Access
Third-Party & Vendor Management
Hold vendors to the same access and security standards you hold yourself to.
Defensive guide
Why should I care?
Vendors often have deeper access than your own staff and less oversight.
How to implement it
- Contractual security requirements
- Named vendor identities
- Default-off access with approval workflow
- Review of vendor-installed connectivity
What good looks like
- A register of every vendor connection and its purpose
Common failure modes
- Vendor cellular modems discovered years later
- Contracts silent on security
How to verify it
- Audit each vendor connection against a current contract and work order