Vendor Access
Set rules for third-party access to systems, data, and support channels.
Purpose
Access work should always connect a person, role, system, approval basis, review date, and removal path. The highest-risk failure is stale privilege that nobody notices because the original request looked legitimate.
Policy shape
| Rule | State the expected behavior in direct language. |
|---|---|
| Reason | Explain the operating risk or obligation behind the rule. |
| Owner | Name who maintains the policy and decides exceptions. |
| Evidence | Define what proves the policy is being followed. |
| Review | Set a review cadence and update trigger. |
When to use
- When the work repeats often enough that memory is no longer reliable.
- When more than one person may request, perform, review, or inherit the work.
- When risk, approval, evidence, or handoff needs to be visible later.
Common failure modes
- Access remains after role change or departure.
- Reviewers approve names without confirming business need.
- Exceptions are granted but never revisited.
- A vendor account remains active after support ends.
Review guidance
Review this page after a material incident, after a role or system change, and on a normal cadence appropriate to its risk. During review, check whether the owner is still correct, whether inputs are still complete, whether the output is still useful, and whether related pages need updates.
External guidance
These resources are references for terminology, control thinking, or review design. DailyWF adapts the ideas into lightweight operating pages rather than reproducing full standards.
- NIST SP 800-63-4 Digital Identity GuidelinesIdentity proofing, authentication, and federation guidance.
- NIST SP 800-53 Rev. 5 control catalogSecurity and privacy control language useful when translating operating work into controls.
- CIS Critical Security Controls v8Prioritized safeguards for common enterprise security risks.
- CISA Secure by DesignSecure-by-design principles for software and technology evaluation.