How to manage access control for external personnel 

Why is this important 

For many businesses, external personnel need access to company owned resources like physical assets, information, intellectual property (IP), financial information, SaaS-solutions, and line-of business systems.

These external parties are can be amongst 

• Auditors

• Accountants

• Consultants

• Investors

• Marketing agencies / bureaus

• IT-operations partners

• Outsourcing partners

• Lawyers / Legal advisors

• … And even temporary employees and board members 

With a wide range of different resources exposed to external personnel and partners - keeping control of both who have access, as well as what they have access to is crucial for any company with both tangible and intangible assets.

Why is this difficult? 

When granting access to external partners you often have other mechanisms for managing these partners as well as access management compared to other scenarios. The main reasons for why this is difficult to manage are

• External parties and vendors will often not follow the same onboarding and control routines as internal employees. They do not follow the usual onboarding and off boarding routines and check lists.

• Turnover / turnaround of personnel amongst external companies like auditors, accountants, consultancy companies as well as marketing agencies are often high. This leads to the need of a higher frequency of auditing. Ironically, the frequency for auditing is usually lower for external parties compared to own employees.

• Lack of transparency or lack of notification routines when people in external companies change roles or leave the external company 

• Vendor management of the different external parties scattered across the company, with varying level of awareness around security aspects like access management amongst the owners of the contracts or the day-to-day coordinator of the external party

• Aspects around security and access management might be lacking in the contracts between the company and the external party, thus creating lack of awareness as well as hinder the flow of information between the external party and your company

To sum it all up, it is easy to see that management of access to company’s resources is hard enough for your own employees. By adding external parties, the complexity is magnified ten times and the consequences with an even higher multiplier due to both internal and external reasons. 

What are the consequences

Given the wide variations in what external personnel and partners have access to - there are several risk and consequences of not having sufficient control of the accesses they have to the company’s resources. 

Some of the consequences and risk are

• Breach of regulatory requirements and compliance, including breach of GDPR.

• Disclosure of market sensitive information to unauthorized personnel 

• Compromise of HR and confidential employee data

• Loss of intellectual property

In worst case, the lack of proper control might end up in Cybr-security incidents causing large data breaches, loose of information or exposure to ransomware.

How to manage access control for external personnel

This chapter is still under consideration. In the meanwhile, feel free to register for Concid’s Beta program.

Concid is a solution which addresses all these pain points and gives you hassle free resource and access management, even for of external personnel