Who else can get into your systems?

Why it matters

Many well-known breaches started with a supplier: the Target breach began with a heating and air conditioning contractor’s access. Suppliers often get remote access to help with their own products and then keep it for years, with shared passwords and no second sign-in step.

Checklist

• List every outside party with access to your network, servers, Microsoft 365 or business software: vendors, contractors, former IT providers.
• For each, note what they can reach, how they connect and who in your business approved it.
• Give each its own account. No shared logins, so you can see who did what and remove one supplier without affecting the others.
• Require multi-factor authentication on every outside account.
• Limit what they can reach to the systems they support.
• Turn access on when needed, and off afterward, where possible.
• Remove access straight away when a contract ends or a supplier changes.
• Review the list at least once a year.
• Ask suppliers how they protect their own systems and the access they hold to yours.