Contractors, temps and the visiting engineer

Four kinds of person who are not your employees

The equipment vendor's engineer, on site with a laptop, plugging into a machine.

The remote support session, opened for a fault and sometimes left open.

Agency and temporary staff, on assignments measured in weeks, arriving faster than any provisioning process.

Professional services: consultants, auditors, integrators, each needing something.

All four touch covered information in the ordinary course of work and all four sit outside the arrangements built for employees.

The tension, stated honestly

A machine is down, the engineer is here, and the account request will take two days. Every business resolves this the same way and the resolution is a shared account somebody set up years ago.

The fix is not a faster approval chain. It is a pre-agreed arrangement: a named, time-limited account per vendor, created in advance, enabled on request and disabled automatically.

That takes an afternoon to set up per vendor and removes the pressure that produces the shared account.

Somebody stays with them

For physical visits, an escort who knows what the visitor is doing and stays present. Not surveillance: presence, and a record that somebody was there.

It is the cheapest control in this entry and it is also the one that catches the ordinary problem, which is a well-meaning engineer copying a file to their own laptop to look at later.

Three clauses worth having

With the equipment vendor: what their engineers may connect, what they may copy, and what happens to anything they take away. With the labour supplier: who is responsible for background checks and for training, and what they are told about your requirements. With professional services: confidentiality, and the same offboarding obligations as anybody else.

None is unusual and none appears by default.

Somebody has to, and it is usually you

A contractor's own employer trains them on their own environment, not on yours. A ten-minute induction covering what may be copied, what may be connected, and who to tell if something goes wrong is worth more than a clause about it.

Record it, for the same reason employee training is recorded.

Opened deliberately, closed the same day

Support connections that persist are one of the most common findings in this area, and they persist because nobody owns closing them. Attach the closure to the ticket rather than to somebody's intention, and review what is open monthly.

The review takes ten minutes and reliably finds something.

Know who has access who is not on payroll

A list, reviewed quarterly, of every non-employee with access to anything. Most suppliers cannot produce this and an assessor will ask for it.

Building it is a morning and it usually finds two or three accounts belonging to people who finished an engagement a year ago.

Physical access, reviewed with the digital kind

Contractor badges outlive contracts more reliably than accounts do, because nobody receives a notification. Review them on the same quarterly cycle as the access register and against the same list.

Convenience arrives with a reputation

The vendor engineer everybody likes is frequently the one who works around your controls to get the machine running, and is thanked for it. Raise it with their employer rather than with them, and put the expectation in the contract before the next visit.

Elsewhere in people

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.