How do we review access to a system a supplier runs for us?

Start

A supplier hosts or runs one of your in-scope systems

A hosted system is reviewed like any other, including the supplier's own accounts on it. Outsourcing the running of the system does not outsource the decisions. What changes is who takes the extract, who makes the removals, and how long each takes.

• Then: Does the contract fix the extract and the removal times?

Decision

Does the contract fix the extract and the removal times?

The contract should set the extract's format and date, and removal times that fit your windows: 1 working day for privileged access and 5 for the rest in the pack's defaults. The pack's supplier clause also has the supplier remove its own leavers' access promptly and review its staff's access regularly. If you have not checked the contract, answer no.

• Yes: Request the extract early enough to be dated on extract day
• No, or not known: Agree extract and removal times with the supplier before launch

Step

Agree extract and removal times with the supplier before launch

Agree them before the campaign starts, not after the decision date. Record the lead time the supplier needs to produce an extract. Put the terms into the contract at the next change or renewal, so they stop depending on goodwill.

• Then: Request the extract early enough to be dated on extract day

Step

Request the extract early enough to be dated on extract day

Raise the supplier's ticket far enough ahead that the extract carries the campaign's extract date. Ask for every account, including the supplier's own support accounts, with role, permissions and last sign-in, as a dated file. A statement that the review was done is not an extract.

• Then: Does the extract reconcile and include the supplier's accounts?

Decision

Does the extract reconcile and include the supplier's accounts?

Check the counts yourself against the count the system shows. Third-party accounts must be present and marked as such. If the report uses role codes, get a translation so line managers can read the permissions.

• Yes: Keep the reviewers and the decisions inside your organisation
• No, or not known: Ask for it again; do not review a partial list

Step

Ask for it again; do not review a partial list

An extract that fails the completeness check is taken again, not reviewed. Escalate a missing or incomplete extract to the system owner, then the Head of Information Security. If it cannot be completed this campaign, the system is left out and the gap is raised as a finding.

• Then: Does the extract reconcile and include the supplier's accounts? (back to an earlier step)

Step

Keep the reviewers and the decisions inside your organisation

Line managers review their own staff. The system owner reviews the permissions and every privileged, generic, service and third-party account, and information security reviews the privileged ones again. A supplier never reviews its own staff's access. A support account is kept on evidence of a current contract, recent use and a named owner on your side.

• Then: Raise the removals with the supplier by ticket on decision day

Step

Raise the removals with the supplier by ticket on decision day

One ticket per system, listing every Revoke and Modify with its entry reference, marked privileged or standard, with its due date. The windows start on the decision date. Ask the supplier to confirm each removal on the day it is made.

• Then: Can the supplier remove the access within its window?

Decision

Can the supplier remove the access within its window?

Compare the supplier's normal turnaround with each window. In the pack's example, the ERP provider acts on a removal ticket in 5 working days, which fits standard access and misses the privileged window of 1 working day. If you do not know the turnaround, assume it does not fit.

• Yes: Confirm every removal on a fresh extract
• No, or not known: Tell the system owner and the contract's manager before it lapses

Step

Tell the system owner and the contract's manager before it lapses

A removal that cannot be made in time is escalated to the system owner, and a supplier's delay also to the manager of that contract, before the window ends, so it is tracked rather than missed. Where you can, disable the account yourselves in the meantime; the pack gives that as an example interim fix.

• Then: Confirm every removal on a fresh extract

Step

Confirm every removal on a fresh extract

Take or request a fresh extract after the windows end and check each removed access has gone. A closed supplier ticket shows someone was asked; the extract shows the access has gone. Record the date each access was removed and the date it was confirmed.

• Then: Were any removals late because of the supplier?

Decision

Were any removals late because of the supplier?

A removal is late when the access went after its window. Count it late even when it has since been confirmed. Late removals lower the campaign's on-time removal measure.

• Yes: Raise a process weakness and fix it in the contract
• No: Report the system with the rest of the campaign

Outcome

Raise a process weakness and fix it in the contract

When the supplier's removal time does not fit the window, either the contract or the window must change. Record it as a process weakness owned by whoever owns the contract, with a fix and a date. Do not quietly widen the window. Link it to the supplier's entry in your supplier risk register, where its agreed removal times belong.

• Then: Report the system with the rest of the campaign

Outcome

Report the system with the rest of the campaign

The supplier-run system appears in the campaign report like any other. Name any supplier that could not meet the removal windows, and the effect, in the report's section on supplier-run systems.