Skip to content
Cyber Replay logo CYBERREPLAY.COM
Book a Call
Back to all articles
Security Operations 17 min read Published Apr 1, 2026 Updated Apr 1, 2026

Vendor Access Governance: Audit Worksheet for Nursing Home Directors, CEOs, and Owners

Practical vendor access governance audit worksheet for nursing home directors, CEOs, and owners to reduce third-party risk, speed remediation, and protect

By CyberReplay Security Team

TL;DR: Use this practical vendor access governance audit worksheet to find and fix risky third-party access in 2-6 hours, reduce breach likelihood by an estimated 30% - 50%, and bring vendor access into SLA-aligned control. Includes checklists, CSV-ready worksheet, remediation SLAs, and next-step MSSP/MDR options.

Table of contents

Quick answer

Vendor access governance audit worksheet nursing home directors ceo owners very: Direct, practical steps for nursing home leadership to run a targeted vendor-access audit using the worksheet below. Focus on privileged and remote access, require least-privilege and time-bound sessions, enforce multi-factor authentication and session logging, and assign remediation SLAs. Expect to close the highest-risk vendor access cases in 1-4 weeks and reduce exposure to third-party compromise by approximately 30% to 50% depending on control adoption.

If you prefer an external guided assessment, consider two short, authoritative assessment options that are free or low friction and tailored for healthcare operators: the CISA Ransomware Readiness Assessment for operational resilience and the HHS/HealthIT Security Risk Assessment tool for HIPAA-focused review. CISA RRA: https://www.cisa.gov/ransomware-readiness-assessment. HHS/HealthIT SRA tool: https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool.

This worksheet is designed to be completed in 2 to 6 hours for a focused inventory pass, or extended into a 30, 60, or 90-day remediation plan when combined with the SLA examples below.

Why this matters now

Nursing homes hold protected health information and operate medical devices, payment systems, and resident records. A single compromised vendor account can give attackers broad lateral access with patient safety and regulatory consequences - including HIPAA penalties and operational disruption.

If vendor access is unmanaged, expect longer incident response times and higher remediation costs. Fixing access problems proactively is usually 5x cheaper than incident-driven remediation.

This document includes a ready-to-use audit worksheet, prioritized remediation guidance, measurable SLA examples, and recommended next steps including managed detection and response (MDR) or MSSP services. For hands-on help, consider a short assessment from a managed provider like CyberReplay managed services or a targeted incident readiness check at CyberReplay cybersecurity help.

Who should run this audit

  • Nursing home directors, CEOs, and owners who own compliance risk
  • IT or managed IT staff responsible for access provisioning and device configuration
  • Compliance officers and privacy officers preparing for audits

If you have a large vendor estate or outsourced IT, run this with your MSP/MSSP or use an MDR partner to collect logs and validate sessions.

Audit goals and measurable outcomes

Make outcomes explicit before you start. Example target outcomes for a 90-day program:

  • Inventory coverage: 95% of vendors with any network, VPN, remote desktop, SFTP, or cloud admin access documented within 14 days.
  • Risk closure: Remediate all high-risk vendor accesses (risk score >= 8/10) within 30 days.
  • Authentication improvement: Enforce MFA on 100% of vendor accounts accessing systems with PHI within 60 days.
  • Monitoring: Enable session logging for all remote vendor sessions within 30 days; forward logs to SIEM or MDR with 30-day retention.
  • SLA: Mean time to revoke vendor access after SLA breach = 4 hours for critical incidents; 72 hours for non-critical.

Quantified impact examples:

  • Time saved: a disciplined audit process reduces triage time during incidents by up to 40% because vendor access is pre-documented and auditable.
  • Risk reduction: implementing least-privilege, MFA, and session logging typically reduces exposure to credential-based lateral movement by 30% - 50% in practice.
  • SLA impact: clear SLAs reduce vendor remediation latency from weeks to hours in critical scenarios, cutting potential downtime and regulatory exposure.

