What rules should apply to vendor remote support in your network?

Treat every vendor support session as a temporary, approved, recorded visit. Require your staff to start it, limit it to the system in question, set an end time, record what happens and remove access when it ends. Do not leave standing vendor accounts or always-on tunnels.

Why this deserves a policy

A support engineer on a remote session can see or change whatever the session allows. If the account is shared, always on, or protected by a weak password, it becomes an attack path. Standing access is hard to watch, which is why the controls below focus on making access short and visible.

Rules to set

1. You start the session. Your staff initiate and approve each session. The vendor does not connect on its own schedule.
2. Named individuals. No shared vendor logins. Each person authenticates with multi factor authentication.
3. Scoped access. Give access to the one system in question, not the whole network. Use a jump host or a support network segment.
4. A time limit. Sessions end automatically after a set period. Extend only on request.
5. Your staff watch. For sensitive systems, an employee observes the session and can end it.
6. Recording and logs. Keep a record of who connected, when, from where, and what they did. Store it where the vendor cannot change it.
7. No data moves out without approval. Files, diagnostics and log bundles leave only after review.
8. Access ends cleanly. Disable the account or close the tunnel when the session closes. Review standing accounts quarterly.

Contract terms

• The vendor will use only the access method you specify.
• Vendor staff with access are named and trained, and changes in that list are notified.
• Support from outside your country is disclosed. Remote access from another country can count as a transfer of personal data, as our post on remote support access from another country explains.
• The vendor reports any compromise of its support tooling promptly.
• Data seen during support is handled under the contract's confidentiality and deletion terms.

GDPR Article 28 requires a processor to act only on documented instructions and to be bound by confidentiality, among other points. If vendor support can touch personal data, the contract should cover it. Have counsel check the wording.

Tooling choices

Prefer a method that you can switch off and audit. A broker you control, a time limited credential, or a session shared through your own remote access system all fit. Avoid methods that need a permanent agent calling out to the vendor with no logging on your side. Keep the support tool itself patched, since remote support tools can have vulnerabilities like any other software.

Test it

Ask for a support session in a test setting and walk through the rules. Where does the log appear? Who approved? When did the access end? If any answer is "we do not know," fix that first.

Quick check

Safeguard's policies, gates and agent identity features help you control access for your own automation, which uses the same principles.

Sources

• GDPR Article 28, Processor

Last reviewed: 19 October 2026.