Vendor and contractor accounts outlive contracts, share passwords and bypass MFA far more often than employee accounts, yet most organisations only discover this after a supplier incident. This health check is a recurring audit of the access that third parties actually hold in your environment: ten metrics on sponsorship, contract alignment, MFA, shared accounts, session recording, dormancy, reviews, just-in-time access, remote tools and offboarding. Each metric has a formula, a data source type, thresholds, an owner and a cadence, with a findings log and a remediation map. It is run by the IAM or privileged access team and signed off by the access governance owner. How to design third-party access is covered in the Third-Party Access Guide; this page tests whether that design holds in practice.
What this health check covers
Scope is every identity used by a person who is not your employee: vendor support engineers, contractors, consultants, managed service provider staff and partner users, whether they hold a directory account, a guest account, an application-local account or a privileged remote session. It measures access outcomes in your own systems. It does not score a supplier's own security posture through questionnaires or assurance reports; that is the job of the TPRM Programme Health Check, and the two pages share no metrics.
The Third-Party Access Guide lists the metrics that show progress in direction only. This page fixes each one as a numerator over a denominator with green, amber and red bands, so two reviewers get the same answer. If you searched for a third party access review, a vendor access audit checklist or contractor access KPIs, this is the working run sheet. Machine credentials issued to vendors, such as API keys and OAuth apps, are measured separately in the Third-Party Credential Register Template.
Key takeaways
- Every external account needs a named sponsor and an end date: without both, no other metric can be trusted, because nobody is accountable for removing access.
- The contract is the denominator for offboarding: compare active accounts to contract end dates, not to HR records, which rarely hold contractors and never hold vendor staff.
- Shared vendor accounts break attribution: count them and drive the number to zero, because MFA, recording and reviews all assume one person per account.
- Standing vendor access is the exposure: the just-in-time share and the remote tool count show how much access is available when nobody is working.
- Thresholds are starting points: the bands are NHI Mgmt Group recommendations; adjust them to your risk appetite and record why.
How to use this template
Build the third-party identity population first: join directory, guest, application-local and privileged access accounts to the vendor and contract register so every account maps to a supplier, a sponsor and a contract. Then run each metric at the cadence below, score it against the bands, and log every amber or red result in the findings log with an owner and a due date. Keep each completed run; the trend in dormant and post-contract accounts shows whether the sponsor process is working.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Post-contract and dormant account sweep (TA-02, TA-06) | Monthly | IAM operations | Access governance owner | Contract register extract, account extracts, disable records |
| Privileged vendor session review (TA-05, TA-08) | Monthly | Privileged access team | Access governance owner | Session broker logs, recording index, sample review notes |
| Full metric run (TA-01 to TA-10) | Quarterly | Access governance owner | CISO | Metric workbook, third-party identity population snapshot, findings log, sign-off |
| Sponsor attestation campaign (TA-07) | Quarterly for privileged, six-monthly for others | Identity governance lead | Internal audit | Campaign decisions with timestamps, revocation evidence |
| Vendor remote tool inventory (TA-09) | Six-monthly | Endpoint and network security | CISO | Software inventory and network flow evidence for remote access tools |
Metrics
The population is every enabled account or access path held by a non-employee person. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| TA-01 | Third-party accounts with sponsor | Enabled third-party accounts with a named, currently employed sponsor and a recorded end date / enabled third-party accounts | Directory and guest account attributes; contractor or vendor register; HR record for the sponsor | ≥ 98% | 90% to below 98% | < 90% |
| TA-02 | Expired contract with active access | Count of enabled third-party accounts or access paths whose contract, purchase order or statement of work has ended | Contract register joined to account extracts | 0 | 1 to 5, all under 7 days past end | > 5, or any 7 days or more past end |
| TA-03 | Vendor MFA coverage | Third-party accounts for which MFA is enforced at every sign-in path (including remote access and guest sign-in) / enabled third-party accounts | IdP policy assignments and exclusions; remote access gateway configuration; sign-in logs | 100% for privileged, ≥ 98% overall | 95% to below 98% overall | < 95% overall, or any privileged account without MFA |
| TA-04 | Shared vendor account count | Count of accounts used by more than one third-party individual (generic support logins, team accounts), excluding registered break-glass accounts | Account naming review; sign-in logs showing concurrent or multi-location use; vendor attestation | 0 | 1 to 3, each registered with a removal date | > 3, or any unregistered |
| TA-05 | Session recording on vendor access | Third-party privileged sessions brokered and recorded / third-party privileged sessions observed (broker plus direct connections found in network or host logs) | Session broker logs and recording index; firewall and host remote login logs | ≥ 98% | 90% to below 98% | < 90% |
| TA-06 | Dormant vendor account rate | Enabled third-party accounts with no successful sign-in in 60 days / enabled third-party accounts | Directory, IdP and application last sign-in attributes | ≤ 5% | Above 5% to 15% | > 15% |
| TA-07 | Access review completion | Third-party access items certified by the sponsor by the deadline / third-party access items issued for review; report the revoke rate alongside | Certification campaign records | ≥ 98%, revoke rate above zero | 90% to below 98% | < 90%, or zero revocations |
| TA-08 | JIT vendor access share | Third-party privileged access paths granted per request with automatic expiry / third-party privileged access paths | Privileged access request and approval logs; entitlement extracts | ≥ 90% | 60% to below 90% | < 60% |
| TA-09 | Vendor remote tool count | Count of distinct remote access or remote support tools observed in use by third parties, compared with the approved list | Endpoint software inventory; network flow and DNS logs; approved tool list | Only approved tools observed | 1 unapproved tool, removal scheduled | ≥ 2 unapproved tools, or any on critical systems |
| TA-10 | Offboarding latency | Median and 95th percentile hours from the end of engagement (contract end or sponsor notice, whichever is earlier) to disable of all accounts and sessions for that individual | Contract register and sponsor notices; directory, IdP and application audit logs | P95 ≤ 24 h | P95 above 24 h to 72 h | P95 > 72 h |
Notes on the formulas
- TA-01 checks the sponsor too: a sponsor who has left the organisation counts as no sponsor. Re-assign before the next review campaign. The Contractor Identity Lifecycle Guide explains sponsor duties.
