Contractors who touch in scope systems or data are treated like staff for SOC 2 controls. Give them individual accounts, least privilege access, signed confidentiality and policy acknowledgements, the same training, and a recorded offboarding. A development agency is also a vendor, so it needs a vendor review.
Two ways to look at a contractor
An individual contractor is a person with access. The employee lifecycle controls apply: onboarding checks, access approval, training, offboarding.
An agency or offshore firm is a vendor whose staff work for you. Vendor management applies as well: due diligence, a contract with security terms, and an annual review.
Many outside teams are both. Cover both angles.
Onboarding
- A written agreement with confidentiality and security terms.
- A background check where law and your policy allow it. Rules differ by country, so get advice.
- Policy acknowledgement and security training before access.
- An access request approved by a named owner, with the role and end date.
- Individual accounts with MFA. Shared logins break traceability and are a common finding.
Limit access
Give contractors only what the task needs.
- Separate repositories or a limited set of projects.
- No production access unless the work needs it, and then time boxed.
- Company managed devices, or a virtual desktop with controls, if the data is sensitive.
- Network and logging controls that let you see what they do.
Offshore work adds questions about data location and local law. Decide which data may leave which region, and write it into the agreement.
Offboarding
When the contract ends, remove accounts the same day, revoke tokens and keys they created, remove them from groups, and rotate any shared secret they knew. Record the date. A contractor who finished in March and still has access in June is a standard exception.
Auditors often compare the list of active accounts to the contractor list. Keep one list.
Review
Run the same access review for contractors as for employees, on the same schedule. Add a check that each contractor still has a current contract. See access review for SOC 2.
Evidence to keep
- Signed agreements.
- Onboarding checklist per person.
- Access approvals and removal tickets.
- Training and acknowledgement records.
- Vendor review file for the agency.
Agreements worth including
Ask your counsel to cover confidentiality, ownership of work product, a duty to report security incidents within a set time, rules on subcontracting, return or deletion of data at the end, and your right to audit or request evidence. For an agency, add a requirement to keep staff changes notified, so you can adjust access when people rotate on and off your account.
Watch the quiet risks
Source code and credentials often end up on personal machines and in personal chat. Ban secrets in chat, use a vault, and review repository access lists monthly. Note any contractor who works for several of your competitors and decide whether that matters for your data. Keep the review short and recorded.
Quick check
Do we need background checks for contractors?
Your policy decides, within the law. Be consistent: if your policy says all personnel with access, apply it to contractors too.
Can contractors use their own laptops?
Only if your device standard allows it and you can show it is met. Otherwise provide a managed device or remote desktop.
Last reviewed: 19 October 2026.
