Controlling Vendor Access for Small Businesses

A security policy is an important piece to securing an organization, but without including vendors, it may just be a document on the shelf. Securing any infrastructure can be difficult especially for small businesses that rely on outsourced consultants for services. Many times controlling how much access vendors have and how they provide service can be problematic due to contracts, access needed and lack of IT knowledge from management. Following a systematic approach and developing the proper methods and checks, small businesses can be just as successful implementing a policy that is used specifically by outside consulting staff. The information gathered within this document will include a vendor questionnaire, a policy template and considerations for implementing such a policy for stakeholders who may lack the appropriate technical knowledge. Using the techniques in this document, small organizations will be able to move towards a more secure environment that reduces their risk, maintains relationships while also protecting their data.