# Vendor Access Review Micro-Course

A free, reviewable cybersecurity training package for teams that need to teach employees how to request, approve, renew, and remove third-party access without turning the access review into a checkbox exercise.

Use this as a starter asset in AI Studio by Jericho. Replace the placeholders, adapt the scenarios to your approved systems and review cadence, and route the draft through security, IT, GRC, vendor-risk, privacy/legal, and L&D review before publishing.

## Course snapshot

- **Audience:** Employees, managers, vendor owners, service owners, MSP/vCISO client teams, and operations leaders who request or approve third-party access.
- **Duration:** 6 to 8 minutes.
- **Format:** Micro-course with three scenarios, three quiz questions, remediation note, and LMS packaging guidance.
- **Learning goal:** Help learners recognize when vendor access should be limited, verified, renewed, or removed through the approved process.
- **Review boundary:** This course supports policy communication and training workflows. It is not legal advice, a compliance guarantee, or proof that access controls are effective.

## Learning objectives

By the end of this lesson, learners should be able to:

1. Identify when a vendor or contractor access request needs verification before approval.
2. Explain why access should match the work, role, system, time period, and approved owner.
3. Recognize common pressure tactics that lead to overbroad or lingering access.
4. Use the approved process to report stale, excessive, unexpected, or unclear access.
5. Describe why periodic review matters for vendor-risk, audit, and security workflows.

## Lesson script

Vendor access is one of those security topics that sounds administrative until something goes wrong. A contractor needs a portal account. A vendor support engineer needs temporary access. An integration account needs permissions. A consultant needs files. A managed service provider needs a dashboard. Each request may be reasonable. The risk appears when access becomes broader than the work, lasts longer than the engagement, or bypasses the person who should approve it.

Good vendor access review is not about slowing the business down. It is about making sure access still matches the job. The practical question is simple: who has access, to what, why, for how long, and who still owns the decision?

When you request or approve vendor access, check the purpose first. What work is the vendor doing? Which system or data do they need? Is the access read-only, administrative, temporary, or ongoing? Does the request match the contract, statement of work, ticket, or approved project? If the access seems broader than the task, pause and ask for the right scope before approving.

Next, check the owner. Vendor access should have a named business or system owner who can confirm the need. If the request arrives from an unfamiliar person, a personal email account, a chat message, or an urgent phone call, use the approved verification path. Do not approve access because someone sounds rushed, senior, technical, or helpful.

Time matters too. Temporary work should not create permanent access. If the vendor is helping with a migration, support ticket, audit, maintenance window, or implementation, the access period should match that work. If access needs to continue, renew it through the approved review process instead of letting it quietly linger.

Reviews are not just for IT. Managers, project owners, procurement, vendor-risk, compliance, and system owners may all have a role. During a review, look for access that no longer matches reality: former vendors, old projects, accounts with no active owner, shared credentials, excessive permissions, unused integrations, unknown service accounts, and access that was granted as an exception but never cleaned up.

If something does not look right, the safe next step is not to guess. Use the approved reporting or review channel. Say what you noticed, which system or vendor is involved, and why the access may need review. Security and IT can help confirm whether access should be changed, renewed, documented, or removed.

The goal is not to memorize every access rule. The goal is to build a habit: before approving, renewing, or ignoring vendor access, make sure the access has a current purpose, proper scope, named owner, appropriate time limit, and approved review path.

## Scenario 1: The urgent support request

A vendor support engineer emails a project manager during an outage window:

> We need admin access to the production dashboard for the rest of the week so we can troubleshoot quickly. Please approve ASAP or the fix may be delayed.

**Better decision:** Verify the request through the approved support ticket or vendor contact path. Confirm the system, role, access level, time period, and owner. If admin access is justified, make it time-bound and documented. If a narrower role will work, use the narrower role.

**Teaching point:** Urgency does not remove the need for scope, ownership, and documentation. The right process helps the business move without creating unnecessary standing access.

## Scenario 2: The forgotten implementation account

During a quarterly access review, a department lead sees an account for an implementation consultant who finished the project months ago. The account still has access to shared project files and a reporting dashboard.

**Better decision:** Do not assume someone else handled it. Flag the account through the approved access review process, confirm whether there is still an active business need, and request removal or renewal based on the current owner’s decision.

**Teaching point:** Old access is easy to miss because it once made sense. Reviews help teams compare access against today’s work, not last quarter’s project plan.

## Scenario 3: The integration nobody owns

A vendor integration account appears in a review export. It is tied to a tool the team still uses, but nobody knows who owns the integration or whether the permissions are still appropriate.

