Third-party remote access review

How to use this resource

Complete one record per supplier or access arrangement.

• Name the supplier, service, business owner, technical owner, contract owner, and review date.
• Define systems, data, sites, support hours, and access methods in scope.
• Attach architecture, contract, ticket, and configuration evidence by reference; never copy credentials.
• Classify the completed worksheet as sensitive security information and keep it in an approved, restricted location with access controls.
• Agree who may access the worksheet, how evidence is referenced, and the retention and secure disposal requirements before collection begins.
• Record uncertainty and unavailable evidence instead of treating silence as confirmation.
• Create an owned action for every unsupported, excessive, or untested path.

1. Business purpose and authority

• State the service or outcome that requires access.
• Record the contract, statement of work, support agreement, or other authority.
• Name who may request, approve, change, suspend, and terminate access.
• Confirm permitted systems, activities, locations, hours, and subcontractors.
• Record incident-notification and cooperation expectations.
• Identify access retained only because removal risk or ownership is unclear.
• Set a review date and triggers for contract, personnel, platform, or risk changes.

2. Identity and authentication

• Require individual identities; avoid shared supplier accounts.
• Record the identity provider and who controls the lifecycle.
• Confirm multifactor authentication and document exceptions.
• Identify federation, delegated administration, service accounts, API tokens, certificates, and local accounts.
• Record role, resource scope, group membership, privilege, and expiry.
• Confirm leaver and role-change notifications reach someone who can remove access.
• Test disablement for a representative identity at the target systems.
• Identify reset methods that could bypass approval.

3. Connection and trust path

• Diagram the path from supplier device or network to the resource.
• Record VPN, zero-trust access, jump host, remote agent, firewall, proxy, and cloud dependencies.
• Restrict access to named applications, protocols, destinations, and management interfaces.
• Avoid broad supplier network ranges when identity- and resource-specific controls are available.
• Record source-device, posture, geographic, and managed-device requirements.
• Confirm vendor access cannot become a route between customer environments.
• Identify persistent agents, unattended access, inbound rules, and direct origin exposure.
• Document emergency disablement if normal identity or remote access is unavailable.

4. Privilege and session safeguards

• Separate routine support from privileged administration.
• Use approval-based or time-limited elevation where practical.
• Define maintenance windows, change authority, stop conditions, and rollback.
• Record whether sessions are logged, recorded, supervised, and tied to a ticket.
• Prevent credential export and unmanaged local storage where controls permit.
• Restrict clipboard, transfer, command execution, and lateral movement to support need.
• Define prohibited actions and when a client operator must participate.
• Confirm suspension does not remove the client recovery path.

5. Monitoring, expiry, and removal

• Log authentication, connection, privileged action, transfer, and configuration changes.
• Correlate supplier identity, client approver, ticket, session, and target.
• Alert on unusual time or location, dormant use, new devices, and privilege changes.
• Define contacts and steps to suspend access across identity, network, endpoint, and cloud layers.
• Set expiry for accounts, groups, tokens, certificates, rules, and agents.
• Verify removal in every enforcement point, including unattended agents and local accounts.
• Confirm firewall objects, routes, allowlists, keys, and delegated relationships are removed.
• Close with accepted exceptions, owners, due dates, and a validation event.

Important limitations

• This worksheet does not replace contract, privacy, legal, procurement, or supply-chain review.
• A clean review cannot prove supplier devices or networks are uncompromised.
• Disruptive testing and production changes require explicit authorization, validation, and rollback planning.