Often yes, but treat a customer's auditor or consultant as a separate recipient, not as the customer. Confirm who they are, who engaged them, what scope applies, whether they are bound by confidentiality, and whether they may keep copies. Then apply the same limits you would to the customer.
Why a third party changes the picture
Your confidentiality terms are usually with the customer. A consultant is another organisation, possibly serving several clients, possibly including your competitors. Evidence you shared with the customer in good faith can end up in a consultant's shared files or reused in a template.
This is not an argument for refusing. Auditors and assessors are a normal part of customer due diligence. It is an argument for asking a few questions first.
Questions to ask before sharing
- Who engaged you, and for what purpose? Get the customer's confirmation in writing.
- What are the exact documents needed? Share the minimum that answers the audit question.
- Are you bound by confidentiality? Ask for the customer to confirm, or for a direct agreement if your contract requires it. Involve your legal team.
- Where will the documents be stored, and for how long?
- Who will see them at your firm?
- Will any content be reused for other clients? The answer should be no.
A reputable consultant answers these without fuss. Hesitation is itself information.
How to share
- Create a separate named access set for the consultant, not a shared login with the customer.
- Use expiring access. Align the expiry to the audit window.
- Tag the pack in your register as shared with a third party, and note the customer it is for.
- Prefer view only access where your tool supports it, or a supervised session for the most sensitive items.
- Watermark PDFs with the consultant's firm name and date. See do watermarks protect security documents.
What to hold back
Even for an audit, some material needs extra thought. Raw vulnerability data, unpatched findings and details of other customers should usually stay out. Offer a summary or a walkthrough instead. If the auditor needs evidence of a control operating, show a sample with identifying details removed, rather than handing over full logs.
If the audit scope expands halfway through, pause and re-confirm. Scope creep is how a modest request turns into a full export.
After the engagement
When the audit window ends, close the access you created, record the date, and ask the customer to confirm that copies held by the consultant are handled per your agreed terms. Treat the exact legal requirements as a matter for your counsel. See revoking customer access to evidence for the offboarding steps.
Safeguard's SBOM exports and compliance evidence can supply the source material for an auditor pack, and you control how and with whom it is shared. Try a free scan to see sample output.
Quick check
Can the customer share your documents with their consultant themselves?
That depends on your confidentiality terms. Check your agreement, and if it is silent, ask the customer to request it so you can set the right limits.
Should the consultant get the same access as the customer?
Not automatically. Give the minimum for the audit scope, with its own expiring access.
Last reviewed: 19 October 2026.
