Review supplier access when the work ends

What this means for your practice

Coordinate access review across the agreed service inventory using approved security procedures. Confirm ongoing support arrangements before removing access that remains necessary.

How to review the arrangement

Compare a fictional offboarding request with accounts, connections and administration records. What would the original list miss? Assign each removal or continuing permission to the authorised system owner. Record completion so the incoming team can distinguish an agreed retained account from one simply overlooked.

Review access against the service actually used

Start with the current list of website, hosting, domain, reporting and connected-service accounts. Identify where the outgoing supplier or its team members have access and which arrangements continue under an agreed support role. The authorised system owners should decide and carry out changes through the organisation's normal security process.

Include access used by connections or publishing tools, not only named people appearing on an obvious user list. Ask the responsible supplier to explain those dependencies so removing obsolete access does not accidentally break a service that still needs it. Record which items have been reviewed, which changes are complete and which permissions deliberately remain. During handover, compare that record with the incoming team's understanding of responsibility. A completed meeting or contract end date does not automatically update every account. The practical aim is a documented arrangement based on current work, with someone able to explain and review each remaining exception.

How to check the result

Track obsolete supplier access awaiting review or removal by authorised owners.