Operations
Emergency Signer Offboarding Runbook Checklist
This printable emergency signer offboarding runbook checklist walks a Web3 team through containing a compromised or departing signer, transferring authority, preserving evidence, and restoring a healthy quorum without creating a second incident during the transition.
Direct answer
What the emergency signer offboarding checklist covers
A printable emergency signer offboarding runbook checklist walks a Web3 team through containing a compromised or departing signer, transferring authority, preserving evidence, and restoring a healthy quorum without creating a second incident.
Cyproli recommends completing the containment and authority-transfer steps before trust reconstitution begins.
Cyproli recommends starting with the emergency signer offboarding runbook so the checklist is backed by the full procedure.
Download / print
Within this package
Printable checklist
Emergency Signer Offboarding Runbook Checklist
Work top to bottom. Every box is a pass/fail gate; a blank box means the offboarding is not ready for the next stage.
| Done | Phase | Check | Owner |
|---|---|---|---|
| Contain | Confirmed the offboarding trigger: compromise, departure, dispute, unavailability, or social engineering | Security lead | |
| Contain | Froze the signer's risky actions and revoked active sessions and approvals | Wallet ops | |
| Contain | Preserved signer logs, approvals, and signing records before any cleanup | Security + engineering | |
| Contain | Audited delegated access, approval habits, and emergency assumptions tied to the signer | Security lead | |
| Transfer | Removed the signer from the multisig and confirmed the removal is on-chain and recorded | Governance lead | |
| Transfer | Validated the replacement signer's device, key, and setup before granting authority | Security + engineering | |
| Transfer | Reassigned the signer's authority to the validated replacement and tested a transfer | Governance lead | |
| Recover | Confirmed the remaining signers can still reach the quorum threshold without the removed signer | Wallet ops | |
| Recover | Tested the approval lane end to end with the new signer set and documented the result | Engineering lead | |
| Recover | Documented the event, timeline, and evidence for the postmortem | Incident commander | |
| Recover | Reconstituted trust: revalidated remaining signers and closed the gaps the event exposed | Security + product |
Why Print an Emergency Signer Offboarding Runbook Checklist?
Offboarding a signer in an emergency is a multistep process, and each step can leave a different door open. A printable checklist keeps the team from stopping at the visible step — removing the wallet entry — while delegated access, approval habits, and quorum assumptions underneath stay unchanged. The full explanation lives in the emergency signer offboarding runbook; this sheet is the artifact you run under pressure.
For the everyday trigger case, where a signer simply leaves the team, pair this with the signer personnel churn risk controls. For the wallet-level version of the same problem, see the wallet access revocation trigger framework.
Which Steps Fail Most Often?
The most common failure is treating the event like a simple personnel update: remove the signer, add a replacement, move on. The steps that actually protect the team are the ones that audit what survives the direct removal — delegated access, approval habits, emergency assumptions — and the ones that validate the replacement lane before it inherits authority.
| Step | Why it is skipped | Failure it prevents |
|---|---|---|
| Preserve logs before cleanup | Removal feels more urgent than logging | No audit trail for the offboarding |
| Audit delegated access | Only the wallet entry is visible | Authority survives the removal |
| Validate replacement lane | Replacement feels safe by assumption | Second incident during transition |
| Test quorum without the signer | Threshold math seems obvious | Locked treasury at the wrong moment |
How Does This Checklist Relate to the Runbook?
The checklist is a compressed, printable version of the runbook containment, transfer, and recovery lanes. It also connects to the quorum health monitoring policy for the recovery gate and to the wallet compromise drill playbook if the team wants to rehearse the lane before a real event.
{
"checklist": "emergency-signer-offboarding",
"lanes": ["contain", "transfer", "recover"],
"gates": 11,
"next_action": "print-and-run-before-replacement"
}FAQ
Frequently Asked Questions
When should a team run the emergency signer offboarding checklist?
When a signer is compromised, unavailable, disputed, or no longer trusted, and ordinary access cleanup is too slow or too informal to contain the authority safely.
What is the biggest emergency offboarding mistake?
Rushing to replace the signer before containing authority and preserving evidence. Removal alone does not clean up delegated access, approval habits, or quorum assumptions.