How do I check an IT consulting firm’s remote access to client systems before buying?

An IT consulting firm may hold the keys to many other businesses’ systems. When you buy it, you take responsibility for those keys, and for any misuse before you arrived. Begin by asking for an inventory: each client, what the firm can reach, how it connects and who at the firm has the login details.

Next, look at how credentials are kept. Are passwords shared in a spreadsheet, a chat thread or a person’s memory, or kept in a managed vault with individual accounts? Ask how access is granted to new staff and removed when someone leaves. Check whether anyone departed recently and whether their access was closed on time.

Ask how access is logged and reviewed, and whether clients have been told what the firm can see. Review the service agreements to see what clients expect and what the firm promised. Ask whether there has ever been a breach, a mistake with client data or a complaint. Consider hiring an independent security reviewer to test the setup. Your lawyer can advise on client contracts and on privacy duties, and you should plan to reset every credential soon after closing, with each client told in advance.

Key takeaways

• Get an inventory of client systems, connection methods and who holds each credential.
• Check how access is added, logged and removed when staff leave.
• Plan an independent review and a credential reset for the first days after closing.