Remote access is how most intrusions begin, and the policies covering it usually address employees while leaving vendor and contractor access to informal arrangements. This one treats third-party access as a first-class case.
List approved methods and prohibit the rest. Name the sanctioned paths (VPN, ZTNA, VDI) and state that anything else, including personal remote desktop tools, is prohibited. Unlisted tools are how access persists after offboarding.
Require device posture, with identity as the baseline. A correct password and MFA code from a compromised personal laptop is still a compromised session. Require encryption, patch level, and endpoint protection as conditions of access.
Give every third-party account an expiry date. Vendor accounts are the ones that outlive their purpose. Time-bound them by default, renewed on request, so lapses are automatic rather than dependent on someone remembering.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| User type | Method | Device | MFA requirement | Session limits | Logged |
|---|---|---|---|---|---|
| Employee: standard | ZTNA client | Managed device only | App-based MFA | 12h session, re-auth daily | Yes |
| Employee: privileged | ZTNA plus PAM broker | Managed device only | Phishing-resistant (FIDO2) | 4h session, re-auth per session | Yes (session recorded) |
More free templates IT teams use alongside this one.
Access control policies state least privilege and then leave the mechanics unspecified, which is where it breaks down. This one fixes the approval route, the review cadence, and the privileged-access rules explicitly.
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
Sending every vendor a 200-question security questionnaire means nobody reads the answers. This one tiers vendors by what they can actually damage, and asks a proportionate set, with evidence required rather than self-attestation at the top tier.
Approved access methods by user type, device posture requirements, MFA standards including phishing-resistant factors for privileged access, session and timeout rules, logging and retention, and explicit handling of third-party access with expiry dates.
Yes, on every path without exception. For privileged access, phishing-resistant factors such as FIDO2 security keys are increasingly the expectation, because push-based MFA is defeated by fatigue attacks and real-time phishing proxies.
Time-boxed to the specific work, supervised or recorded where it touches production, granted through your own access path rather than a vendor tool, and tracked in a register with an expiry date and a named internal sponsor.
