Vendors and their access

Most public institutions rely on vendors for the website: a developer, a host, a managed service provider, an agenda software company, a payment processor. Vendors need access to do their work. They also hold the keys to your web presence, often more of them than any employee.

This lesson covers how to give vendors what they need and keep control.

Ownership comes first

Before access, make sure the institution owns what matters:

• The domain is registered in the institution's name, with institutional contacts, in an account the institution controls. A vendor can have delegated access. They should not be the registrant.
• Hosting and paid services are in the institution's account where possible, or the contract says how they transfer.
• Content and data can be exported in a usable format at any time, and on request when the contract ends.
• Administrator access to every system stays with at least two of your own people, even when the vendor does the work.

If any of these is not true today, write it down. Fixing it is easiest at renewal.

Named, limited, time-bound access

Give vendor staff the same rules as your own:

• Named accounts: each person at the vendor has their own login, with their own work email. No shared "vendor" account.
• Smallest role: a developer fixing a template may need administrator access for a day. A content contractor needs Editor.
• Two-step sign-in: required on every vendor account. CISA's goal 3.F, in its guidance for operational technology, calls for MFA on all accounts that can be accessed remotely, including vendor and maintenance accounts.
• Time limits: for one-time work, set an end date and remove access when it passes.
• In the inventory: each vendor account is recorded with the vendor's name and contract.

Ask the vendor for a list of their staff who have access to your systems, and ask them to tell you when someone on it leaves.

What the contract should say

You may not write the contract, but you can tell the person who does what the website needs. CISA's Cybersecurity Performance Goals include two supply chain goals worth raising:

• Incident notice (goal 1.D): vendors and service providers notify the customer of security incidents, with a time frame.
• Managed service providers (goal 1.E): understand what the contract covers, and address security gaps that fall outside it.

Also ask for:

• institutional ownership of the domain, accounts, content and data,
• a list of vendor staff with access, kept current,
• two-step sign-in on all vendor access,
• what happens at the end: data export, transfer of accounts and removal of access.

Remote access tools

Some vendors install software that lets them control a computer or server from outside. Know which tools are installed, who can use them and whether they require two-step sign-in. Remove tools that are no longer needed. An unused remote access tool is an open door.

When the contract ends

Treat the end of a contract the way lesson 4 treats a departure:

1. Remove every vendor account.
2. Change every shared password they knew.
3. Transfer any account or service still in their name.
4. Confirm you have a full export of your content and data.
5. Update the inventory and the contact records.