliance Tier Feature Comparison and Pricing Proposaltemplate
  • Reverse Lookup Workflow for Lost Device Scenariossop

Listed by name. These documents are not yet published as individual downloads.