- Inventory machine access and operational dependencies alongside named vendor users.
- Ask suppliers for evidence tied to the access they actually hold.
- Test revocation and continuity before a supplier incident forces the decision.
A supplier can pass a questionnaire while an old support account still has administrator rights in your tenant. An integration can keep exporting data after its business sponsor leaves. Begin a supplier review by listing those access paths, then use the questionnaire to investigate the risks you find.
NIST's supply chain risk management guidance addresses risk across acquired products and services. The access review below is a narrower operational exercise; it does not replace procurement, contractual, or product-assurance work.
Build the register from both sides
Ask procurement and finance which suppliers are active, then compare that list with identity and application records. Include MSP remote-management agents, cloud roles, guest accounts, OAuth grants, API keys, SFTP accounts, and support portals. An invoice list alone will miss free integrations and abandoned trials.
For each entry, record a business owner, technical owner, systems and data reachable, authentication method, privilege, incident contact, and last verified use. Note whether a supplier outage would stop payroll, order processing, customer support, or another service even if the supplier has no privileged access.
Follow one integration all the way through
Consider a hypothetical CRM integration that exports contacts to a marketing platform. Check the approved purpose against its granted scopes. Does it need every record, or only a defined audience? Can it write back? Who can change its configuration? Where do exported copies remain after access is revoked?
Ask the owner to demonstrate a normal transaction and identify the audit trail. Record the application identifier and credential owner, without copying secrets into the register. If nobody owns it, investigate dependencies before disabling it; a quiet integration may still support a monthly business process.
For human support access, prefer named accounts and limited duration where practical. If standing access is necessary for emergency service, document the reason, scope, approval conditions, and monitoring. Review the subcontractors who can use that path as well.
Ask questions that change a decision
A useful evidence request is specific: "Show how your support users authenticate to our environment and how we can identify their administrative actions." Ask which incident contact is staffed, how notification works, and who can authorize emergency suspension.
Request the evidence relevant to your service. A general assurance report may exclude the product, subcontractor, or period you care about. Have the contract owner check scope, data handling, deletion at termination, and continuity terms. Avoid treating a certification badge as proof that your tenant configuration is safe.
Rehearse the off switch
Use a test account or approved maintenance window to verify revocation. Disabling a named user may leave an OAuth grant, API key, or remote-management agent operational. Document every action required and who has permission to perform it.
In an incident, coordinate evidence preservation with containment. Capture the relevant account identifiers, grants, and logs without delaying an urgent suspension. Confirm afterward that access is blocked, rather than relying on a successful administrative click.
Write down the operational consequence too. If suspending the MSP would remove endpoint management, identify who can administer devices directly. If a SaaS service is unavailable, locate a usable export and the business process that can operate without it.
Start with suppliers holding privileged access or essential data. Review the register again at renewal, major scope changes, and staff departures. Track stale access removed, revocation tests completed, and unresolved dependencies. Those records are more useful than the number of questionnaires collected.
Turn this response guidance into clearer roles, containment decisions, evidence paths, and executive briefing rhythm.