External people with access.
WHAT TO ESTABLISH
What they need access to For how long What they may do with it What happens when the work ends
WHAT TO GIVE
Their own account, in their name The minimum access needed
WHAT NOT TO GIVE
Your own credentials Broader access for convenience
WHY NOT YOUR CREDENTIALS
You cannot revoke them without changing your own, and actions cannot be attributed.
WHAT TO REQUIRE
That they do not share access That they follow your basic standards
WHAT TO PUT IN WRITING
Access, confidentiality, and what happens to information afterwards.
WHEN THE WORK ENDS
Remove access the same day Check whether they created additional accounts or keys Check what third-party services were connected
THAT LAST ONE
Connections authorised during a project and forgotten.
WHAT TO REVIEW
Contractor access, quarterly.
WHAT YOU WILL FIND
Accounts from projects that ended long ago.
