Giving Vendors and Contractors Access Safely: Least Privilege to Offboarding
Vendors and contractors often hold the keys to your systems. Here is how to grant access safely, from least privilege and named accounts to same-day offboarding.
To give vendors and contractors access safely, give each outside person their own named account (never a shared login), grant only the systems and data they need, require multi-factor authentication, set an end date on the access, route connections through a controlled remote access tool, log what they do, and switch everything off the day the work ends. Put these expectations in the contract before access is granted. This guide explains each step and gives you a checklist for onboarding and offboarding outside help.
Why vendor access is a real risk
Small businesses depend on outside help: accounting firms, software vendors, IT providers, marketing agencies, web developers, copier and phone companies, freelancers. Each one may hold passwords or remote access into your systems, and their security becomes part of yours.
The FTC's guidance for small businesses notes that vendors may have access to sensitive information about your business and customers, and recommends putting security provisions in vendor contracts, verifying compliance rather than taking it on trust, and limiting vendor access to a need-to-know basis with encryption and multi-factor authentication. CISA and partner agencies have also warned specifically about attackers targeting managed service providers to reach their customers, and published recommendations for those customers in a joint advisory.
Principle 1: least privilege
Least privilege means each person gets the minimum access needed to do their job, for as long as they need it, and nothing more.
In practice:
- A bookkeeper needs the accounting system, not the file server or email admin console.
- A web developer needs access to the website's staging environment and hosting panel, not to Microsoft 365.
- A software vendor supporting your practice-management system needs access to that server, during a support session, not 24/7 access to the whole network.
- An IT provider needs administrator rights, but those rights should be limited to the systems they manage. CISA's MSP advisory recommends that customers keep provider accounts out of internal administrator groups where possible and restrict them to the systems the provider actually manages.
Before granting access, write down in one sentence what the vendor needs to do and which systems that requires. If you cannot describe it, do not grant it yet.
Principle 2: separate, named accounts
Never share an employee's login with a vendor, and avoid generic accounts like "support" or "vendor1" used by many people.
- Create a named account for each outside person, clearly labelled (for example, with "ext" or the vendor's name) so it stands out in your user list.
- Use guest access where the platform supports it. In Microsoft 365, external collaborators can often be invited as guests to specific Teams or SharePoint sites instead of receiving a full company account.
- Keep administrator accounts separate from everyday accounts, for vendors and staff alike.
- Never send passwords by email. Use a password manager's secure sharing feature or have the vendor set their own password through an invitation link.
Named accounts give you two things: you can turn off one person without affecting anyone else, and your logs show who did what.
Principle 3: require MFA
Every vendor account that can reach your systems or data should use multi-factor authentication, as both the FTC and CISA recommend. That includes remote access tools, cloud admin portals, hosting control panels and your line-of-business software where it supports MFA. CISA also suggests reviewing MFA settings for weaknesses such as configurations that "fail open" or allow easy re-enrollment.
Principle 4: time-limited access
Most outside access should not be permanent.
- Set an expiration date on accounts for project-based contractors. Many identity platforms, including Microsoft Entra, support access reviews or account expiration.
- Use on-demand remote sessions. Rather than leaving remote access software permanently installed and unattended, use a tool where your staff approves each session, or enable the vendor's account only for the scheduled support window.
- Grant administrator rights just in time where your tools support it, and remove them when the task is finished.
- Review vendor accounts every quarter. Ask: Is this vendor still working with us? Does this account still need this level of access? When was it last used?
Principle 5: control and record the connection
- Route vendor connections through one approved path, such as your VPN with MFA, a zero-trust access service or a remote support tool you control. CISA recommends a dedicated, secure connection for provider traffic.
- Do not open Remote Desktop to the internet for a vendor's convenience.
- Turn on logging for sign-ins and administrative actions, and keep the logs long enough to investigate a problem later. CISA's MSP advisory recommends retaining important logs for at least six months.
- Separate vendor-managed devices such as phone systems, cameras or building controls on their own network segment where possible.
Put it in the contract
Security expectations are much easier to enforce when they are written down before work starts. Consider including:
- the specific systems and data the vendor may access, and for what purpose;
- a requirement to use named accounts and MFA, and not to share credentials;
- how quickly the vendor must tell you about a security incident that could affect you;
- who is responsible for which security tasks (for an IT provider: patching, monitoring, backups, incident response);
- return or deletion of your data at the end of the relationship;
- your right to review their security practices, for example through a questionnaire or an independent assessment.
Depending on your industry, regulations may require some of this. For example, healthcare providers need business associate agreements under HIPAA, and financial businesses covered by the FTC Safeguards Rule must oversee their service providers. Ask your advisors which rules apply to you.
Offboarding: the step that gets forgotten
CISA's MSP advisory notes that disabling provider accounts can be overlooked when a contract ends. Make offboarding a checklist, and run it the same day the work ends:
- Disable the vendor's accounts in every system: Microsoft 365 or Google Workspace, VPN, line-of-business apps, hosting, firewall, cloud consoles.
- Remove remote access software they installed, and revoke API keys or app passwords they created.
- Change shared secrets they knew: Wi-Fi passwords, service account passwords, alarm codes, door codes.
- Transfer ownership of anything they registered for you, such as domain names, DNS, hosting, software licenses and social media, to a company account. Do this before the relationship ends, not after.
- Collect company devices and documents, and confirm in writing that your data has been returned or deleted.
- Record the date and who completed the offboarding.
Do the same review when a vendor's individual technician leaves their company: ask vendors to tell you when someone with access to your systems moves on.
Vendor access checklist
- Inventory of every vendor with access, what they reach and who approved it
- Security terms in the contract before access is granted
- Named accounts or guest access, never shared logins
- MFA on every vendor account
- Least privilege, with expiration dates and quarterly reviews
- One controlled connection path, with logging
- Same-day offboarding checklist
Outside partners are essential to a small business, and giving them access safely is mostly a matter of discipline. If you would like help reviewing who has access to your systems today, or setting up named accounts, MFA and a clean offboarding process for your business in Miami-Dade or anywhere in South Florida, request a free IT assessment.
