A city allows vendor engineers into internal systems for after-hours repairs but rarely watches those sessions. What oversight should be added to third-party communication channels?
Select an answer to reveal the explanation.
Short Explanation
Vendor after-hours access without a clock, a log, or a watcher is unsupervised keys to the building. Bound the session, record what happens, and require logical escort or dual approval—don’t give forever tunnels or rely on monthly pinky-swears. Hiding accounts from the directory only hides the risk from you.
Full Explanation
After-hours and emergency vendor support still requires continuous oversight: time-bound sessions, detailed logging (and session recording where appropriate), and logical escort or dual-control approval so privileged activity is monitored and constrained. Temporary access windows shrink persistent exposure; recording and dual approval deter and detect unsupervised changes on municipal systems during nights and weekends when fewer staff watch the console.
Granting vendors standing always-on VPN tunnels with no expiry maximizes the window for credential theft and unattended misuse and weakens the ability to prove who did what when. Monthly self-attestation that “nothing improper happened,” without technical monitoring, is insufficient assurance for high-risk support paths. Hiding vendor accounts from the directory so auditors cannot see them undermines identity governance and deliberately blinds review processes.
Exam caveat: third-party access is not exempt from AAA—time limits, logging, and escort/dual control are expected controls, not optional niceties. Operational check: expire vendor sessions by default, require approval for after-hours elevation, retain detailed logs or recordings for support windows, list vendor identities in directories under review, and eliminate standing unmonitored tunnels.