The short answer
Treat contractor access to building systems like any temporary privilege: grant only what the current task requires, bind it to a named identity and a finite window, and automate revocation when the engagement ends. Apply least privilege, which NIST defines as restricting access to the minimum needed for assigned tasks, equally to logical access (BMS, networks, servers) and physical credentials (badges, doors), then verify with logs, access reviews, and revocation drills.
Key takeaways
- Least privilege is decided per asset and per role, not once per vendor firm; a badge to the mechanical floor should not auto-grant an account on the BMS server.
- Contractor access is temporary by design: a named individual, a defined scope, and an end date are recorded at grant time, not retroactively.
- Automatic expiry must fire on multiple triggers — contract end, sponsor departure, scope change — backed by regular reconciliation against the active-engagements register.
- Always-on 24/7 remote access demanded by vendors should be replaced with scheduled, session-logged access where feasible.
- High-trust systems should administer lower-trust systems (browse-down); contractor segments must never administer your higher-trust network.
- Without entry/exit, session, and action logs, you cannot investigate incidents or prove that offboarding actually happened.
Scope: what counts as a property system and where least privilege applies
On a property, systems reach far beyond servers. A contractor may need to touch the building management system that drives HVAC and lighting, the access-control panels behind badge readers, the elevator controller, the fire-alarm service port, or the tenant Wi-Fi and cameras. Each is a separate asset with its own risk profile and its own way to grant, expire, and log access.
NIST defines least privilege as restricting a user's access privileges to the minimum necessary to accomplish assigned tasks. Translated to facilities, that means decisions are made per asset and per role, not on the logic that an accredited vendor should simply be allowed everywhere. A technician with badge access to the plant room should not automatically hold an account on the BMS server, and vice versa. Treat the two grants as independent decisions even when they are recorded for the same work order.
CISA's Zero Trust Maturity Model frames least privilege as accurate, per-request access decisions about identity and asset rather than a standing network position. The same discipline applies to a badge at a door and a login on a controller: both should be tied to who, what, when, and why.
- Typical contractor-touched assets: BMS/automation, access control and doors, elevators and escalators, fire and life safety, power and HVAC plant, tenant IT and video surveillance.
- For each asset, record who requests it, which zone or function is actually needed, for how long, and who authorizes it.
- A physical credential and a logical account are two separate decisions even when issued under one contract.
Why contractor access drifts into standing risk
The defining problem is that a contractor identity never passes through the normal employee lifecycle. There is no HR offboarding event that forces the account closed. The contract ends, the sponsoring manager leaves or moves projects, yet the badge and the login keep working. NCSC supply-chain guidance treats this as core risk and tells organizations to know exactly what physical and logical access suppliers — and their sub-contractors — hold to your systems, premises, and information.
A second common failure is shared accounts and the standing access a vendor quietly keeps for itself. NCSC warns that a third party installing equipment may bring connectivity you never approved, such as a 4G modem inside a device that gives the vendor unconstrained remote access into your network. Such out-of-band channels are invisible in your logs and outside your policy.
The result is access creep: temporary entitlements quietly become permanent, and one technician's access spreads to the subcontractors of his firm. Any forgotten channel can become an entry point for an attacker, which is exactly why CISA's cross-sector performance goals treat least privilege and managed-service-provider risk as priority baseline practices.
- Verify which subcontractors and service engineers reach your assets through your direct contractor.
- Hunt for and disable bypass channels: cellular modems, configuration Wi-Fi, removable media left connected, spare service ports.
- Separate access tied to the current engagement from stale accounts that the same firm held on earlier projects.
Designing time-boxed, least-privilege access
A workable pattern is to issue access from role templates — for example, BMS service engineer, access-control installer, elevator technician — where the zone and function list is predefined rather than assembled case by case. Inside the role, access is bounded by time windows: a cleaning contractor may enter during business hours, while plant maintenance staff work evenings. The same logic applies to logical systems, where an account opens for a specific work order and closes when the order completes.
Where possible, prefer just-in-time access over standing access. NCSC's guidance on operational technology notes that a vendor's demand for 24/7 remote access often can be replaced by scheduled sessions; where the requirement cannot be removed, compensating controls such as network segmentation and auditing of third-party actions are mandatory. A third party should reach only the specified assets and nothing else on your network.
The browse-down model applies: systems of higher trust administer systems of lower trust, never the reverse. If a contractor administers your building controller, place its segment at a lower trust level and isolate it so that remote session cannot become a bridge into the corporate network.
- A role template records the individual, the firm, the site, the zones and functions, the validity window, and the accountable sponsor.
- Default to one work order or one shift, with renewal only by explicit approval rather than silent continuation.
- Remote access runs only through a managed gateway with multi-factor authentication and session recording, never direct ports on the device.
- Separate duties: the person who grants access should not be the only one who reviews and revokes it.
Automatic expiry: triggers and reconciliation
Automatic expiry should not wait for the contract end date alone. Practical triggers are the expiry of the credential period, the departure or transfer of the sponsoring manager, a change or termination of the engagement, a no-show contractor, or a subcontractor swap. Each of these events should revoke rights across both domains — the badge system and the logical accounts.
Reliability comes from reconciliation. At least monthly, and more often on large sites, compare active accounts and badges against the register of live contracts and work orders. Anything not in the register is suspended or flagged for review. It helps to measure revocation latency — the interval between the moment access is no longer needed and the moment it is actually closed — and to target hours, not weeks.
