--- title: "Who else has the keys? Vetting and managing vendor and ap..." url: https://trnsfrm.tech/blog/vendor-app-access-who-has-the-keys description: "When a vendor you trust gets breached, you inherit the risk. Here is how to inventory who has access to your systems, what to ask vendors, how to keep access…" lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: Who else has the keys? Vetting and managing vendor and app access for manufacturers, contractors, and DoD suppliers (https://trnsfrm.tech/blog-covers/cloud-misconfig.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO October 20, 2026 # Who else has the keys? Vetting and managing vendor and app access for manufacturers, contractors, and DoD suppliers ## Your vendors hold keys to your business Last week a credential belonging to a Microsoft 365 backup service, ConnectWise Cloud Backup (formerly SkyKick), was used to sign in to customer tenants. Huntress reported (https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) that the sign-ins were app-only: no person logged in, so there was no MFA prompt to stop them. The app already had broad access to mail, files, and Teams, and whoever held its credential inherited that access. Those customers did nothing wrong. They hired a vendor and granted it the access the job needed. That is the point. Every vendor and app with access to your systems is part of your security whether you think about it or not. Back in April we wrote about the big-name software supply chain attacks (https://trnsfrm.tech/blog/supply-chain-attacks-lessons-from-recent-software-breaches) and why they matter. This post is the hands-on side: how a manufacturer, contractor, or DoD supplier actually keeps track of who has access, keeps that access small, and reacts the day a vendor says it has been breached. ## Step one: write down who has access Most companies have more outside access than anyone realizes, because it piles up one project at a time. Start a simple list. A spreadsheet is fine. For each vendor or app, write down what it connects to, how it connects, and who on your side owns the relationship. The usual places to look: - **Your IT provider or MSP.** Remote management tools, admin accounts, and any tools they have connected to your Microsoft 365. We are one of those vendors for our clients, so this applies to us too. - **Backup and security tools.** These often hold some of the broadest access in your environment, because backup has to read everything and restore has to write it. - **ERP and accounting vendors.** Support accounts, VPN access, and remote sessions for upgrades and troubleshooting. - **Machine builders and OEM remote support.** CNC, PLC, robot, and test equipment vendors frequently have a remote access box or software on the plant network so they can support the machine. - **Construction and project software.** Estimating, scheduling, document control, and the integrations between them and your accounting system. - **Microsoft 365 connected apps.** Every app someone approved with "Sign in with Microsoft" or that an admin consented to. These live under Enterprise applications in Microsoft Entra, and they keep their access until someone removes it. - **Shared and service accounts** that a vendor set up years ago and nobody has touched since. If nobody can say what an entry is for, flag it. Those are the ones to look at first. ## Questions to ask a vendor before you give it access You do not need a 200-question security questionnaire for every vendor. You need straight answers to a few questions that tell you how they treat the access you are handing over: - What exactly do you need access to, and why? Can it be less? - How do your people sign in to our systems? Is MFA required for every one of them? - Is your access always on, or only when we open it for a support session? - Who at your company can use it, and how do you remove someone who leaves? - Do you log what you do in our environment, and can we see those logs? - If you have a security incident that could affect us, how fast will you tell us, and who will call? - Do you use subcontractors or other tools that would also touch our data? A vendor that answers these clearly and quickly is usually a vendor that has thought about it. ## Keep access small and check it on a schedule Least privilege is a fancy name for a simple rule: give each vendor only the access it needs, only for as long as it needs it. In practice that looks like: - **Separate accounts for each vendor.** No shared logins, and never a vendor using one of your employees' accounts. - **MFA on every remote session.** For DoD suppliers handling CUI, NIST SP 800-171 requires MFA for nonlocal maintenance sessions and requires those connections to be terminated when the work is done (3.7.5 in Rev 2). That is a good rule for everyone, not just defense work. - **Remote access that is off by default.** Turn on the OEM remote support box or the vendor's VPN account when there is a ticket, and turn it off when the job is closed. - **Scoped app permissions.** When a Microsoft 365 app asks for access to every mailbox and every file, ask whether it really needs that. - **A regular access review.** Quarterly works for most companies. Go down the list, confirm each entry is still needed, and remove what is not. Put a name on the review so it actually happens. ## Offboarding a vendor When you stop working with a vendor, the contract ending does not end their access. Someone has to remove it. Make it a checklist: - Disable or delete their accounts in your systems and in Microsoft 365. - Remove their apps from Entra Enterprise applications, and review any credentials those apps added. - Uninstall their remote access agents from servers, PCs, and plant equipment. - Change any shared passwords they knew, including local admin, Wi-Fi, firewall, and equipment passwords. - Get your data back, and get written confirmation they have deleted their copies. - Update your vendor list. ## What to put in the contract The contract is where you turn the questions above into commitments. Talk to your attorney about the exact language, but the topics worth covering are: - **Breach notice:** how fast they must tell you about a security incident that could affect you, and how. - **Security basics:** MFA, separate accounts, and access limited to what the work requires. - **Subcontractors:** whether they can use them, and that the same requirements flow down. - **Your data at the end:** return and deletion when the relationship ends. - **Cooperation:** help with logs and information if something goes wrong. For DoD suppliers, there is a specific reason to care. DFARS 252.204-7012 defines "rapidly report" as within 72 hours of discovery of a cyber incident, and it requires the clause to flow down to subcontracts that involve covered defense information. If a vendor touches that information, your contract with them needs to support that clock. ## The day a vendor announces a breach It will happen eventually. When it does, work the problem in this order: 1. **Find out if you use it.** Check your vendor list and your Microsoft 365 Enterprise applications. Ask your IT provider directly. 2. **Cut the access.** Disable the vendor's accounts or apps. In Microsoft 365, disable rather than delete when the vendor or your IT team advises it, so the app can be restored cleanly later. 3. **Look for what changed.** Review sign-in and audit logs for the window the vendor names: new admin roles, new credentials added to other apps, new accounts, and mailbox rules. Huntress made the point last week that disabling an app does not remove credentials an attacker already added elsewhere. 4. **Change what the vendor knew.** Passwords, keys, and shared secrets. 5. **Write it down.** What you checked, when, and what you found. If CUI could be involved, bring in whoever owns your DFARS reporting right away. 6. **Do not turn it back on** until the vendor confirms the problem is fixed and tells you how. With the inventory done, most of this takes hours instead of days. ## Where to go from here If your DoD supplier work puts vendor access in scope, our defense and DoD supplier page (https://trnsfrm.tech/industries/defense-dod-suppliers) and NIST 800-171 overview (https://trnsfrm.tech/frameworks/nist) cover how it fits together. AI tools are vendors too, and our AI governance policy template (https://trnsfrm.tech/resources/ai-governance-policy-template) covers the approval side. You can score yourself in about ten minutes with the free compliance checklist (https://trnsfrm.tech/compliance-checklist), or book the 45-minute Gap Audit (https://trnsfrm.tech/book) and have a senior engineer walk through your vendor and app access with you. ## Keep exploring More from the TRNSFRM team. ### All Blog Posts Browse every cybersecurity and IT article. https://trnsfrm.tech/blog ### Case Studies Real CMMC, NIST, and FTC outcomes. https://trnsfrm.tech/case-studies ### Free Compliance Checklist Score yourself across 47 controls in 10 minutes. https://trnsfrm.tech/compliance-checklist ### Compliance Frameworks CMMC, NIST 800-171, ISO 27001, HIPAA, FTC, ITAR. https://trnsfrm.tech/governance ### Cybersecurity Operations 24/7 MDR, SOC, and threat response. https://trnsfrm.tech/cybersecurity ### IT Resilience Framework Assess, Remediate, Operate, Improve. A continuous lifecycle. https://trnsfrm.tech/it-resilience-framework ### ITAR Compliance Checklist Work through ITAR readiness control by control. https://trnsfrm.tech/frameworks/itar ### MSP Partner Program White-label security and compliance for MSPs. https://trnsfrm.tech/partners/msp ### Choosing a Cybersecurity Firm 2026 buying guide and provider directory. https://trnsfrm.tech/blog/cybersecurity-companies ## More industries we secure Regulated-industry programs built by TRNSFRM. ### Aerospace & Space AS9100, CMMC, ITAR programs for aerospace suppliers. https://trnsfrm.tech/industries/aerospace-space ### Ambulatory Surgery Centers HIPAA-grade IT for ASCs and outpatient surgery. https://trnsfrm.tech/industries/ambulatory-surgery-centers ### Automotive Suppliers TISAX, CMMC, and OEM cyber flow-downs. https://trnsfrm.tech/industries/automotive-suppliers ### Behavioral Health HIPAA + 42 CFR Part 2 for behavioral health providers. https://trnsfrm.tech/industries/behavioral-health ### Defense & DoD Suppliers CMMC 2.0 & NIST 800-171 for the defense industrial base. https://trnsfrm.tech/industries/defense-dod-suppliers ### Dental Practices Real HIPAA compliance for dental groups and DSOs. https://trnsfrm.tech/industries/dental ## Featured cybersecurity insights Deeper reads from the TRNSFRM team. ### Building an Incident Response Plan You'll Actually Use A pragmatic IR playbook, not a shelf binder. https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use ### Cloud Misconfigurations: The #1 Cause of Data Breaches Where teams get cloud wrong — and how to fix it. https://trnsfrm.tech/blog/cloud-misconfigurations-the-1-cause-of-data-breaches ### CMMC 2.0: What Defense Contractors Must Do Now The DIB compliance clock is ticking. https://trnsfrm.tech/blog/cmmc-2-0-compliance-what-defense-contractors-must-do-now ### Deepfake Fraud in the Boardroom: The New CEO Scam Why voice and video attacks now target execs. https://trnsfrm.tech/blog/deepfake-fraud-in-the-boardroom-the-new-ceo-scam ### MFA Bypass Techniques and How to Stop Them Attackers are getting past MFA — here's how. https://trnsfrm.tech/blog/mfa-bypass-techniques-and-how-to-stop-them ### Quantum Computing and the Cryptography Apocalypse Start planning your post-quantum crypto migration. https://trnsfrm.tech/blog/quantum-computing-and-the-cryptography-apocalypse Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "176", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "Who else has the keys? Vetting and managing vendor and app access for manufacturers, contractors, and DoD suppliers", "description": "When a vendor you trust gets breached, you inherit the risk. Here is how to inventory who has access to your systems, what to ask vendors, how to keep access small, and what to do the day a vendor announces a breach.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-10-20T13:44:16.957283+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/cloud-misconfig.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "Who else has the keys? Vetting and managing vendor and app access for manufacturers, contractors, and DoD suppliers", "item": "https://trnsfrm.tech/blog/vendor-app-access-who-has-the-keys" } ] } ] } ] ```