How should contractors get access to our systems?
Named accounts, narrow scope, MFA and an end date. Never a shared staff login or VPN password.
Start here
Give each contractor their own named account, limited to the systems they work on, with MFA and an end date. Never share a staff login or a common VPN password.
The rules
- Own account. So every action is traceable to a person.
- Narrow scope. One app or one server, not the network.
- Expiry. Access ends when the contract does, automatically if possible.
- MFA. Same standard as staff. No exceptions for convenience.
Their devices
Contractors often use their own hardware. If you can’t manage it, limit what it can reach, require device checks where possible, or provide access through a browser-based session that keeps your data off their machine.
Offboarding
Disable the account the day the work ends. Rotate any shared secrets they saw, such as service passwords or API keys. Review logs if anything looks odd.
Contractor access is part of our remote access setup. Related: running a least-privilege access review.