Renewal must not be silent continuation. When the window lapses, the rights are automatically blocked, and a new period opens only after a fresh request and approval. This prevents the all-too-common situation where temporary rights live for years simply because no one looked.
- Trigger 1: the planned end date of the contract or work order.
- Trigger 2: the sponsoring manager leaves or changes role.
- Trigger 3: contract termination, scope change, or subcontractor substitution.
- Trigger 4: prolonged inactivity or access outside the scheduled working window.
- Reconcile the access register against active engagements on a fixed cadence.
Monitoring, audit, and ongoing verification
Access that is not logged is a blind spot. A modern access-control system records every pass through a point: who entered which zone and when, and it can prevent re-entry without a recorded exit. Logical systems should equally log contractor sessions — connection time, commands run, and accounts used. These logs are invaluable during an investigation, letting you reconstruct a person's route through a building and their actions in systems in minutes.
Linking access events to video strengthens control: a door event in a zone can be matched to camera footage and to actions in the system. Regular access reviews — at least quarterly — reveal accumulated roles and unexplained accounts. Every change to rights should follow a documented request-and-approval flow; without it, you have no defensible basis for granting or revoking access later.
For sites under sector regulation, access-scoping requirements may be set by the relevant authority for your industry and jurisdiction. Confirm the current edition of applicable rules; the practices above are a solid common baseline but do not replace mandatory requirements.
- Retain access-control and session logs for as long as your policy and any regulation require.
- Configure alerts for access outside the scheduled working window and for logins from unexpected sources.
- Run a quarterly access review where each system owner confirms roles are current.
- On technician departure or contract end, close both the individual's and the firm's corporate access paths.
Put it into practice
Contractor Access Lifecycle Checklist (Zero-Trust)
This checklist walks the full lifecycle — before granting, at grant time, during work, and after completion. Use it as the skeleton of an access policy and as the source list for periodic audits of existing contractor rights.
- Before granting: the systems and zones needed for the specific work order are listed, and systems that are off-limits are named explicitly.
- Before granting: the individual, firm, subcontractors, and the accountable sponsor inside your organization are recorded.
- Before granting: the end date and working window are agreed, with renewal only by explicit decision.
- Grant: a named account is created rather than a shared one; badge and logical login are issued as two independent decisions.
- Grant: remote access runs through a managed gateway with multi-factor authentication and session recording.
- Grant: the contractor's network segment is verified as lower-trust and isolated (browse-down), reaching only the specified assets.
- During work: access, session, and action logs are active; alerts fire on access outside the scheduled window.
- During work: equipment installed by the vendor is checked for hidden channels such as cellular modems or configuration Wi-Fi.
- Completion: automatic expiry fired on the end date or another trigger; revocation latency is recorded and within target (hours).
- Completion: the access register is reconciled against active engagements, and all surplus rights are closed.
- Audit: quarterly, each system owner confirms that every contractor role is still current and justified.
- Audit: denials, incidents, and suspicious activity are documented and routed to an accountable owner.
Questions people ask
What does least privilege mean in practice for a one-day HVAC service visit?
Least privilege means the technician gets exactly the functions and zones that work order requires — say, the specific HVAC controller or plant room — and nothing for other floors, the server room, or tenant data. Nothing is added as a convenience, and nothing lasts beyond the shift. NIST defines the principle as limiting privileges to the minimum necessary to accomplish assigned tasks.
Which events should automatically revoke access even before the contract end date?
Deputy revocation triggers include the sponsor's departure or role change, contract termination or scope change, a subcontractor swap, and prolonged inactivity or off-hours access. Renewal should never be automatic: after the window lapses the account is blocked and reopens only on a fresh approved request. Periodic reconciliation against the active-engagements register catches rights that no single trigger touched.
Should a contractor get a shared vendor account or a named identity?
A named identity is the right default. Shared accounts make it impossible to determine who actually performed an action, and when one technician leaves, access remains open to the whole group. Named accounts enable per-person revocation, meaningful logging, and incident investigation. NCSC supply-chain guidance emphasizes knowing precisely what physical and logical access your suppliers' people hold.
A vendor insists on 24/7 remote access to the building management system. What should I do?
Try to negotiate scheduled, just-in-time sessions through a managed gateway with session recording and multi-factor authentication instead of standing access. Where the requirement genuinely cannot be removed, apply compensating controls: isolate the vendor segment, limit it to the specific assets, and log all its actions. Also verify that vendor-installed equipment introduced no hidden channel such as a cellular modem.
How often should contractor access rights be reviewed?
A realistic minimum is a quarterly review in which each system owner confirms that every role is still current and justified. For critical zones and larger estates, reconcile the access register against active contracts monthly. Event-driven reviews are triggered by sponsor departure, contract termination, an incident, or detected anomalous activity.
Sources and further reading
Sources were checked when this page was generated. Confirm changing dates, rules and prices with the original publisher.
- Least Privilege — Glossary | CSRC (NIST)National Institute of Standards and Technology (NIST)
- Zero Trust Maturity ModelCybersecurity and Infrastructure Security Agency (CISA)
- Cross-Sector Cybersecurity Performance GoalsCybersecurity and Infrastructure Security Agency (CISA)
- Supply Chain Security — Principle 1: Understand the RisksUK National Cyber Security Centre (NCSC)
- Operational Technology — Principle 5: Third-Party Risks to Your OT SystemUK National Cyber Security Centre (NCSC)
- СКУД для офисов с гибридным режимом: гости, курьеры, подрядчики, временные доступыАйПи Решения