Policy and Procedure: Vendor access to critical resources including servers 

Policy and Procedure: Vendor access to critical resources including servers 

The references to “you” in this article refer to the tech who is assigned to work with a vendor who needs access to a server that we manage. 

As always, you must use your GGIT phone line for vendor interaction so we have an audio record of the entire interaction. 


I. Procedure Before Granting Access


Before providing access to vendor, the tech is responsible for confirming the following. Do not rely on any other personnel. It is up to you to:

  1. Confirm with the vendor support rep whether there is a risk that the service will go down during the session 
  2. Check with an account authorization contact regarding whether customer’s users are aware the service is going down. If not, we must receive permission first from an authorization contact.
  3. Ascertain how long the vendor expects the work to take, and how long the service will be unavailable. If the work will take past our tech’s hours, another tech should be on hand to take over the monitoring. If not, work should be postponed unless it is urgent (meaning an outage or other urgent matter is being addressed in real time)
  4. If the work must be done urgently and is expected to go past regular hours, you may be expected to remain at work beyond your usual quitting time
  5. If this is not urgent, you may voluntarily stay late, but will not be expected to. 


II. Procedure While Work is in Progress

  1. The tech should monitor the actions of the vendor closely enough to assure that no damage is done and there are no server settings or firewall changes without our permission.
  2. Before granting permission for any changes to the server or server firewall, you must confirm that they will not damage any functionality. If you cannot independently ascertain this, ask a senior team member for help. Do not take the word of the vendor support rep. 
  3. Any such changes to the server or firewall, if permitted by us, must be documented by you in our documentation platform.


III. Procedure after Work is Concluded

  1. The vendor must leave all services in perfect working order before signing off. This must be verified via full testing. 
  2. If we don’t have access to fully test all aspects of the service, ask the customer to test it. Reach out to the customer by any method necessary to ensure they see the request ASAP.
  3. The ticket should always reflect that we asked the customer to test that everything was working. 
  4. If anything is not working, reach out to the vendor as soon as possible. Keep the customer informed of your actions to work with the vendor to get an issues resolved. 

    • Related Articles

    • Access to Company Resources From a Personal Computer - Verbiage

      For Customer considering allowing users to use a personal machine: Hi XXX, I hope all is well. I understand you have a [some/an intern)s)/consultant(s) PICK THE RIGHT ONE AND EDIT CAREFULLY] joining [company name] soon. I'm writing to strongly advise ...

    • Time-Off Policy and Instructions for Full-Time Employees

      Vacation Time Eligibility All full-time employees are entitled to the following paid vacation benefit. A full-time employee is defined as one who consistently works at least thirty-five hours per week. Accrual First two calendar years of sequential ...

    • Paid Sick Leave Policy - Effective January 1, 2025

      Items in green are direct verbiage from the NJ sick leave law Paid Sick Leave Policy Both full-time and part-time employees get a certain amount of paid sick leave every year based on the number of hours worked. Each employee accrues earned sick ...

    • Confidentiality of Vendor Information

      Customers should not know anything about our vendors. If you have to mention that a vendor is working on an issue call them the "back end,” "the engineers" or "back-end support”. If they want to know just say our vendor information is proprietary and ...

    • Policy on Employee Use of Artificial Intelligence

      Purpose: To ensure that employees use AI applications responsibly while safeguarding confidential information and personally identifiable information (PII). Absolutely nothing that, bundled with other information found elsewhere on the internet, has ...