How can an executive office show that a departing vendor no longer has usable access?

Abstract

NIST control guidance treats account management, authenticators, remote access, personnel changes, logging, and supply-chain risk as related controls [1][3][4][6]. CISA guidance adds that third-party access should follow least privilege and that exposed managed-service accounts deserve review [8][9]. Vendor offboarding is complete only when the organization checks every path the vendor could still use, including delegated calendars, shared files, meeting platforms, physical badges, and recovery channels.

Methodology

This review compares ten current NIST and CISA sources on access control, identity, remote access, supply-chain risk, incident response, and managed providers [1][2][3][4][5][6][7][8][9][10]. It offers an operating control for executive support teams, not a contract interpretation or incident certification.

The contract end date is only a trigger

A vendor can retain named accounts, guest access, shared links, API tokens, badges, devices, forwarding rules, or knowledge of a recovery path. Begin with an access inventory tied to the vendor's work rather than treating one disabled account as closure [1][4].

Remove access in dependency order

Disable active remote and privileged paths at the approved time, then revoke authenticators, sessions, delegated permissions, group memberships, and physical access. Preserve only the access that a named business or legal owner has explicitly approved for transition work [1][2][3][6].

Transfer records without copying everything

Assign ownership for current calendars, briefs, source files, contact records, and open commitments. Copy only what the organization is entitled and required to retain. Supply-chain and privacy controls do not justify importing a vendor's unrelated records [4][5].

Test from the outside

After removal, test former login routes, shared links, password-reset paths, device sessions, and meeting invitations. Review logs for successful use after the cutoff. If unexpected access appears, route it through the incident owner rather than asking support staff to investigate alone [7][8][9].

Close with evidence and an owner

A closure record should identify the vendor, systems reviewed, removal time, exceptions, transferred assets, test results, and approving owner. Keep the record under the organization's retention policy and schedule a later check for temporary exceptions that outlive the transition.

Key findings

  • One disabled account does not prove that every vendor access path is closed.
  • Remote, delegated, physical, and recovery access need separate checks [1][3][6].
  • Transition records should have a new accountable owner.
  • Post-removal testing can expose surviving links and sessions.
  • Unexpected access belongs in the approved incident process [7].

Sources

  1. Security and Privacy Controls for Information Systems and Organizations, National Institute of Standards and Technology
  2. Zero Trust Architecture, National Institute of Standards and Technology
  3. Digital Identity Guidelines, National Institute of Standards and Technology
  4. Cybersecurity Supply Chain Risk Management Practices, National Institute of Standards and Technology
  5. Cybersecurity Framework 2.0, National Institute of Standards and Technology
  6. Guide to Enterprise Telework, Remote Access, and BYOD Security, National Institute of Standards and Technology
  7. Incident Response Recommendations and Considerations, National Institute of Standards and Technology
  8. StopRansomware Guide, Cybersecurity and Infrastructure Security Agency
  9. Advanced Persistent Threat Activity Exploiting Managed Service Providers, Cybersecurity and Infrastructure Security Agency
  10. Secure Your Business, Cybersecurity and Infrastructure Security Agency

Return to the Research Content library