HowyGuardHow do I control what outside companies can access?
Make a list of every outside company or person who can log in to your computers, email or business software, like your IT helper, software vendors or web designer. Give each one their own login with two-step sign-in, remove anyone you no longer work with, and keep the dated list as proof.
Outside access is any way a company you work with, like an MSP or a software vendor, can log in to your systems.
Check if you already have it
You have this under control if you can answer yes to all three:
- You have a written list of every outside company that can log in, and how.
- Each one uses its own login with two-step sign-in, never a password you share.
- Nobody you've stopped working with still has access.
Places to look: the admin list in Google Workspace or Microsoft 365, the users list in your booking or accounting software, and remote-control tools like TeamViewer or AnyDesk on each computer.
How to set it up
Control what outside companies can reach
Any setup, needs a list of every company that helps with your computers or accounts
- List every outside company or person who can get into your computers, email or business software, such as an IT helper or a software vendor.
- For each one, write down how they get in: their own login, a shared password, or a remote-control tool.
- Give each one their own login, never a shared password, and make sure it uses two-step sign-in.
- Remove access for anyone who no longer works with you, and change any password they knew.
- Turn off always-on remote-control tools, and let vendors in only when you're there to approve it.
- Review the list every six months.
How to show it's true: Keep the dated vendor list with the last review date.
- You're not sure what a vendor can reach: ask them in writing. Their answer goes on the list.
To find and remove remote-control tools on each computer, follow the Windows and Mac steps in how to secure admin accounts and remote access.
How to show it's done
Keep the dated list in your proof folder: company, what they do, how they log in, whether it has two-step sign-in, and the date you last checked. File any written answers vendors send you with it.
Common questions
My IT company says their tool is secure. What do I ask?
Ask in writing: does their login to your systems use two-step sign-in, and is their remote tool always on, or only when you let them in? Put the answer on your list.
Does the company behind my booking software count?
Yes, if it can see your data or log in to your account. Put it on the list.
A vendor shares one login among their staff. What do I do?
Ask for a named login for each person who works on your systems.