Audit preparation checklist

  • Appoint the audit owner: Director, CIO, or delegated security lead and a second reviewer.
  • Gather source lists: VPN logs, RDP/VDI provider, remote support tools (TeamViewer, AnyDesk), cloud IAM, active directory service accounts, vendor onboarding records, contract repository.
  • Ensure access for log review: SIEM/MDR console or event log access is required to validate active sessions.
  • Prepare communication plan: Vendor notification template and escalation contact list.

Checklist example (printable):

  • Audit owner assigned
  • Vendor list exported from procurement and IT
  • Remote access tool inventory completed
  • SIEM or log access confirmed
  • Contract and BAA status reviewed

Vendor access governance audit worksheet - fields and how to use it

Use this CSV-ready worksheet to capture every vendor connection. Save as vendor-access-audit.csv and open in Excel or Google Sheets. The minimal fields below are what auditors need to make rapid risk decisions.

Example CSV header - copy into a file named vendor-access-audit.csv

VendorName,PrimaryContact,ServiceProvided,HasBAA,AccessType,Protocols/Tools,Accounts,Privileged(Y/N),MFA(Y/N),SessionLogging(Y/N),AccessStartDate,AccessEndDate,Justification,LastUsed,ContractExpiry,RiskScore,RemediationAction,RemediationSLA,Owner

Field definitions and usage notes:

  • VendorName: Legal name used in contracts.
  • PrimaryContact: Name and phone/email for escalation.
  • ServiceProvided: Short description - e.g., EHR support, lab interface, HVAC control.
  • HasBAA: Yes/No answer for HIPAA Business Associate Agreement.
  • AccessType: Remote / Onsite / Cloud API / Service Account.
  • Protocols/Tools: VPN, RDP, SSH, SFTP, Azure AD, Google Workspace, TeamViewer, vendor portal.
  • Accounts: List specific user or service accounts used by vendor.
  • Privileged(Y/N): Does the vendor use admin/privileged accounts?
  • MFA(Y/N): Is multi-factor authentication enforced for vendor accounts?
  • SessionLogging(Y/N): Are sessions recorded and retained? If yes, where?
  • AccessStartDate / AccessEndDate: Dates for time-bound access.
  • Justification: Business reason for access.
  • LastUsed: Date the vendor last connected.
  • ContractExpiry: Contract end date.
  • RiskScore: 1-10 scoring - see scoring below.
  • RemediationAction: E.g., disable account, require MFA, rotate credentials, narrow ACLs.
  • RemediationSLA: e.g., High - 72 hours; Critical - 4 hours.
  • Owner: Internal staff responsible for completing remediation.

Populate this workbook and then filter by RiskScore and Privileged to prioritize.

Step 1 - Inventory all vendor access (2-4 hours)

Goal: find every place vendors can authenticate or maintain a persistent session.

Actions:

  • Export accounts from Active Directory with “vendor” naming conventions or service account flags.
  • Query VPN authentication logs by source IP and user-agent for external vendor IP ranges.
  • Check remote support tools inventory - many vendors use TeamViewer, AnyDesk, LogMeIn, or vendor portals.
  • Review cloud IAM roles and API keys in Azure, AWS, or Google Cloud for accounts tagged by vendor or by service.
  • Cross-check procurement and contract lists to find expected vendor accesses and fill gaps.

Concrete command example for Active Directory last logon (run in a privileged admin shell):

# Example: export last logon for all service/vendor accounts
Get-ADUser -Filter * -Properties LastLogonDate,Description |
Where-Object { $_.Description -match 'vendor|service' } |
Select-Object Name,SamAccountName,LastLogonDate,Description |
Export-Csv -Path C:\temp\vendor_accounts.csv -NoTypeInformation

Time estimate: small org 2 hours; medium 4-8 hours including log pulls.

Step 2 - Validate why and scope of access (1-2 hours per vendor)

Goal: confirm business justification and whether access is correctly scoped and time-bound.