**Better decision:** Escalate through the approved review path. Identify the system owner, vendor owner, and technical owner before changing anything. Confirm whether the integration is still needed, whether the permissions are least-privilege enough for the current workflow, and whether the account has the right monitoring and renewal process.

**Teaching point:** Unknown ownership is itself a review finding. The answer is not instant deletion or blind renewal. The answer is to identify the owner and make an evidence-aware decision.

## Knowledge check

### Question 1

A vendor asks for broad administrative access because they are troubleshooting a time-sensitive issue. What is the best next step?

A. Approve immediately because speed matters during troubleshooting.  
B. Deny all vendor access until the next quarterly review.  
C. Verify the request through the approved path, confirm scope and owner, and use the narrowest time-bound access that fits the work.  
D. Share a coworker’s account so the vendor does not need a new login.

**Correct answer:** C

**Teaching feedback:** A real support need can still be handled through the approved process. Confirm who is asking, what access they need, why they need it, who owns the decision, and when the access should end.

### Question 2

During an access review, you find a vendor account tied to a project that appears complete. What should you do?

A. Ignore it because the account was approved originally.  
B. Flag it through the approved review process so the current owner can confirm renewal or removal.  
C. Immediately delete it without checking ownership or impact.  
D. Email the vendor and ask whether they still want the access.

**Correct answer:** B

**Teaching feedback:** Access that was once appropriate may become unnecessary later. Reviews should compare access against current work and route uncertainty through the approved owner and process.

### Question 3

Why does named ownership matter for vendor access?

A. It gives employees someone to blame.  
B. It helps confirm business need, scope, renewal, and removal decisions.  
C. It means the vendor can decide their own permissions.  
D. It removes the need for periodic access reviews.

**Correct answer:** B

**Teaching feedback:** A named owner helps the organization make a current, accountable decision about whether access still fits the work. Ownership supports review, escalation, and cleanup.

## Remediation note for follow-up training

If a learner misses this module after a simulation, audit finding, or access review issue, reinforce the habit rather than scolding the person:

> Vendor access should match the work happening now. Before approving or renewing access, confirm the business purpose, system, permission level, time period, and named owner. If the request is urgent, unclear, overbroad, or no longer tied to active work, use the approved review path before acting.

## AI Studio prompt

Copy, paste, and adapt this prompt inside AI Studio by Jericho:

> Create a 6-minute cybersecurity micro-course for employees and managers on vendor access review. Use our approved access request system: [SYSTEM]. Use our vendor-risk or procurement owner: [OWNER]. Use our reporting path: [REPORTING PATH]. Cover urgent support requests, stale vendor accounts, overbroad permissions, temporary access, integration ownership, and periodic review. Include three workplace scenarios, three quiz questions with teaching feedback, a remediation note, captions/transcript guidance, LMS-ready export notes, and assumptions that require security, IT, GRC, vendor-risk, privacy/legal, and L&D review before publishing.

## LMS packaging guidance

Package this as a short module for onboarding, annual refreshers, manager training, vendor-risk remediation, or post-review follow-up.

Recommended metadata:

- **Title:** Vendor Access Review: Approve, Renew, or Remove?
- **Category:** Security Awareness / Vendor Risk / Access Review
- **Duration:** 6 to 8 minutes
- **Completion:** Lesson viewed plus quiz passed according to your LMS rules
- **Exports:** SCORM, xAPI, HTML, or PDF when configured and reviewed appropriately
- **Accessibility review:** Captions/transcript, clear quiz feedback, mobile-readable scenarios, and plain-language definitions for vendor access, owner, temporary access, and access review

## Human review checklist

Before publishing, confirm:

- Security and IT agree with the access request and escalation language.
- Vendor-risk, procurement, or GRC reviewers agree with the vendor-owner workflow.
- Privacy/legal reviewers have inspected references to regulated, customer, employee, CUI, contract, or confidential data when applicable.
- L&D confirms the course is clear, accessible, and appropriate for the audience.
- System names, review cadence, reporting path, and owner roles match the organization’s approved process.
- The course does not imply legal advice, compliance certification, breach prevention, or guaranteed behavior change.

## CTA

Build your own policy-fit version in AI Studio by Jericho: https://contentstudio.jerichosecurity.com/campaigns/course-giveaway-vendor-access-review?utm_source=owned&utm_medium=giveaway&utm_campaign=vendor_access_review_course_giveaway&utm_content=markdown_course_cta