External suppliers regularly need access to your systems. But do you know who grants that access, which permissions are assigned and who checks whether they are still necessary?
External access is necessary, but not without risk
Almost every organisation works with external suppliers that need access to parts of its IT environment. A software provider supports a business-critical application, a machine manufacturer performs remote maintenance and an external specialist helps resolve technical problems. This cooperation is often essential to reliable operations. At the same time, it creates connections between organisations, systems and people who are not subject to the same day-to-day management.
In practice, external access is usually arranged in response to a specific need. A supplier has work to do, so an IT employee or external service provider makes a connection or account available. Once the support works, the access arrangement often fades into the background. There is less inclination to revisit whether the permissions remain appropriate, who manages the connection and whether the original agreements still reflect the current situation.
This reveals an important distinction between enabling access and controlling it. An organisation can have technically reliable connections yet lack a clear understanding of which external parties can reach its systems. Supplier access governance is therefore not just about securing individual connections; it is about retaining visibility, authority and control.
How supplier access gradually becomes fragmented
External access rarely develops from a single, central design. New machines are installed, applications are replaced and additional suppliers become involved in supporting business processes. A practical solution is chosen for each situation, often by different parties. Over time, the result can be a collection of VPN connections, remote management tools, supplier accounts and direct system integrations.
Each arrangement may be understandable in isolation. The risk lies in the missing overall picture when nobody maintains a complete overview. An account created for a temporary project remains active after the work is finished. A supplier receives broad administrator privileges because they make support easier. Or a connection originally intended for one machine can, in fact, reach a much larger part of the network.
As long as there are no visible problems, such arrangements can remain in place. Suppliers can do their work and operations continue uninterrupted. Yet the organisation may become dependent on access mechanisms whose scope, management or even existence it does not fully understand. That dependence often becomes apparent only when a supplier is replaced, an incident occurs or a security assessment is carried out.
Who decides on access, and who actually provides it?
Supplier access governance requires a clear distinction between different responsibilities. The organisation decides which supplier may perform work, which systems must be accessible and what risks that access entails. Technical implementation can then be assigned to an internal IT team or an external IT service provider. That party configures accounts, authentication, connections and access restrictions in accordance with the agreed requirements.
In many environments, however, this division is less clear. A machine supplier may manage its own connection to its equipment, while a software partner creates accounts independently within an application. An external service provider may also hold extensive privileges without any explicit agreement on who can approve changes to those rights. Actual authority over access can consequently shift to whoever controls the technical mechanisms.
That need not be a problem when responsibilities have been deliberately allocated and the organisation retains sufficient control. It does become a risk when nobody can establish which rights have been granted, who can change them or how access can be terminated. The last point is especially important: during an incident, at the end of a contract or when a working relationship changes, the organisation must be able to act without depending entirely on the supplier whose access needs to be revoked.
Four responsibilities for controlled access
Authorise
the organisation decides
A designated owner approves the purpose, systems involved, permitted activities and duration. The supplier explains what access is needed; the organisation assesses and accepts the associated business risks.
Configure
the IT service provider implements
The internal IT team or external service provider translates the approval into accounts, authentication, connections and isolation. The actual permissions and the method for terminating access are documented.
Monitor
the designated owner reviews
A person or team assigned in advance assesses whether permissions are still needed and whether usage remains within the agreements. The IT service provider supplies the required records; anomalies are assigned an owner and followed up.
Revoke
the organisation retains the ability to intervene
Define who can decide on routine termination and emergency blocking, and who implements each decision. The IT service provider terminates the relevant accounts, permissions, connections and active sessions, then confirms that the supplier no longer has access. Agree the implications for production and support in advance.
One party may perform several tasks. For each task, document who decides, who implements and who reviews, so that authority does not silently shift to the supplier.
Responsibility remains with the organisation
Outsourcing technical management does not automatically transfer every business risk to the service provider. A supplier may be responsible for maintaining a machine or application, but will not usually have a complete picture of the interconnected processes and systems across the organisation. The customer must therefore be able to assess the potential consequences of the access granted beyond the supplier's immediate area of work.
This becomes clear in a production environment. A machine supplier may have a legitimate reason to perform remote maintenance, but that does not automatically justify access to other machines, office workstations or central servers. If a connection is not sufficiently isolated, a security issue at one external party can affect systems beyond its maintenance responsibilities. The technical design of access therefore helps determine the potential impact on business operations.
Good supplier access governance is not a sign of distrust. Suppliers also benefit when permitted activities, available rights and activity records are clearly defined. Clear boundaries reduce misunderstandings and make it easier to distinguish responsibilities when events do not unfold as expected.
Risk management comes first
Every organisation has an interest in understanding and managing its digital risks. That need does not arise from legislation, but from dependence on IT for everyday work, service delivery and business continuity. Supplier access deserves particular attention because an organisation's systems may depend in part on the security, working practices and employees of external parties.
A sound assessment therefore starts not with which technical connection is possible, but with what the system means to the organisation. Access to a test environment generally calls for different measures from access to a production line, financial system or central infrastructure. The likelihood of misuse and the security of the connection matter, but so do the consequences of disruption, unauthorised changes or loss of confidential information.