Actions:

  • For each vendor row, confirm business need in 1 sentence and align to contract clauses.
  • Ask: Does the vendor require persistent admin credentials or can access be task-based with temporary elevation?
  • Validate account ownership: Is a named vendor employee listed? If not, switch to per-person accounts rather than shared credentials.
  • Check BAAs and data processing agreements. If no BAA exists for PHI access, escalate immediately.

Document decision: If access is unnecessary or not justified, mark RemediationAction: Revoke access and set RemediationSLA to Critical - 4 hours.

Step 3 - Risk-score and prioritize remediation (30-90 minutes)

Use a simple risk formula combining sensitivity, privilege, access vector, and logging.

RiskScore example calculation (1-10):

  • Privilege: Admin = +3, Standard = +1
  • Data sensitivity: PHI = +3, PII = +2, Non-sensitive = 0
  • Remote external access = +2
  • MFA missing = +2
  • Session logging missing = +1

Add up points then normalize to 1-10 scale. High-risk >= 8, Medium 5-7, Low <= 4.

Prioritization:

  • High: Immediate remediation; remove persistent access, require per-session access with approval, enable MFA and logging.
  • Medium: Remediate within 30 days and implement MFA and narrower ACLs.
  • Low: Review at next contract renewal but document controls.

Step 4 - Apply controls and SLAs (ongoing)

Controls to enforce immediately for high and medium risk:

  • Require MFA for all vendor access to systems with PHI and critical operational systems.
  • Move from shared credentials to individual vendor accounts with time-limited access tokens.
  • Where possible, use jump hosts or privileged access management (PAM) to broker vendor sessions and record keystrokes and commands.
  • Enforce least privilege by scoping roles and using role-based access control.
  • Log and monitor sessions in SIEM or via an MDR provider and set alerts for unusual activity.

SLA examples to include in remediation action plans and vendor contracts:

  • Critical security incident: vendor must respond by phone within 1 hour; vendor access revoked in 4 hours unless validated.
  • Configuration or control gaps: vendor to remediate misconfigurations within 72 hours.
  • Contract non-compliance discovered in audit: vendor remediation plan within 14 days or contract termination review.

Sample contract clause language to request from procurement:

“Vendor will support least-privilege access models and enable MFA for all accounts used to access customer systems. Vendor will provide session logs for all remote access within 24 hours upon request. Failure to remediate security gaps within the agreed SLA may result in access suspension.”

Step 5 - Monitoring and review cadence

Short term: daily review for critical vendor access changes for the first 30 days after audit.

Ongoing cadence:

  • Weekly: high-risk vendor access review and log spot checks for active sessions.
  • Monthly: reconcile vendor list with procurement and contract expiries.
  • Quarterly: formal vendor access governance review and tabletop exercise with vendor contacts.
  • Annually: full contract and BAA review with security controls verification.

Recommended monitoring metrics to track:

  • % of vendor accounts with MFA enabled
  • Mean time to revoke compromised or unapproved vendor accounts
  • Number of vendor sessions recorded in SIEM per month
  • Time from detection to containment for vendor-sourced alerts

Implementation examples and scenarios

Scenario 1 - EHR vendor uses shared admin account

  • Problem: Shared account used by multiple vendor technicians to edit resident records.
  • Immediate actions: Disable shared account; create named accounts; require MFA and session recording via PAM; rotate credentials and change system logs to tag vendor activity.
  • Outcome: Root cause (shared credentials) removed. Time to identify vendor activity in an incident dropped from 6 hours to under 60 minutes. Regulatory risk reduced because actions are attributable.

Scenario 2 - HVAC vendor has VPN credentials to control building systems

  • Problem: HVAC vendor credentials allow network pivoting into clinical workstation VLAN.
  • Immediate actions: Implement network segmentation and restrict vendor VPN to management VLAN and specific IPs. Require MFA and scheduled windows for access.
  • Outcome: Attack surface reduced; potential lateral movement blocked. Downtime risk for clinical systems reduced dramatically.

