Vendor Access Lists: Who Gets Into Your Systems During a Server Move
![Disclaimer of best intentions[edit] Traveling to the Chernobyl exclusion zone 'as a tourist' is often frowned upon and has recently received a lot of bad rep because of attention or thrill seeking individuals. In response to this, some tour](https://1matrixtech.net/blog/assets/commons-82940827-website.webp)
When a small business moves servers, storage, or core applications, the technical steps tend to get the attention. Access rarely does. Yet during a migration, a surprising number of people need to touch the environment: internal staff, outside consultants, remote support providers, on-site technicians, software vendors, and sometimes former contractors whose accounts were never closed. Before any cable is pulled or any workload is replicated, it helps to know exactly who can reach what, who should be able to, and how that will change on migration day. This article walks through a method for building a vendor access list that you can use with any migration partner, including 1 Matrix Tech, and that you can keep current long after the move is finished.
Why access is the first thing to document
Access defines the boundary of a migration. If you do not know which accounts, keys, badges, VPN profiles, and administrative credentials exist, you cannot confidently say what has been moved, what has been secured, and what might be exposed. Many migration problems that look like technical failures are actually access problems: a service account that stopped working because its password was rotated, a firewall rule that only one departed employee understood, or a vendor who could not log in during the cutover window because nobody confirmed their credentials in advance.
Starting with access also reveals the true scope of the environment. Listing the people and organizations with access often surfaces systems that the business had forgotten about entirely. That is useful information regardless of whether the migration proceeds on schedule.
Building the inventory
Create a single document, spreadsheet, or structured record with one row per access path. Each row should capture the person or organization, their role, the system or area they can reach, the method of access (for example, remote login, physical key, badge, shared administrator account, or software license), the business reason they need it, and the date it was last reviewed. Keep the list in a location that more than one authorized person can reach, so that the information survives a single employee's departure.
Include physical access as well as digital access. A server room key that hangs on a hook in the office, or a building code that has not changed in years, belongs on the same list as a VPN account. Physical paths often carry more risk than teams expect because they are easy to overlook during planning.
Questions to answer for each entry
For every access path, ask a short set of questions. Does this person still need it? Who approved it originally, and is that person still with the company? Is the access shared, or is it tied to an individual? If it is shared, how would you revoke it without disrupting other users? When was the credential last changed? Is there a documented way to restore access if the person is unavailable?
Pay particular attention to shared administrator accounts and to accounts used by automated processes. These are common sources of confusion during a move because they often have no obvious owner. Assign a named internal owner to each one, even if the technical work is performed by an outside provider.
Planning access changes for migration day
Migration day usually requires temporary access changes: additional administrators, broader permissions for a cutover team, or vendor logins to systems that normally stay closed. Document each planned change before the window opens. Note who is granted the access, the exact time it begins, the time it should end, and who is responsible for removing it. Expired temporary access is a common leftover that creates lasting exposure after a project is declared complete.
Decide in advance how emergency access will be requested and approved during the cutover. A phone verification step, a named approver, and a written record of what was granted and why will keep the process orderly if something goes wrong at two in the morning.
A practical checklist before the move
Before migration day, confirm that every entry on the access list has a current owner, a documented business reason, and a verified contact method. Confirm that each vendor or provider has been given only the access they need for their scope of work, and that you have written confirmation of who on their side is authorized to act. Verify that any credentials scheduled to rotate during the move have a recorded replacement process. Confirm that you know how to remove each access path quickly if required.
After the move, repeat the review. Remove temporary grants, confirm that expected logins still work, and update the list to reflect the new environment. Schedule a recurring review, such as quarterly or after any staff change, so the document remains accurate. A vendor access list that is only updated during migrations quickly becomes a historical artifact rather than a working control.