It’s common for third-party vendors to require access to company systems, resources, or facilities in order to provide service or maintenance, support company functions and personnel, or engage in security or monitoring endeavors.

The purpose of this Vendor Access Policy, written by Scott Matteson for TechRepublic Premium, is to establish appropriate guidelines for providing, monitoring, adjusting, and terminating vendor access to company systems or resources.

Featured text from the download:

DETAILS

All third-party vendors should be properly vetted and provide at least three references.

The IT department/office of security should develop a plan for vendor access based upon the requirements involved.

Only the bare minimum access and privileges should be granted to vendors in order to perform necessary work. If a remote virtual private network tunnel is involved, only open the ports needed for connectivity.

Where possible, remote access should entail multi-factor authentication.

Vendor accounts should be subjected to the same requirements as employee accounts. This means minimum password length, password complexity, mandatory periodic password changes, etc.

Where possible, grant individual-based access to vendors rather than using generic or shared accounts.

Vendors must not store company data on their own systems unless file storage is the purpose of the vendor association.

Boost your business operations with our five-page document. Previously priced at $19, this is now available for download at just $9. Alternatively, enjoy complimentary access with a Premium annual subscription.

TIME SAVED: Crafting this content required 10 hours of dedicated writing, editing, research, and design.