Supplier and third-party access audit

Why run this

What this checklist is for

Public sector organizations work with many suppliers, and each one that reaches your systems extends your attack surface into an organization whose security you do not control.

This audit is about knowing the extent of that, which most organizations have never established.

Run it with

CIO or Head of Digital

And with

Security and identity teams

And with

Procurement and contract managers

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Inventory

Establishing who actually has access.

A complete list exists of third parties with any access to your systemsCompiled from the directory rather than from procurement records, which are usually incomplete.
Each entry names a supplier, a purpose and an internal ownerAccess with no internal owner cannot be reviewed and will not be revoked.
Access granted for projects that have ended is identifiedThe single most common finding, and the easiest to remediate.
Supplier-to-supplier access is identified where it existsOne supplier granting another access on your behalf, which happens more than most organisations realise.
Remote support and vendor maintenance access is includedEquipment vendors with standing remote access are a well-documented intrusion path.

Section 2

Controls

Whether the access is appropriately constrained.

Third-party accounts require multi-factor authentication without exceptionSupplier accounts are frequently exempted for convenience and are the accounts most likely to be phished.
Access is scoped to the minimum required, not to a general roleA supplier granted an administrative role because it was quicker is a standing risk.
Time-bound access is used rather than standing permissionsExpiry that happens automatically is the only kind that reliably happens.
Third-party activity is logged and the logs are retainedYou will need this during an incident and you cannot create it retrospectively.
Conditional access restricts where and how third parties connectLocation and device conditions applied to supplier access are proportionate and rarely implemented.

Section 3

Contract and assurance

Whether the obligations are written down.

Security obligations are in the contract, not only in a policyA policy the supplier has not signed is not an obligation.
Breach notification requirements and timescales are specifiedIncluding how quickly they must tell you, which is the clause most often missing.
Subcontracting is addressed and requires your agreementYou should not learn about a supplier's supplier from an audit log.
The right to audit or receive assurance evidence existsCertification, penetration test summaries or a completed questionnaire on a defined cadence.
Exit provisions cover data return and access revocationIncluding the timescale, which should not be open-ended.

Section 4

Ongoing management

Whether this stays current.

Access is reviewed on a defined cadence with recorded outcomesA review that changed nothing still needs a record showing it happened.
Contract end triggers an access revocation processLink the two. Contract expiry and access expiry should not be independent events.
Supplier security incidents are tracked and assessed for impact on youA supplier breach is your incident if they hold or reach your data.
A supplier compromise is included in your incident response scenariosIt is one of the more likely scenarios and one of the least rehearsed.
Somebody is accountable for third-party riskSplit between procurement and IT usually means owned by neither.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

No complete inventory

Build it from the directory rather than from procurement records. The gap between the two is itself the finding.

Supplier accounts exempt from MFA

Close the exemption. These are among the most targeted accounts you have and the exemption is almost always for convenience.

Standing rather than time-bound access

Move to time-bound. Access that must be manually revoked depends on somebody remembering after a project ended.

Ownership split between procurement and IT

Name one accountable person. Shared ownership of third-party risk reliably means nobody reviews it.

Want a second opinion on your score?

We will build the third-party access inventory from your directory and produce a prioritised remediation list, which usually starts with a number nobody expected.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

azure

public-sectorReadiness

Cloud migration readiness checklist

Twenty checks covering the governance, procurement and technical questions a council review will ask.

June 27, 2026 · 20 checksOpen

purview

public-sectorReadiness

Records compliance audit

Whether your retention schedule is operating or merely documented, across twenty specific checks.

April 25, 2026 · 20 checksOpen

power-bi

public-sectorReadiness

Public reporting publication readiness

Twenty checks before publishing spending or performance data, covering accuracy, accessibility and the questions members will ask.

December 13, 2025 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Inventory

Controls

Contract and assurance

Ongoing management

Read this against the number above

If you could not tick these, start here

No complete inventory

Supplier accounts exempt from MFA

Standing rather than time-bound access

Ownership split between procurement and IT

Want a second opinion on your score?

Related checklists

Cloud migration readiness checklist

Records compliance audit

Public reporting publication readiness

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email