Chapter 24 — Supplier and third-party access

Chapter 24 — Supplier and third-party access

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Listing supplier access"]
  N2["24.2 Remote support"]
  N3["24.3 Contracts"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Listing supplier access"]
  N2["24.2 Remote support"]
  N3["24.3 Contracts"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Listing supplier access]
    |
    v
[24.2 Remote support]
    |
    v
[24.3 Contracts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) list supplier access; (2) control remote support; (3) review contracts for identity terms.

24.1 Listing supplier access

Several suppliers have access: the practice management supplier's support team, the payroll provider and an equipment maintenance company that connects to the X-ray workstation. Kai lists each with the accounts used, systems reached and the Fernhill person responsible. He finds that the maintenance company uses a permanent remote access account with a password unchanged for years. Supplier access is often invisible to internal reviews, so listing it explicitly is the first control. The list is reviewed with each access review. Each supplier contact is named.

24.2 Remote support

Kai changes remote support so suppliers request access each time, a Fernhill staff member approves it for a set period, and sessions are recorded where the tool allows. The maintenance company's permanent account is disabled and replaced with approved sessions using individual named accounts with multi-factor authentication. Kai explains to the supplier that this protects both organisations, since actions are traceable to named engineers and access is not left open between visits. The approval steps are added to the runbooks. Session records are kept for the agreed log period.

24.3 Contracts

At contract renewal, Kai asks the practice manager to include identity terms: the supplier must use named accounts, multi-factor authentication, notify Fernhill when engineers leave and support single sign-on where possible. He records which contracts have these terms and which do not yet. Contract terms turn good practice into agreed expectations, giving Fernhill a basis to ask suppliers for improvement rather than relying on goodwill. Kai keeps the list of contracts and terms in the documentation index. The practice manager reviews it before each renewal. Suppliers without terms are noted as gaps.

Worked example

Three suppliers are listed; the maintenance company's permanent account is replaced by approved named sessions with MFA.

Synthetic case. Suppliers and accounts are synthetic.

Errors and limits

Permanent supplier accounts with unchanged passwords leave access open between visits.

Exercises

• EX070 — Permanent account. What was wrong with the maintenance company's access? Rubric: 3 = permanent account with unchanged password;; 2 = permanent;; 1 = vague;; 0 = none.
• EX071 — Remote approval. How is remote support now granted? Rubric: 3 = requested each time, approved for a set period;; 2 = approved;; 1 = always on;; 0 = none.
• EX072 — Contract term. Name one identity contract term. Rubric: 3 = notify when engineers leave;; 2 = named accounts;; 1 = price;; 0 = none.

Synthesis

Listed, approved and contracted supplier access keeps third parties accountable.

Continue studying — chapter 24 of 30

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →