Guide Medium priority Vendor AccessAuditProduction

Vendor Access Reviews for Production Infrastructure

9 min read

Vendor access is rarely malicious. It is usually just old. A support account was created for a ticket, a VPN note was shared, an SSH key was added, and nobody removed it when the work finished.

A useful review asks simple questions: who has access, what can they reach, why do they still need it, and when does it expire?

Vendor access review workflow

1
List vendors
2
Map hosts
3
Check scope
4
Set expiry
5
Review sessions
6
Remove stale access

Common vendor access gaps

No expiry 86%

Access survives the task.

Shared account 78%

Attribution is weak.

Protocol split 64%

SSH and RDP are reviewed separately.

Manual evidence 72%

Review depends on screenshots and memory.

Review access by task, not by person alone

A vendor may need access for a certificate fix, POS support issue, Windows server inspection, network device change, or deployment repair. The access should match that task.

Permanent broad access is usually a process shortcut, not a real requirement.

Put SSH and RDP in one review model

Linux and Windows access often drift into separate processes. That makes reviews harder because the same vendor might have a VPN path, an SSH key, and an RDP route.

CertLocker gives teams one scoped model for SSH and browser RDP access with expiry and audit trails.

Connect reviews to certificates and secrets

Vendor support often touches certificates, private keys, API secrets, or service credentials. Review those adjacent permissions at the same time.

The clean review is not just "did they log in?" It is "what production trust material could they reach?"

Vendor access review checklist

  • ✓ Every vendor access grant has owner, reason, target, protocol, and expiry.
  • ✓ Shared vendor accounts are replaced or tightly exception-managed.
  • ✓ SSH and RDP access are reviewed together.
  • ✓ Certificate, secret, and token access are included in the review.
  • ✓ Stale access is removed and the review is recorded.

Related reading and workflows

SSH access management

Short-lived SSH access, browser sessions, 2FA, groups, and audit.

Zero-trust SSH use case

A practical model for replacing long-lived PEM files.

Short-lived SSH access with 2FA

How CertLocker handles scoped server access and audit trails.

Secrets management

Versioned secrets, scoped access, groups, and audit evidence.

Secrets and TLS automation

Why secrets and certificate workflows belong close together.

Secret version history

Browse, restore, and audit older secret values without guesswork.

Help with onboarding

Bring your existing inventory to a hosted walkthrough with the CertLocker engineers.

CertLocker for DevOps teams

The broader trust-control workflow for platform and infrastructure teams.

Compare CertLocker with scripts

Where spreadsheets, cron jobs, and shared files stop being enough.

Try the workflow against real infrastructure

Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.

Hosted evaluation Ask about onsite evaluation