- TA-02 and TA-10 measure different failures: TA-02 is a point-in-time count of access that should already be gone; TA-10 is the speed of the process for each departure, which shows whether TA-02 will stay at zero.
- TA-03 means enforced on every path: a vendor who signs in to the IdP with MFA but reaches a server through a remote tool or a local account without it counts as not covered.
- TA-05 needs a second source: brokered sessions are easy to count; the denominator must also include direct connections found in firewall or host logs, or the metric only measures the broker. See the Privileged Session Management Guide.
- TA-09 is a count, not a share: each unapproved remote access tool is a path around the broker. CISA's Guide to Securing Remote Access Software covers detection of malicious use of these tools.
How to collect the data
- Export the contract register: suppliers, contracts, start and end dates, sponsor and named individuals, from procurement or the vendor management system. This is the reference for TA-01, TA-02 and TA-10.
- Build the third-party identity population: export directory accounts flagged as external, IdP guest accounts, application-local accounts held by suppliers and privileged access entitlements, then join each to a contract by sponsor and supplier attributes.
- Pull authentication evidence: IdP policy assignments and exclusions, remote access gateway authentication settings and sign-in logs for the period (TA-03, TA-04, TA-06).
- Pull session evidence: session broker connection logs and the recording index, then firewall and host remote login logs for third-party source addresses and accounts (TA-05, TA-08).
- Find remote tools: query the endpoint software inventory and network flow or DNS logs for remote access and remote support software, and compare with the approved list (TA-09).
- Pull governance records: certification campaign decisions for third-party items and privileged access request logs with expiry times (TA-07, TA-08).
- Sample: pick five departed third-party individuals and trace every account they held to its disable event. Record any variance.
Red flags that need action now
- Any privileged third-party account still enabled after the contract ended (TA-02). Treat it as a possible incident.
- A privileged vendor account or remote access path without MFA (TA-03).
- A shared vendor support login with administrative rights and no record of who used it (TA-04).
- Third-party connections to production found in host logs that never passed through the session broker (TA-05).
- Standing, always-on vendor access to critical systems with no request or expiry (TA-08).
- An unapproved remote access tool installed on a server and reachable by a supplier (TA-09). Follow the Compromised MSP Playbook if misuse is suspected.
- A sponsor certification campaign with zero revocations across all suppliers (TA-07).
- No way to revoke all access for one supplier within hours, tested at least once a year.
Findings log
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-TPA-01 | [Number] third-party accounts active after contract end | TA-02 | [High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-TPA-02 | [Supplier] uses a shared administrative account on [system] | TA-04 | [Severity] | [Role] | [Date] | [Status] |
| HC-TPA-03 | [Number] direct vendor connections bypassed the session broker | TA-05 | [Severity] | [Role] | [Date] | [Status] |
| HC-TPA-04 | Unapproved remote tool [tool category] found on [number] hosts | TA-09 | [Severity] | [Role] | [Date] | [Status] |
| HC-TPA-05 | [Finding] | [Metric] | [Severity] | [Role] | [Date] | [Status] |
Group findings by supplier where one supplier causes several, so the relationship owner can raise them in one conversation. Risk accepted findings carry an expiry date and an approver.
Remediation map
| Finding type | Metrics | Where the fix is explained |
|---|---|---|
| No sponsor, no end date, slow offboarding | TA-01, TA-02, TA-10 | Contractor Identity Lifecycle Guide; Third-Party Access Policy Template |
| MFA gaps | TA-03 | MFA Guide; MFA Exception Register Template |
| Shared accounts and unrecorded sessions | TA-04, TA-05 | Privileged Session Management Guide; Remote Support Sessions |
| Dormant accounts and weak reviews | TA-06, TA-07 | Orphaned and Dormant Accounts; Access Reviews Guide |
| Standing vendor privilege | TA-08 | JIT Access Guide |
| Unapproved remote tools | TA-09 | Remote Support Sessions; Managed Service Provider Risk Assessment Guide |
Related guides
- Third-Party Access Guide: the design this health check audits.
- Third-Party Risk Management Maturity Model: place the results in the wider programme.
- Identity Security Metrics Guide: the wider identity metric catalogue.
- Third-Party Incident Response Playbook: when a supplier access finding becomes an incident.
- TPRM Programme Health Check: the programme-level companion page.
References
Framework anchors for the metrics: NIST SP 800-53 Rev. 5 AC-2 (Account Management), AC-2(3) (Disable Accounts), AC-17 (Remote Access), AU-14 (Session Audit), PS-7 (External Personnel Security) and SA-9 (External System Services); NIST CSF 2.0 PR.AA-05 and GV.SC-10; CIS Controls v8.1 Control 15 (Service Provider Management).
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
- CISA: Guide to Securing Remote Access Software
- CIS: Control 15 Service Provider Management
- NCSC: Principles of Supply Chain Security
Related NHI Mgmt Group resources: Third-Party Access Guide, Third-Party Access Policy Template, Contractor Identity Lifecycle Guide, Privileged Session Management Guide.