Vendor and Third-Party Access Audit
Check who outside the company can reach our systems.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).
Audit third-party access. List of vendors, contractors and agencies with the access they hold, purpose, start date and contract end: [VENDOR_ACCESS]. How access is granted and monitored: [PROCESS]. Data they can see: [DATA_ACCESSIBLE]. Check for access that outlasted the contract, shared credentials, more access than the task needs, no named internal owner, and no record of what they did. Rank by sensitivity of data and breadth of access. Return a table with Vendor, Access, Owner, Risk (red, amber, green) and Action, a template for access agreements in plain language, and a review rhythm. Contract and data duties are [VERIFY] for [JURISDICTION]. Also suggest a rule that vendor access expires automatically unless renewed by the internal owner, and a log of when each vendor last used access, so that unused access can be removed without argument. Keep severity honest: separate confirmed issues from possible ones, give the evidence for each, and recommend a retest after fixes so that closure is verified and not assumed.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.