CYBCybersecurity

Supplier and contractor access to company systems: the door nobody controls

Remote support, shared accounts, programs installed years ago and never removed. Supplier access is one of the most exploited ways in. How to list it, limit it, log it and close it.

Strategic editorial team 12 October 2026 8 min read

Cover: “Supplier access: the door nobody controls”, Cybersecurity

The access that suppliers and outside technicians have to company systems is one of the doors attackers exploit most, because nobody owns it fully. IT grants it, purchasing signs the contract, the supplier uses it and nobody closes it. Four rules bring it under control. List every access, limit each one to specific people, systems and times, log what happens, and close it when the job is done. In Verizon’s 2026 Data Breach Investigations Report, breaches involving a third party make up 48% of the total, up 60% on the previous year.

This article looks at the question from the side of the company that opens the door. The opposite case, the supplier answering its customers’ questionnaires, is covered in our piece on NIS2 and suppliers.

Why external access in particular?

For three reasons that add up.

Responsibility is split. Whoever requested the work assumes that security is a job for IT. IT regards access as a matter for the contract. The contract often says nothing about it.

Access piles up. There is the ERP technician, the maintenance engineer for the machines, the support team for the phone system and whoever installed the CCTV. Over the years, each of them has had a way in. The jobs end. The access stays.

The tools are legitimate. In January 2023 CISA, the US cybersecurity agency, warned that attackers use ordinary remote management programs as a back door. Some portable versions run without administrator rights and without being installed, which gets them round the most common controls. To an antivirus, a support program that connects at night can look normal.

What happened when the door was open?

Three public cases show three variations on the same problem.

The supplier’s credentials. In a report dated 25 March 2014, the US Senate Commerce Committee reconstructed the breach suffered by the Target retail chain at the end of 2013. The company had given network access to a small heating, ventilation and air-conditioning contractor, and that is where the attack began. It exposed around 40 million payment cards and the personal data of up to 70 million people. The report also notes that the most sensitive systems were not sufficiently isolated.
The supplier’s tool. On 2 July 2021 a ransomware attack hit VSA, Kaseya’s remote management software, which many IT service providers use. According to Kaseya itself, around 50 direct customers were affected. Through them, between 800 and 1,500 businesses managed by those providers were hit.
A flaw in the access program. In February 2024 a vulnerability was disclosed in ConnectWise ScreenConnect, a widely used remote support program. It allowed attackers to bypass authentication (CVE-2024-1709, severity 10 out of 10). On 22 February, CISA added it to its catalogue of vulnerabilities already exploited by attackers.

The lesson is the same in every case. An organisation can look after its own systems well and still be reached through the credentials, the tools or the late updates of the people who support it.

What external access does an organisation really have?

Type of access	Example	Question to ask
Remote support programs	Installed years ago by the ERP technician and always on	Who can connect, from where, and who knows when it happens?
VPN accounts	A single “support” account used by several technicians	Which person does each account belong to today?
Accounts on systems	Administrator privileges on the ERP system or the database	Are those privileges needed all the time, or only during the job?
Cloud services	Guest or partner users with administrator rights	Who granted them, and when do they expire?
Plant and machinery	Remote-support routers on the production lines, CCTV, the phone system	Are they kept separate from the office network?
Integrations	Access keys and service accounts used by external software	Who changes them, and who would notice if they were used elsewhere?

Which rules are needed?

A single register. Every supplier with access has one entry. It lists the systems they can reach, the tools they use, the people authorised and an internal contact who answers for that access.
Named accounts and multi-factor authentication. Accounts are never shared. Without a name there is no accountability, and a shared password outlives the people who leave the supplier. Legislative Decree 138/2024 (Italy’s NIS2 law) lists multi-factor authentication among the measures required of the entities it covers. NIS2 is the EU directive on network and information security.
Access on request and for a limited time. Access opens for the job, with the internal contact’s approval, and closes at the end. Emergencies follow a written procedure, with an internal person on call.
A single point of entry. External sessions go through one controlled system, not through programs installed here and there. Unauthorised tools are detected and blocked, as CISA recommends. Authorised ones are kept up to date like any other software.
Least privilege and separate networks. The machine technician reaches the machines, not the accounting system.
Logging. In Italy, the Italian Data Protection Authority (Garante) issued a decision on 27 November 2008 covering system administrators, including external ones. It requires an up-to-date list of them with their identification details, and a review of their work at least once a year. It also requires access logs that are complete, unalterable and kept for at least six months. The criteria for keeping logs are covered in our piece on log files and reconstructing attacks.
Closure. Access is closed at the end of each job, at the end of the contract and whenever a technician leaves the supplier. A periodic review compares the register with the accounts that actually exist.

