How to manage contractors' access to your systems

Who counts as a contractor

Small businesses rely on more outside people than they realise. The bookkeeper who logs in to Xero, the payroll bureau, the marketing agency editing the website, the developer who built the booking system, the software vendor's support team, the casual designer working on brochures, the IT provider itself. Each of them has some form of access, and each is a possible route into the business if their own security is weak.

The problem is rarely the contractors themselves. It is that access is granted in a hurry, often by sharing an existing login, and never reviewed. Three years later, a marketing agency you stopped using still has admin rights on the website, and a former bookkeeper can still see the bank feed.

Named accounts, never shared ones

Every outside person should have their own login, not a staff member's password or a shared office account. In Microsoft 365 and Google Workspace you can invite contractors as guests to specific Teams, SharePoint sites or shared drives, so they use their own organisation's account but only see what you share. For systems like Xero, payroll software and website platforms, add them as a separate user with their own role. Named accounts mean you can see what each contractor did, require multi-factor authentication for them, and remove one person without affecting anyone else. If a contractor insists on using a staff member's login because it's quicker, that is a sign the access hasn't been thought through.

Give the least access that does the job

Before granting access, ask what the contractor actually needs to do. A bookkeeper reconciling accounts may need full access to the accounting system but nothing in SharePoint. A web developer needs the website platform and possibly DNS, but not your email. A designer may only need one shared folder. Start narrow and widen if needed; it is much harder to claw back access once it's been granted.

Be especially careful with admin rights. Contractors occasionally ask for global admin in Microsoft 365 to set up an integration or a new app. Often a more limited admin role will do, or your IT provider can make the change on their behalf. If admin rights are genuinely needed, grant them for the duration of the task and remove them afterwards.

Remote access tools and vendor support

Software vendors often ask to install remote access tools so they can support their product. That is reasonable, but it needs managing. Prefer tools where you or your staff approve each session, rather than unattended access that is always on. Know which vendors have tools installed on which machines, and remove the tool when the support relationship ends. Never allow a contractor to connect a personal device to the office network without checking with whoever manages IT. A guest Wi-Fi network that is separate from the main network is the easiest way to give visitors internet access without exposing your servers, printers and staff computers.

Write it into the agreement

Your contract or engagement letter with each contractor should cover how they protect your data. At a minimum: they will keep your information confidential, use multi-factor authentication on accounts that access your systems, tell you promptly if they suffer a security incident that could affect you, and return or delete your data when the work ends. Under the Privacy Act 2020, the business remains responsible for personal information it shares with a contractor, so it is worth making those expectations explicit.

For contractors who handle sensitive data, such as payroll bureaus or health system vendors, ask how they secure their own systems, and note their answers in your contractor register. A short questionnaire or a conversation about MFA, backups and staff training is reasonable and most reputable firms will answer readily.

Keep a register and review it

Maintain a simple list of every outside person or company with access: who they are, what systems they can reach, who approved it, and when the access should end. Add an end date even for open-ended relationships, so the access comes up for review rather than running forever. Microsoft 365 can also be set to review guest access periodically.

Once a quarter, walk through the register with the IT owner. Remove anyone who no longer needs access and confirm the rest are still appropriate. When a contractor relationship ends, treat it like a staff leaver: remove the accounts, revoke remote access tools, change any shared credentials they knew, and collect any business devices. It is a small amount of work that closes one of the most common ways small businesses are breached.