When a contractor's engagement ends, remove access on the contract end date, rotate anything shared with them, retrieve or confirm destruction of data, and keep a dated record. Contractors often hold access outside your identity provider, so the usual employee process misses things.
Why contractors need their own list
Employees are usually in the HR system and the identity provider, so removal is triggered automatically. Contractors are often set up by a team lead, with a personal email address, a shared account or a vendor portal login. Nobody owns the end date, and access quietly continues.
Before the engagement ends
- Ask the sponsoring manager to list every system the contractor used.
- Check the contract for return or destruction of data and equipment.
- Identify any accounts shared with other people, such as a team login for a tool. These will need a password change.
- Agree a handover for knowledge that exists only in their head.
On the end date
- Disable named accounts: identity provider, email, chat, source control, ticketing, cloud consoles and any vendor portals.
- Remove from groups and mailing lists, including security alert lists.
- Revoke tokens and keys they created, and rotate shared secrets they could read.
- Remove virtual private network and remote access profiles and device certificates.
- Recover or wipe equipment. Company laptops come back. For their own devices, get a written confirmation that company data is deleted, and remove any managed profile.
- Transfer ownership of documents, repositories and scheduled jobs.
- Check external tools: shared drives, design tools, cloud notebooks and issue trackers that the contractor invited themselves into.
What to verify a week later
- Run a report of active accounts and compare with active contractors. Anything unmatched needs an owner or removal.
- Look at sign in logs for the removed accounts. Attempted use after the end date is worth a conversation.
- Confirm that invoices and access are both closed. If payment ended but access did not, the process has a gap.
Make it routine
Give every contractor an end date in the system at the time of creation. Accounts that expire automatically are safer than accounts that depend on someone remembering. Review contractor access quarterly, with the sponsor confirming each name.
Auditors commonly sample both leavers and third party access. A ticket that shows request, approval and removal with dates is the evidence they will ask for.
Small teams can keep this simple. A shared sheet with name, sponsor, start date, end date and a list of systems is enough to begin. The key is that the sheet exists, one person owns it, and the end date triggers a task rather than relying on memory. Review it monthly and the gaps will show themselves quickly.
Quick check
Should contractors use their own email for accounts?
Prefer an account in your directory, so it is disabled in one place. If a personal address is unavoidable, record it and track the account.
Is a signed destruction statement enough?
It is the usual minimum. Higher sensitivity data may warrant technical verification or avoiding local copies altogether.
Last reviewed: 19 October 2026.
