Third-Party and MSP Access Review Checklist
A third-party and MSP access review checklist evaluates delegated, remote, privileged, shared, and support access granted to suppliers, MSPs, contractors, and partners.
Primary Audience & Scope
Vendor management, IAM, Procurement, Security, Legal
When to Use
- •A workforce or third-party lifecycle event occurs.
- •High-impact access needs review.
- •Evidence of access decisions is required.
Interactive Work Area
Fill or track items interactively and copy out to your Clipboard
Template Table Structure
| Field | Working prompt | Item | Required evidence / record |
|---|---|---|---|
| Person or entity | Name, ID, role, organization, sponsor | Trigger | Departure, role change, contract end, review cycle, incident, exception |
| Access scope | Systems, data, facilities, privileged rights, groups, shared spaces | Decision | Keep, remove, modify, suspend, exception, investigate |
| Owner | Manager, IAM, data owner, vendor manager, Legal/HR as applicable | Due date | YYYY-MM-DD |
| Validation | Evidence that action was completed and reviewed | — | — |
Checklist Audit List
List vendors and business sponsors.
Map access paths including VPN, cloud, SaaS, support portals, APIs, and delegated admin.
Identify privileged vendor users.
Verify MFA, PAM, logging, and session review.
Confirm contract and data processing requirements.
Confirm access expiration or review date.
Validate emergency termination path.
Track remediation actions.
What Completion Looks Like
- 1Access decisions recorded.
- 2Removals validated.
- 3Exceptions time-bounded.
- 4Evidence retained.
- 5Owner and due date assigned.
Insider Risk Capability Framework™ (IRCF™) Alignment
Operationalize This Template in RiskTKO®
Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. AI Insider Risk Checklist