Client-owned access
Work should occur in client-controlled accounts with the minimum permissions required for the assigned workflow.
Menu
ACCESS WITH BOUNDARIES
Remote support should not require uncontrolled access.
Security starts with a narrow workflow, client-owned accounts, explicit permissions, approved handling rules, and a complete offboarding path.
ACCESS PLAN
Six controls every client workflow should define.
Unique credentials and MFA
Every worker should use an individual identity. Shared passwords should not be the operating model.
Approved credential handling
Credentials should move through an approved password manager, never chat, email, or unmanaged documents.
Confidentiality
NDA, confidentiality expectations, allowed tools, and prohibited data handling should be documented before access is granted.
Document boundaries
The engagement should state whether local downloads are allowed, where working files live, and when copies are deleted.
Offboarding
Access removal, file return, credential review, and device checks should follow a named closeout checklist.
CONTINUITY WITHOUT SPRAWL
Backup coverage needs controlled access too.
Continuity should come from documented procedures and an approved access path, not casually sharing a primary specialist’s credentials.
- 01Document the recurring workflow and source locations.
- 02Name who may authorize backup access.
- 03Grant only the permissions needed during coverage.
- 04Review and remove temporary access afterward.
CLIENT DISCUSSION
Resolve these questions before access is approved.
01
Approved password manager and identity process
DISCUSS02
Device management and endpoint requirements
DISCUSS03
Data retention and deletion periods
DISCUSS04
Allowed AI tools and client-data restrictions
DISCUSS05
Incident reporting contact and response procedure
DISCUSS06
Subprocessor list and cross-border data handling
DISCUSSACCESS FOLLOWS SCOPE
Map my workflow Map the permissions with the workflow.
A responsible proposal should identify the systems, access level, source documents, decision owners, and offboarding steps required.