29/10/2026
Temporary access can become a permanent security gap.
A vendor gets administrator access to fix a production issue. The work is completed, the ticket is closed, and everyone moves on.
But what if that access is never removed.
Before granting privileged access to a vendor or contractor, check five things:
- Named account: Can you identify who is using it?
- Limited permissions: Does the account have only the access required?
- Expiry time: Is access set to expire automatically?
- Activity logs: Can you review what was accessed or changed?
- Revocation: Is someone responsible for confirming access has been removed?
Closing a support ticket doesn't close an account's permissions.
Make access removal part of the process, not a reminder someone might forget.
Save this checklist for your next vendor access request.