A vendor with access “for a moment” often stays for years. Fill this in before the first logon and at every renewal.
Before you grant access
- Named account (no shared password in email)
- An owner on your side (who approves and who revokes)
- Scope: which systems, which data, whether production
- An end date or end condition (“after delivery of X”)
- Agreed channel (VPN / broker / RDP behind MFA) — not “permanent AnyDesk with no logs”
- Vendor knows what is forbidden (copying databases, installing tools without approval)
During the engagement
- MFA enabled on the vendor account
- Least privilege (not Domain Admin “because it is faster”)
- Logons attributable to a person (no shared “service” login)
- Active sessions / devices reviewed on longer projects
- Production changes have a short note (who, when, what)
Offboarding
- Account disabled the same day the contract / project ends
- Removed from VPN, RDP, panels, shared mailboxes
- API tokens, SSH keys, passkeys, OAuth apps revoked
- Devices / certificates returned if issued
- Mail forwarding rules and filters set by the vendor checked
- Shared service passwords rotated (and a plan to stop sharing)
Warning signs
- access with no end date
- one login for the whole vendor company
- RDP / panel exposed to the internet “for convenience”
- nobody on your side knows the access is still live