Guide · Access control
Contractor access without shared logins
Affiliate disclosure: This page contains affiliate links, which are labeled. If you buy through one, Small Biz Cyber Guide may earn a commission at no extra cost to you. Recommendations are not for sale. See the full affiliate disclosure.
Contractors need to get work done, but handing over a shared office password gives them more access than the job requires and no clean end date. This guide expands the Short into a start-to-finish method: decide what they actually need, issue it in their own name, time-box it, and close it on a date you set before they start.
Recent breach of this type: Emergency fix for the remote-management tool many MSPs use to run client PCs (disclosed ). A critical flaw hit the console many IT providers use to manage client computers. What happened and what to do →
Quick verdict
- Named, not shared. Give each contractor their own account or a time-boxed vault share — never the team's forever password.
- Least privilege. Grant only the apps, folders, and permissions the task needs. Read-only is enough surprisingly often.
- End date first. Put the revocation date on the calendar the day they start, and revoke the same day the contract ends.
Worth piloting: NordPass Business
A business vault lets you share a single login with a named contractor, set up the share for the job, and end it without changing the password for everyone else. Pilot NordPass Business with a real contractor workflow before you commit.
Before they start: the access request
- Write the job in one sentence and list the exact systems, folders, and data it touches.
- Name a staff sponsor who owns the access and the revocation.
- Decide the end date now — contract end, project milestone, or a review date for open-ended work.
- Agree in writing how they will handle your data, what devices they may use, and that access ends without a reminder.
Granting access the clean way
| Need | Better approach | Avoid |
|---|---|---|
| One shared tool login | Time-boxed vault share to the named contractor | Texting the team password |
| Cloud app work | Named account with the smallest role that works | Making them an admin 'just in case' |
| Files | Share the specific folder, with an expiration where available | 'Anyone with the link' sharing — see our link-sharing guide |
| Remote/system access | Named account plus MFA, removed at end date | A shared remote login left enabled |
Require MFA on contractor accounts where the tool supports it, and keep admin rights with staff. If a contractor needs elevated access for a short task, grant it for that window and remove it when the task is done — do not let a temporary grant become permanent by default.
Revoking on time
On the end date: disable the named accounts, close the vault share, remove file shares, and rotate any credential they could have viewed. The sponsor confirms completion to whoever keeps your access list. This is the same muscle as employee offboarding — practising it with contractors, who come and go more often, makes both processes reliable.
Bottom line
Named, not shared. Give each contractor their own account or a time-boxed vault share — never the team's forever password. The expanded steps above turn the Short's rule into a process with an owner and a check — do the first section today, schedule the rest this week, and write down what you changed so the next person does not have to rediscover it.
Prefer video? Watch the under-a-minute version on YouTube: Contractor Access Without Shared Logins.
Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.
Put contractor access in writing. The Small Business Security Essentials Toolkit ($79) includes an editable Contractor & Vendor Access policy and an access register with end dates, days left, and overdue flags, so every outside account has an owner and an expiry.