Outside vendors sometimes need access to maintain software, phones, cameras, or specialized equipment. Their access should match the job and remain accountable to a business owner.
Approve the work and identity
Confirm the vendor through an established contact method before granting access. Record the named technician, company, task, target systems, planned time, and internal sponsor. A support email alone is not enough to authorize a new remote-access arrangement.
Limit the access
- Use an approved access method with individual identities where supported.
- Require appropriate authentication, including MFA for remote and privileged access.
- Restrict the vendor to the needed systems and services.
- Set an expiry or a scheduled removal review.
- Retain relevant access logs and change records.
Do not share the organization's main administrator account or publish a device's management interface to the internet for convenience. Send any required credentials through the agreed secure process.
Plan supervision and recovery
Agree who can authorize configuration changes and what happens if the session disrupts production. Save the relevant configuration first and identify the rollback owner. For critical changes, arrange a staff contact who can validate the result.
Close the access after the work
Obtain the vendor's changes, remaining issues, and support reference. Disable temporary accounts or permissions as planned, review unexpected activity, and update documentation. If continuing access is necessary, replace the temporary arrangement with a reviewed ongoing scope rather than leaving the original exception open indefinitely.
Get help with your network
For an existing service issue, open an AvrinTech support ticket. For an assessment or planned improvement, request a scoped proposal and review our networking services. Work, coverage, and response targets depend on your agreement.