Scenario 3 - Lab interface vendor stores API keys in vendor portal

  • Problem: API keys are long-lived and exposed in a breached vendor portal.
  • Immediate actions: Rotate API keys, implement short-lived tokens or OAuth where possible, and require vendor to sign revised BAA clause for key handling.
  • Outcome: Exposure window shrunk from months to hours if compromise occurs.

Common objections and direct answers

Objection: “We cannot require MFA because our vendor tools do not support it.” Answer: Require the vendor to use a brokered access method such as a PAM jump host or configure conditional access that forces MFA at the authentication gateway. If vendor cannot support acceptable controls, restrict their access to non-sensitive systems and document the risk in contract and executive sign-off.

Objection: “Vendors say we need shared accounts to do scheduled maintenance out of hours.” Answer: Use named service accounts with scheduled time-bound credentials or job-runner accounts that rotate credentials automatically. Modern PAMs can provide scheduled access without exposing permanent credentials.

Objection: “We cannot revoke a vendor quickly or risk breaking patient care.” Answer: Implement time-bound access and pre-approved maintenance windows with staged fallback plans. Add emergency contact clauses and an emergency access revocation procedure so you can cut access for safety while preserving continuity via alternate approved processes.

Get your free security assessment

If you want practical outcomes without trial-and-error, schedule a short assessment and we will map top risks, quickest wins, and a 30-day execution plan. Examples of useful assessment paths:

If you prefer hands-on help from an MSSP or MDR, those partners can ingest logs, validate active sessions, and implement quick remediations. See managed options in the Next steps section.

Next steps for MSSP, MDR, and incident response support

If your team is under-resourced, consider one of the following immediate actions:

  • Run a focused vendor access assessment with an MSSP to collect logs and validate remote sessions. Example provider resources: CyberReplay managed security services.
  • Engage an MDR partner to ingest vendor session logs and provide 24-7 monitoring for vendor-sourced alerts.
  • Schedule an incident response readiness review to ensure your vendor revocation and remediation SLAs are operable.

For quick help and to schedule an assessment-oriented review, see CyberReplay cybersecurity help and the incident assistance page. These services can validate your worksheet outputs, run log hunts for active vendor sessions, and help draft vendor SLA language for contracts.

References

Note: all references above are source pages or guidance pages and are intended to support the audit steps, contractual language, and assessment options discussed in this worksheet.

Frequently asked questions

What is vendor access governance and why is it different from normal IT access control?

Vendor access governance is the set of policies, controls, and operational processes focused specifically on third-party accounts, remote tools, and contractual obligations. It differs from internal IT access control because vendors are external entities with separate SLAs, contractual terms, and potential cross-tenant risks. Governance must include contract clauses, BAAs for PHI, and proving the vendor’s security posture.

How quickly can a nursing home expect to close high-risk vendor access findings?

For a typical nursing home with a single EHR and common vendor tools, you can close the highest-risk findings in 1-4 weeks if you have authority to implement controls. Immediate high-risk revocations should be executed within 72 hours and critical incident revocations within 4 hours when necessary. Working with an MSSP or MDR can compress investigation time by up to 50%.

Do I need expensive tools like PAM to do this audit?

No. The audit worksheet and basic remediation steps can be performed with existing logs, account inventories, and access controls. However, PAM and jump hosts significantly reduce operational overhead and improve auditability for long-term governance. If budget is limited, prioritize MFA, session logging, and account uniqueness first.

What if a vendor refuses to sign a BAA or implement controls?

Refuse or restrict access to systems with PHI. Document the decision and get executive sign-off if you must accept residual risk. For critical services where no compliant vendor exists, implement compensating controls such as aggressive segmentation, continuous monitoring via MDR, and formal acceptance logs.

How does this help during an incident?

Having a current vendor access inventory and recorded sessions cuts incident triage time. You can identify vendor-originated sessions, revoke access rapidly, and provide evidence for regulators. This reduces containment time and can materially lower breach cost and operational downtime.

How often should this vendor access audit be run?

At minimum, run a focused audit every 6 months. For high-risk vendors or after any third-party security incident, run an immediate targeted re-audit.

