Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we review access to a system a supplier runs for us?

4 decision pointsThe pack behind this answer: User Access Review

Add to board memo

The short answer

Recommendation
Review it like any other system. The supplier takes the extract and makes the removals, while the system owner, the reviewers and the decisions stay in your organisation, and you confirm every removal on a fresh extract.
Reasoning
Outsourcing the running of a system does not outsource the decisions. The supplier's own support staff are third-party accounts on your system and are reviewed like any other. What changes is who takes the extract, who removes access and how long each takes. The supplier's removal time is part of your window: in the pack's example, a provider taking 5 working days misses the 1 working day privileged window, and that becomes a process weakness to fix in the contract.
Considerations
  • The windows of 1 working day for a leaver's account and privileged access and 5 for the rest are the pack's defaults. The contract has to match whichever windows you use.
  • A supplier never reviews its own staff's access. Keep a support account only on evidence of a current contract, recent use and a named owner on your side.
  • When the supplier cannot meet a window, change the contract or the window (AR-11). Do not quietly widen the window.
  • A closed supplier ticket shows someone was asked. Only a fresh extract shows the access has gone (AR-07).

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartA supplier hosts or runs one of your in-scope systemsDecisionDoes the contract fix the extract and the removal times?StepAgree extract and removal times with the supplier before launchStepRequest the extract early enough to be dated on extract dayDecisionIs the extract complete and accurate, with the supplier's accounts?StepAsk for it again; do not review a partial listStepKeep the reviewers and the decisions inside your organisationStepSend leaver and privileged removals the day each is decidedDecisionCan the supplier remove the access within its window?StepTell the system owner and the contract's manager before it lapsesStepConfirm every removal on a fresh extractDecisionWere any removals late because of the supplier?OutcomeRaise a process weakness and fix it in the contractOutcomeReport the system with the rest of the campaign

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    A supplier hosts or runs one of your in-scope systems

    A hosted system is reviewed like any other, including the supplier's own accounts on it. Outsourcing the running of the system does not outsource the decisions. What changes is who takes the extract, who makes the removals, and how long each takes.

    In the pack

  2. Decision

    Does the contract fix the extract and the removal times?

    The contract should set the extract's format and date, and removal times that fit your windows: 1 working day for a leaver's account and privileged access and 5 for the rest, in the pack's defaults. The pack's supplier clause also has the supplier remove its own leavers' access promptly and review its staff's access regularly. If you have not checked the contract, answer no.

    In the pack

  3. Step

    Agree extract and removal times with the supplier before launch

    Agree them before the campaign starts, not after the decision date. Record the lead time the supplier needs to produce an extract. Put the terms into the contract at the next change or renewal, so they stop depending on goodwill.

    In the pack

    See also

  4. Step

    Request the extract early enough to be dated on extract day

    Raise the supplier's ticket far enough ahead that the extract carries the campaign's extract date. Ask for every account, including the supplier's own support accounts, with role, permissions and last sign-in, as a dated file, sent by the supplier direct to your evidence location, with the report name and every filter used. A statement that the review was done is not an extract.

    In the pack

  5. Decision

    Is the extract complete and accurate, with the supplier's accounts?

    A matching count shows only that your extract and the supplier's system agree on rows. Have the supplier send the output direct to your evidence location, or watch the run. Keep the report name and filters, compare a second source such as the supplier's list of its staff accounts, and re-check a sample of entries. Third-party accounts must be present and marked as such. If the report uses role codes, get a translation.

    In the pack

  6. Step

    Ask for it again; do not review a partial list

    An extract that fails the completeness check is taken again, not reviewed. Escalate a missing or incomplete extract to the system owner, then the Head of Information Security. If it cannot be completed this campaign, the system is left out and the gap is raised as a finding.

    In the pack

  7. Step

    Keep the reviewers and the decisions inside your organisation

    Line managers review their own staff. The system owner reviews the permissions and every privileged, generic, service and third-party account, and information security reviews the privileged ones again. A supplier never reviews its own staff's access. A support account is kept on evidence of a current contract, recent use and a named owner on your side.

    In the pack

    See also

  8. Step

    Send leaver and privileged removals the day each is decided

    A leaver's account, and any privileged Revoke or Modify, goes to the supplier the day it is decided, due within 1 working day of that decision. All other access goes in one ticket per system on the decision deadline (day 10), listing every Revoke and Modify with its entry reference, due within 5 working days of it. The deadline window is never a reason to wait. Ask the supplier to confirm each removal the day it is made.

    In the pack

  9. Decision

    Can the supplier remove the access within its window?

    Compare the supplier's normal turnaround with each window. In the pack's example, the ERP provider acts on a removal ticket in 5 working days, which fits standard access and misses the privileged window of 1 working day. If you do not know the turnaround, assume it does not fit.

    In the pack

  10. Step

    Tell the system owner and the contract's manager before it lapses

    A removal that cannot be made in time is escalated to the system owner, and a supplier's delay also to the manager of that contract, before the window ends, so it is tracked rather than missed. Where you can, disable the account yourselves in the meantime; the pack gives that as an example interim fix.

    In the pack

  11. Step

    Confirm every removal on a fresh extract

    Take or request a fresh extract after the windows end and check each removed access has gone. A closed supplier ticket shows someone was asked; the extract shows the access has gone. Record the date each access was removed and the date it was confirmed.

    In the pack

  12. Decision

    Were any removals late because of the supplier?

    A removal is late when the access went after its window. Count it late even when it has since been confirmed. Late removals lower the campaign's on-time removal measure.

    In the pack

  13. Outcome

    Raise a process weakness and fix it in the contract

    When the supplier's removal time does not fit the window, either the contract or the window must change. Record it as a process weakness owned by whoever owns the contract, with a fix and a date. Do not quietly widen the window. Link it to the supplier's entry in your supplier risk register, where its agreed removal times belong.

    In the pack

    See also

  14. Outcome

    Report the system with the rest of the campaign

    The supplier-run system appears in the campaign report like any other. Name any supplier that could not meet the removal windows, and the effect, in the report's section on supplier-run systems.

    In the pack

Practical checklist

  1. Check the contract fixes the extract format and date, and removal times that fit your windows. If not, agree them before launch.
  2. Request the extract early enough to carry the campaign's extract date, including the supplier's own accounts.
  3. Test the extract yourself: the supplier sends the output direct to your evidence location or the run is witnessed, the filters are recorded, a second source is compared and a sample is re-checked. Ask again if it fails.
  4. Keep the review with your line managers, the system owner and information security.
  5. Send leaver and privileged removals to the supplier the day each is decided; raise one ticket per system for the rest on the decision deadline, each entry with its due date.
  6. Escalate any removal that will miss its window to the system owner and the contract's manager before it lapses.
  7. Confirm every removal on a fresh extract, and record the date removed and the date confirmed.
  8. Raise late removals caused by the supplier as a process weakness with an owner, a fix and a date.

Evidence to have ready

  • The dated extract as received from the supplier, with the report settings and the results of your own completeness and accuracy tests.
  • The removal tickets with dates raised and done, and the fresh extract confirming each removal.
  • Each process weakness for a supplier that missed a window, with its owner, fix and date.
  • The contract's extract and removal terms, linked to the supplier's entry in your supplier risk register.

Assumptions

  • The supplier hosts or operates a system that is in scope for your access review.
  • The removal windows shown are the defaults in the CISO Times access review pack. Your own method may set different ones, and the contract has to match whichever you use.

Not covered here