Vendor Remote Access: What Must a CISO Approve First?

What must a CISO approve before granting vendor remote access?

Before granting vendor remote access, approve a named business owner, the exact systems and permissions, the access window, monitoring responsibilities, and a tested way to stop access. Philippine security leaders should also confirm personal-data handling and contractual responsibilities before a support arrangement becomes a permanent route into production.

Key takeaways

• Vendor access approval should identify individual operators and accountable customer owners.
• Remote support permissions should match the purchased service and expire when that work ends.
• Customer security teams should retain access to logs and the authority to disconnect a provider.
• Vendor contracts involving personal-data processing need privacy terms as well as technical access controls.

The risk extends beyond stolen passwords. Verizon’s 2026 Data Breach Investigations Report executive summary reports third-party involvement in 48% of breaches, vulnerability exploitation as the initial access vector in 31%, and credential abuse in 13%. These are global reporting-dataset findings, not Philippine prevalence estimates; third-party involvement does not mean every breach began with a remote support session.

Use those findings to ask for separate proof of account protection and remote-tool security. A password policy cannot demonstrate that an internet-facing management appliance is patched. A supplier certificate cannot show which production systems a technician can reach. CISA’s Guide to Securing Remote Access Software, published in 2023, addresses authentication, software inventories, patching, segmentation, and customer visibility together.

Start with the business task, then assign access. For an Ortigas security team reviewing an outsourced support contract, ask the application owner to identify what the technician must maintain and what must remain unreachable. Infocentric’s identity and access management portfolio provides the broader identity context; a vendor-specific approval should still name its own owner and stopping conditions.

What evidence should the vendor provide before you sign?

The vendor should provide an access design and contract terms that your team can check against the actual support task. Ask for evidence of who connects, what the connection permits, what the customer can observe, and how the arrangement ends.

The following approval worksheet connects proposed buyer checks to published guidance; it is a decision aid rather than a product certification. CISA’s remote-access guide supports the technical checks, while the National Privacy Commission’s Data Privacy Act implementing rules support the personal-data contract checks.

Approval item	Evidence to request	What to reject
Operator and permissions	Named accounts, authentication controls, approved destinations, and reduced-privilege roles	Shared access with no attributable operator
Remote software	Authorized-tool inventory, patch responsibility, and configuration ownership	Unmanaged tools outside the agreed support route
Customer visibility	Sample connection records and customer access to retained logs	Provider-only evidence that the customer cannot inspect
Personal-data processing	Documented instructions, security duties, subprocessor terms, and return or deletion provisions	A confidentiality clause treated as the complete processing agreement
Termination and incidents	Customer disconnection authority, notification terms, and recovery responsibilities	Cancellation terms with no operational access-removal procedure

CISA states: “Do not reuse admin credentials across multiple customers.” That recommendation is a useful contract discussion point, but a supplier’s written assurance still needs an implementation check. Ask how the provider separates customer credentials and demonstrates that the proposed connection uses your approved account.

For Philippine personal-data processing, Section 44 of the implementing rules specifies outsourcing-contract content, including documented instructions, security measures, and conditions for another processor. The rules also address deleting or returning personal data after services end, subject to applicable storage requirements. Do not translate that into an automatic instruction to erase every security record.

Use Infocentric’s privileged access management service to frame administrative-account controls, then keep service scope and contractual obligations explicit. A vault demonstration alone does not answer the contract questions.

How should you test whether vendor access can be stopped?

Test vendor access removal in an agreed nonproduction exercise before accepting the support arrangement. The acceptance record should show the customer stopping the approved route, checking the resulting access state, and retaining evidence without depending on the disconnected provider to supply it.

Use this proposed exercise to turn CISA’s guidance on monitoring, restricted access, and customer visibility into an observable buyer check:

1. Select a representative support task and record the operator, target, permitted action, approved window, and customer approver.
2. Establish the connection through the agreed route and verify that permitted work succeeds while an out-of-scope destination remains inaccessible.
3. Ask the customer security operator to stop access using the documented account, session, or connection controls appropriate to the design.
4. Attempt reconnection and inspect relevant target-system records for remaining sessions, credentials, agents, or alternative support routes.
5. Retrieve the activity evidence from the customer’s agreed logging location and record any unresolved access or evidence gap.
6. Restore only the access explicitly approved for continued support and assign an owner and deadline to each correction.

Do not award a pass simply because a vendor portal shows an account as disabled. Require the target-system check and record the design’s limitations. CISA recommends keeping direct access to log servers, including the ability to alter or delete logs, out of remote management tools’ reach. That makes evidence custody part of the exercise rather than an afterthought.

Agree who can authorize disconnection during a service incident and who owns recovery. Infocentric’s managed services describe outsourced operating support; the purchased service still needs its own responsibility record. Bring the access worksheet and unresolved test results to Infocentric’s consulting services team if you need help scoping that discussion.

What do buyers ask about vendor remote access?

Buyers need clear answers about authentication, subcontractors, access removal, and retained evidence before approving vendor remote access. The following questions turn CISA’s customer recommendations and the Philippine outsourcing rules into practical review prompts. They do not replace an assessment of the specific systems, personal data, or support contract.

Is multifactor authentication enough for a support vendor?

No. Multifactor authentication is one control, not the complete access decision. CISA’s remote-access guide also recommends reduced privilege, network separation, authorized-tool controls, patching, and logging. Ask the vendor to demonstrate the approved destinations and permissions, then check who monitors activity and who can stop the connection.

Can a vendor add its own subcontractor?

For outsourced personal-data processing, Section 44 of the Philippine implementing rules requires prior instruction from the controller before another processor is engaged and requires appropriate obligations for that processor. Put the approved arrangement in writing and require an access review before the additional operator connects to your systems.

Does disabling the vendor account finish the exit?

Treat account disablement as a test step rather than the entire exit. Check the agreed remote tools, remaining access routes, customer logs, and target-system results. CISA’s guidance covers remote software inventories and provider activity visibility; use those records to confirm that the approved support path has actually closed.

Must all vendor-held records be deleted immediately?

No universal immediate-deletion rule follows from Section 44. The Philippine outsourcing rules address return or deletion of personal data after services end at the controller’s choice, unless storage is legally authorized. Agree the treatment of support data, copies, and evidence separately: Section 44 also requires information supporting compliance and audits.