What should the contract say?

The rules hold if the supplier has accepted them in writing. The contract should provide for:

a list of the technicians by name, and an obligation to report who joins and who leaves
the access tools allowed, and a ban on installing others
the security measures required, starting with multi-factor authentication
prompt notice of any incident at the supplier
the right to audit
the closure of all access and the return or deletion of data when the relationship ends.

When the supplier processes personal data on the company’s behalf, Article 28 of the GDPR already requires a contract with some of these clauses. The supplier may engage other processors only with written authorisation. It must delete or return the data when the service ends. It must make information available to the controller and allow audits. For San Marino companies the framework is different and must be assessed case by case.

Who is accountable in the company?

Management is. For entities within the scope of NIS2, Article 23 of Legislative Decree 138/2024 requires the administrative bodies to approve how security measures are implemented and to oversee them, and it makes them accountable. Article 24 includes the security of relationships with direct suppliers among the required measures. For companies outside the scope of the law, it remains a risk decision that belongs to leadership.

The division of tasks is simple. The internal contact answers for each individual access. IT manages the register, the tools and the logs. Purchasing and legal take care of the contract clauses. The data protection officer oversees the processing of personal data. Management receives a few figures at regular intervals, namely active accesses, closed accesses and exceptions granted.

A typical scenario. A manufacturing company starts its review and finds three different remote control programs on its servers. One belongs to the ERP supplier and one to the production line maintenance contractor. The third was installed by a technician who no longer works for either of them. The VPN account called “support” is used by six people with the same password. Management decides on a single point of entry, named accounts with multi-factor authentication, access opened at the internal contact’s request and a machine network kept separate from the office network. The maintenance contractor asks for permanently open access to deal with breakdowns at night. Instead, the two sides agree an emergency procedure with an internal person on call.

Where do you start?

A list of the suppliers who support IT systems, plant and software.
A comparison with what actually exists. That means VPN accounts, remote access programs on computers and servers, guest users in cloud services and firewall rules.
Suspension of accounts with no owner, with the timing agreed with production so that nothing stops.
For every access that remains, an internal contact, multi-factor authentication, set hours and logging.
A test. A penetration test checks how far someone using a supplier’s credentials could get.

In brief

External access multiplies over the years and stays open because nobody is fully responsible for it.
Suppliers’ credentials, tools and flaws have all played a part in documented breaches.
You need a single register, named accounts, multi-factor authentication, time-limited access and a single point of entry.
The contract and the logs make the rules verifiable.
The decision belongs to management, which receives a few figures at regular intervals.

Frequently asked questions

Should a supplier you have trusted for years be treated the same way?

Yes. Trust is about people. Rules are about credentials, and credentials can be stolen from anyone. In the Target case the attack started from a supplier, not from an employee.

Should remote support programs be banned?

No. They should be chosen, authorised, kept up to date and routed through a controlled point. Unauthorised ones are detected and blocked.

How long should access logs be kept?

For system administrators, the Garante sets a minimum of six months. The actual period depends on the risk and on the rules that apply.

Does this matter for companies not subject to NIS2?

Yes. The Garante’s rules on system administrators do not depend on NIS2. And customers that are subject to NIS2 increasingly ask how a company controls its own suppliers.

Reviewing external access, running penetration tests from a supplier’s point of view and setting up incident procedures are the work of our Cybersecurity division. When the access involves Oracle databases with privileged accounts, we do the work together with our Oracle & Database Engineering division.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.