Contractors and vendor staff who access your systems or data should receive training matched to that access, with the requirement written into the contract and a way to verify completion. Do not treat contractors as exempt because they are not on payroll. Attackers go after whoever has the easiest path.
Decide who is in scope
Sort outside people by access, not by contract type:
- High: production, source code, customer data, admin consoles.
- Medium: internal tools, shared drives, ticketing.
- Low: no access to systems or data, such as a cleaner or a visiting speaker.
High and medium get training. Low gets a short on site briefing if relevant.
Know the legal wrinkle
Some rules draw a line between workforce and separate business associates. HIPAA's Security Rule, for example, requires a training program for all members of the workforce including management, and whether a given contractor counts as workforce is a legal question. Ask counsel before assuming either way.
What to require
- Baseline awareness before access is granted: phishing signs, sign in hygiene, data handling, how to report.
- Role content for engineers: secrets, dependency review, change control.
- Your acceptable use policy acknowledged and recorded.
- Same reporting path as employees.
Contract language
Include:
- A clause requiring training equivalent to your baseline before access.
- A right to request completion evidence.
- A duty to notify you promptly of incidents affecting your data.
- A requirement to remove access when staff leave the vendor.
Have legal check the wording.
Two ways to deliver
- You train them: Consistent content, you hold records; Admin overhead
- They train, you verify: Less work for you; Content varies, evidence quality varies
For high access, train them yourself. For medium access, accept their program plus attestation and a sample of records.
Verify, do not assume
Ask for a roster of people with access and completion dates. Compare to your access list. Remove accounts that cannot be matched to someone trained. Do this each quarter for high access vendors.
Close the loop at offboarding
When a contractor finishes, remove access the same day and log it. Stale vendor accounts are a classic gap.
If you collect vendor evidence in one place, Safeguard's compliance and evidence automation can help organize it, but the training decisions remain with you.
Quick check
Do short term contractors need training?
If they have meaningful access, yes. Keep it short, and require it before access starts.
Can we rely on the vendor's own training?
For medium access, often yes with attestation and sampling. For high access, add your own role content.
Sources
This is general information, not legal advice.
Last reviewed: 19 October 2026.