Conclusion and clear next step recommendation

If you are a nursing home director, CEO, or owner, start with a one-day focused vendor access inventory using the provided CSV worksheet. If your IT team lacks the time or visibility, schedule a short vendor access assessment with a managed security provider. A 1-2 day assessment from an MSSP or MDR partner can identify critical exposures, implement MFA and session logging, and reduce your vendor-derived attack surface by an estimated 30% - 50% within 60 days.

For fast support, request a vendor access assessment or MDR onboarding review at CyberReplay managed services or get an incident readiness check at CyberReplay cybersecurity help.

When this matters

When to run this audit now: when you have external vendors with any form of remote or privileged access to systems that contain PHI, payment card data, or clinical device control. Typical triggers include onboarding a new EHR vendor, a recent vendor security incident, contract renewals within 90 days, unexplained service accounts in Active Directory, or after detecting unusual remote sessions. This vendor access governance audit worksheet nursing home directors ceo owners very clearly highlights the immediate steps to reduce exposure and prioritize quick wins.

Examples that should trigger an immediate audit:

  • A vendor reports a compromise of their credentials or portal.
  • You discover shared vendor admin accounts or long-lived API keys.
  • A new integration provides vendor access to resident records or medical devices.
  • You are preparing for a HIPAA or state inspection that includes third-party oversight.

If any of the above apply, move to a prioritized remediation track using the RiskScore and SLA tables in this worksheet.

Definitions

  • Vendor access governance: Policy, process, and controls that manage how external service providers and contractors access your IT systems, data, and devices.
  • PHI: Protected Health Information covered by HIPAA that, if exposed, creates regulatory and patient-safety risk.
  • BAA: Business Associate Agreement, the contract that defines responsibilities for handling PHI.
  • MFA: Multi-factor authentication, an authentication method using two or more proof factors.
  • PAM: Privileged Access Management, systems used to broker and record privileged sessions.
  • SIEM: Security Information and Event Management system used for collecting and analyzing logs from vendor sessions and other sources.
  • MDR: Managed Detection and Response, a third-party service that monitors telemetry, hunts for threats, and supports response.
  • MSSP: Managed Security Service Provider, a vendor that may provide monitoring, log collection, and incident support.
  • Session logging: Recording of remote vendor sessions including commands, file transfers, and timestamps for audit and forensics.

Common mistakes

  1. Assuming contracts alone are sufficient. Fix: enforce technical controls such as MFA and session logging and map contract clauses to technical verification steps.
  2. Using shared vendor credentials. Fix: require per-person accounts or brokered temporary access via PAM and rotate credentials automatically.
  3. Ignoring long-lived API keys and service accounts. Fix: discover, rotate, and move to short-lived tokens where possible.
  4. Not correlating vendor sessions in logs. Fix: forward vendor logs to SIEM or MDR and create vendor-specific alerting rules.
  5. Overlooking BAAs for PHI access. Fix: inventory PHI access and escalate any missing BAAs to legal and executive leadership.
  6. Delayed revocation procedures. Fix: pre-authorize emergency revocation steps in vendor contracts and test the process during tabletop exercises.

Each mistake above maps to a remediation action in the worksheet and to an SLA example in the controls section.

FAQ

Q: Is this audit appropriate for small nursing homes with minimal IT staff? A: Yes. The core inventory and risk scoring can be done in 2 to 6 hours. Small sites should prioritize MFA, remove shared accounts, and use vendor procurement to enforce BAAs.

Q: What if a vendor provides critical clinical functionality and refuses technical controls? A: Document the residual risk, escalate to executive leadership for an acceptance decision, and implement compensating controls such as strict segmentation, continuous monitoring via MDR, and additional session supervision.

Q: How do I show regulators that I have effective vendor access governance? A: Keep the completed CSV worksheet, contract BAAs, logs showing vendor sessions, remediation tickets and SLA evidence. Use the worksheet to demonstrate a repeatable process that links inventory to remediation and monitoring.