What should I ask a vendor before giving them access?

The short version

• Ask first: what access, why, who on their team, how they secure it, and how they’ll tell you about a problem.
• Own the account: the business owns the service; the vendor is added as a user.
• Least access: their own login, the lowest role that works, time-limited where possible.
• Write it down: a vendor list with what each one can reach and when to review it.
• End it cleanly: remove access the day the work ends, and change any shared passwords.

Why do vendors matter for security?

Your web company, IT person, bookkeeper, payroll provider and booking software all hold some of your keys. If one of them is breached, careless or leaves on bad terms, your business can be affected. The FTC’s vendor security guidance puts it simply: put security expectations in your contracts, and verify that vendors meet them rather than taking it on trust.

Our help article on sharing logins safely covers the mechanics of inviting people. This guide covers what to ask before you do.

What questions should I ask?

Adapt these to the vendor’s role. A one-off designer needs fewer than your payroll company.

About access

1. Exactly which systems do you need, and what will you do there?
2. Can you work with your own login rather than ours?
3. Who on your team will use it, and what happens when one of them leaves?
4. Do you need access permanently, or only for this project?

About security

5. Do you use a password manager and passkeys or two-step login on everything that touches our systems?
6. Do your staff get security training?
7. Where will any copies of our data be kept, and when will you delete them?

About problems

8. How and how fast will you tell us if you have a breach that could affect us?
9. Do you carry cyber insurance?
10. Who do we call on a weekend if something goes wrong?

CISA’s vendor assessment template for small businesses has a longer list if you need one, and its supply chain resource hub collects related material.

What should be in writing?

You don’t need a long contract for a small job. A short email or clause covering these points helps:

• What access they get, and that it’s only for this work.
• How they may use, share, keep and delete your data. The FTC lists these as contract points.
• That they’ll tell you promptly about a breach affecting you.
• That access ends when the work ends.

For anything involving customer personal data, ask a lawyer to check the agreement. This isn’t legal advice.

How do I give access safely?

1. The business owns the account. Add the vendor as a user. Never let a vendor register your domain, hosting or Google profile in their own name. See owning your online accounts.
2. Their own login, with passkeys or two-step login.
3. The lowest role that works. For a website, see letting staff edit only some content and which WordPress role to choose.
4. If a password must be shared, share only that one login through your password manager. See rolling out a password manager.
5. Add them to your vendor list in your security plan, with a review date.

How do I end access?

On the day the work ends, or the relationship does:

1. Remove their user accounts from each service.
2. Change any passwords they could see.
3. Revoke connected apps or API keys they set up.
4. Ask them to confirm they’ve deleted copies of your data.
5. Update your vendor list.

What if a vendor tells me they’ve been breached?

Ask what was affected, cut off their access if needed, check your own accounts for unusual activity and change shared passwords. The FTC also advises confirming the vendor has fixed the problem before restoring access. If your customers’ data was involved, see what to do after a data breach.

What are the common mistakes?

• The vendor owns the account, so leaving them means losing the service.
• Everyone gets Administrator because it’s quicker.
• A shared office login handed to every contractor.
• Nobody removes access when the project ends.
• No list, so nobody knows who can reach what.

How long does it take?

The questions take a 15-minute call. Setting up a vendor’s login takes minutes. A twice-yearly review of your vendor list takes about 30 minutes.

How does E-3 handle this?

Accounts E-3 sets up are created in the client’s name, with E-3 added as a user, and domains E-3 manages are registered to the client. If a client ever moves on, the accounts stay with the business. That’s the rule we’d suggest asking of any vendor.

Related questions

• How do I write a one-page security plan?
• How do I set up a password manager for my team?
• What does cyber insurance cover?
• What should I ask a web company before hiring one?
• Back to cybersecurity basics

Sources

1. Cybersecurity for Small Business: vendor security (Federal Trade Commission)
2. ICT supply chain resource hub for small and medium-sized businesses (CISA)
3. Operationalizing vendor supply chain risk management: template for SMBs (CISA)
4. Cybersecurity Supply Chain Risk Management Quick-Start Guide (NIST SP 1305)