This approach is also reflected in the Dutch Cybersecurity Act (Cyberbeveiligingswet). For organisations within its scope, it includes principles concerning risk management, access policies and supply-chain security. The legislation thus reinforces the value of an approach that also makes sense beyond its legal scope: systematically assessing digital risks and implementing appropriate safeguards.
The relevant question for an organisation is therefore not simply whether it must comply with a legal requirement. More important is whether it understands the risks associated with its supplier connections, knows who is responsible for managing them and can establish whether the chosen measures work in practice.
What a production environment reveals
Consider a manufacturer that relies on several machine and software suppliers for maintenance and support. One uses its own VPN connection, another works through a remote management tool and a third has access to a server connecting multiple systems. These arrangements were introduced at different times and are not necessarily managed by the same party. In day-to-day operations, this may cause no noticeable difficulties.
The situation changes when the company tries to determine which external parties can actually access its production environment. Documentation may be scattered, some accounts may have existed for years and it may not always be clear which systems are reachable through a given connection. There may also be uncertainty about who can disable an account or what disconnecting a supplier would mean for maintenance and support.
The example shows that supplier access governance is not merely a technical concern. Without an overview, an organisation struggles to assess which risks it is accepting and whether existing arrangements are appropriate. This deserves ongoing attention, particularly where uninterrupted production or service delivery is important.
remote maintenance of a production machine
Illustrative example
A machine supplier wants to investigate a fault in a production machine remotely. The supplier needs access to that machine's control system. Access to other production lines, office workstations or central servers is not required for this assignment.
- Agreement
The designated owner at the manufacturer approves the work and a maintenance window. The required activities and their implications for production and safety are agreed with the supplier.
- Execution
The IT service provider makes an individual account with strong authentication available and restricts the connection to the required machine and services. Access is activated only for the agreed maintenance window; relevant access activities are recorded.
- Review
The designated owner and IT service provider review whether usage remained within the assignment. If an anomaly occurs, a person authorised in advance can have access blocked, taking the implications for production into account.
- Closure
Once the work is complete, temporary permissions and active sessions are terminated, and it is verified that the supplier no longer has access.
The key point: the supplier performs the maintenance; the manufacturer sets the boundaries and retains authority over access. The precise controls must suit the machine, maintenance capabilities and business risks.
This is a fictional scenario for illustration, not a customer case or a description of results achieved by Malenco.
From technical arrangements to controlled access
A manageable approach begins with the principle that suppliers receive access only to what they need for their work. This requires agreements on the systems involved, permitted actions, duration of access and responsibilities. Technical controls must then support those agreements so that actual access is no broader than intended.
Different measures may be appropriate depending on the environment. Individual accounts and strong authentication help identify who is using access, while network segmentation can limit which systems are reachable through a connection. Time-limited access can prevent permanent connections from remaining available for work performed only occasionally. Centralised remote-access facilities can also reduce dependence on separate supplier-managed solutions.
Not every organisation needs the same setup. A small office with a few software suppliers faces different requirements from a manufacturer with dozens of machines and specialised maintenance partners. The aim is therefore not to deploy as many security measures as possible, but to choose controls that match business risks and can actually be managed.
Control requires more than logging
Recording external access is valuable, but a log file alone does not provide control. If nobody identifies relevant activities or reviews anomalies, useful information may go unused. Effective governance therefore combines technical records, clear responsibilities and a process for investigation and follow-up.
Regular reviews of existing rights are also essential. Suppliers change, maintenance contracts end and systems take on different roles. Access that was necessary a few years ago may now be redundant or excessive. By periodically reassessing rights and connections, an organisation can prevent historic decisions from silently shaping its current risk exposure.
The ability to act quickly during an incident deserves particular attention. If a supplier account may have been compromised, it must be clear who is authorised to block access, which technical options are available and which business processes could be affected. Such a response is only genuinely useful if the organisation has established in advance how to carry it out.
A practical approach to supplier access governance
For many organisations, improvement begins with visibility. Rather than immediately replacing every existing connection, first establish which suppliers have access, which systems they can reach and how that access is managed. Each connection can then be assessed to determine whether its permissions match the work being performed and the risks associated with the system concerned.
The next step is to assign decision-making and technical implementation clearly. Who approves new access, who configures it and who checks compliance with the agreements? It must also be documented how changes are processed and how access is revoked when a working relationship ends. Where necessary, technical controls can be adjusted to restrict permissions more effectively and make activity more visible.
This does not have to happen across the entire organisation at once. It is often sensible to begin with suppliers that can access the most critical systems, then apply the lessons more widely. Step by step, this creates a manageable situation in which the organisation not only understands its dependencies but can actively control the risks associated with them.
Who is ultimately in control?
External suppliers remain an important part of modern IT environments. Their specialist knowledge and support are often essential to keeping systems reliable. That is precisely why access should not be governed solely by technical convenience or historic arrangements, but by a considered assessment of business risks.
The essence of supplier access governance is that the organisation knows who has access, why it is needed, who manages it technically and how it can be monitored or terminated. Not every connection needs to be configured in the same way, but every connection must fit within clear responsibilities and a manageable process.
Ultimately, the question is not only whether your suppliers can access the right systems, but whether your organisation retains control over that access.
