When a team works from many places, remote access stops being an exception and becomes part of how work gets done. That makes it easy to lose track of. Accounts are opened for a project and never closed, a contractor keeps access after the work ends, and nobody is sure who can connect from outside. A simple remote access record keeps that knowable.
One thing to be clear about before you start. Nothing here tells you whether any document satisfies anything, and nothing here identifies what you are obliged to produce. Which frameworks, standards and obligations apply to an organization varies by organization, by industry and by jurisdiction, and working out which ones apply to you belongs with a qualified professional who knows your situation. This article covers the record and the process around it. It does not describe how to set up or configure any remote access method. Which method your organization uses, and how it is set up, belongs with whoever manages your systems, working with qualified professionals.
What the record holds
Keep one row per person or outside party with remote access.
| Field | What to write |
|---|---|
| Person | The individual, never a shared account |
| Role | Employee, contractor or outside party |
| Systems reached | What they can use from outside |
| Method | The approved remote access method, by its internal name |
| Approved by | Who approved the access, and the date |
| Device | The device the access is used from, if your organization records it |
| End date | When access is due to end, for contractors and projects |
| Last reviewed | The date of the most recent access review |
The written decisions behind it
Alongside the list, write down the decisions it depends on, in a page or two:
- Who may have remote access and who approves it.
- The approved method or methods, by their internal names, so there is one route rather than several.
- What happens when someone leaves or changes role, so that remote access is part of the offboarding checklist.
- How often access is reviewed, on a cadence your organization chooses.
How to build it
- Ask whoever manages your systems for the current list of people and parties with remote access.
- Match each entry to an approval. Where no approval can be found, record it as an open question with an owner.
- Add end dates for every contractor and project-based entry.
- Link it to onboarding and offboarding so that every joiner and leaver updates the record.
Keeping it current
Review the full list on the cadence you chose, and record each review with its date, who took part and what changed. Pay particular attention to entries past their end date and to accounts nobody recognizes.
What the record is not
The record shows who can connect from outside and on whose approval, as of a date. It does not show that any connection is safe, and it is not a credential.
When you are ready to gather the documents that sit alongside this one, work through the Trust Center Document Checklist page on this site and fill the gaps one document at a time.