Privileged Access Management: 3 Questions Every CEO Must Ask Their IT Firm

Right now, somewhere between two and twenty people at your IT company can log into your systems with full administrative rights. They can read your files, access your email archive, reset employee passwords, and touch your financial systems. Do you know exactly how many? Do you know their names? Do you know whether those credentials get rotated when someone leaves that firm? Most CEOs don’t. And most IT vendors are counting on that.

Why Privileged Access Management Is the Real Security Conversation

Most security conversations between IT vendors and their clients circle around firewalls, antivirus, and backups. Those are real. But they protect against external threats. The more uncomfortable conversation is about internal access – specifically, who inside your IT vendor’s organization can walk into your systems right now, with no announcement, no ticket, and no oversight.

According to the Cybersecurity and Infrastructure Security Agency (CISA), insider threats – whether malicious or accidental – are among the most damaging categories of security incidents. An IT vendor employee with unchecked administrative access to your environment is an insider threat waiting to materialize. That’s not a criticism of vendors. It’s a structural reality most businesses have never been asked to confront.

This post isn’t about paranoia. It’s about three precise questions that any competent IT firm should answer immediately. If they can’t, that tells you something important about how they’re managing your risk.

Question One: How Are Administrative Credentials Issued?

Start by understanding how your IT firm creates and assigns the accounts they use to manage your systems. This sounds technical, but the answer should be entirely explainable in plain language.

What you’re looking for: does the firm use individual named accounts for each technician, or does everyone share a single generic administrative account? Shared credentials are one of the most common – and most damaging – practices in the industry. When five technicians all use the same username and password to access your systems, you have no way of knowing which person made a change, reviewed a file, or triggered an event.

A firm with real controls will tell you that every technician who touches your environment has their own uniquely named account tied to their employment status, and that access is provisioned based on role. A junior helpdesk analyst should not have the same reach into your environment as a senior engineer. That separation – called least-privilege access – is foundational to sound privileged access management.

The follow-up question is simple: “Can you show me a list of every account with administrative rights to my environment?” A firm with real controls can pull that list in minutes. A firm without them will stall, generalize, or redirect the conversation.

What to Listen For

• Individual named accounts per technician, not shared credentials
• Role-based access – not everyone gets the highest level of rights
• A documented process for provisioning new accounts when a technician is onboarded
• The ability to produce an access list for your environment on request

Question Two: How and When Are Credentials Rotated?

Credential rotation means changing passwords and access keys on a defined schedule – and immediately when something changes, like a technician leaving the firm. It’s the second pillar of a credible privileged access management program.

The single most common access control failure isn’t a hacker breaking through a firewall. It’s a former vendor employee who still has working credentials to your environment months after they left. It happens constantly, across every industry and every size of business.

Ask your IT firm directly: “What happens to my system credentials when one of your technicians leaves your company?” The answer you want: access is revoked within hours of departure – not days – and any passwords that person held are rotated at the same time. The answer you don’t want: “we handle that on a case-by-case basis,” or a long pause.

Ask about scheduled rotation too. Even without a personnel change, administrative passwords should rotate on a regular cycle. A firm that can’t name a specific rotation schedule is likely not rotating at all.

The deeper question: does the firm use a dedicated credential management system – a secure vault that stores, tracks, and automates rotation – or are credentials tracked in a spreadsheet, a shared document, or someone’s memory? The former is a business practice. The latter is a liability.

What to Listen For

• Immediate access revocation when a technician leaves – within hours
• A named rotation schedule, not “we do it periodically”
• A dedicated credential vault or password management system, not a shared document
• Rotation triggered by any security event, not just scheduled cycles

Question Three: Who Audits the Auditors?

This is the question most CEOs never think to ask – and arguably the most important one. Credential issuance and rotation policies only matter if someone is verifying they’re actually being followed. That verification is an audit function, and the question is whether your IT firm submits to any independent review of their own security practices.

This isn’t about trust. Trustworthy firms welcome the question because they have a real answer. What you’re probing for is whether the firm’s security posture is self-reported or independently verified. An IT company that says “we take security seriously” but has no external validation is asking you to take their word for it. An IT company that holds an independently audited security certification is asking you to trust a third party’s findings instead.

Look for firms audited against recognized frameworks. The NIST Cybersecurity Framework and the CIS Critical Security Controls are two of the most respected benchmarks for evaluating an IT service provider’s internal controls. Some firms hold certifications like SOC2 (the audit framework) or industry-specific trustmarks that require annual reassessment by credentialed assessors.

For context: Xact IT Solutions holds the GTIA Cybersecurity Trustmark, audited annually since 2021 by Versprite – a CREST-accredited assessor – against CIS Critical Security Controls IG2 with supplementary ISO 27001 controls. That annual audit gives clients an external reference point beyond our word. It’s not common in this industry. It should be.

If a firm can’t name the framework they’re audited against, name the auditing firm, or tell you when the last assessment occurred, the audit almost certainly doesn’t exist.

What to Listen For

• A specific, named security framework the firm is audited against
• An independent, credentialed assessor – not a self-assessment or internal review
• A recurring audit cycle, not a one-time certification
• Willingness to share audit findings or a summary attestation with clients

What a Mature Privileged Access Management Answer Sounds Like

When you ask these three questions, a firm with genuine privileged access management practices will answer without hesitation. They’ll name specific tools, specific policies, and specific people responsible for oversight. They won’t be defensive. They’ll likely be relieved you asked – it signals you’re the kind of client they want to work with.

A mature answer to “how do you manage access to my environment?” sounds like this: every technician has an individual named account; access is tiered by role; all credentials are stored in a dedicated vault; rotation happens on a defined schedule and immediately upon any personnel change; and the entire program is reviewed annually by an external assessor.

That’s not a high bar. It’s a baseline. But in practice, many IT firms – particularly smaller ones – are nowhere near it. Because most clients never ask, those firms have little incentive to build these controls.

You can learn more about the service structure that underpins these controls on our cybersecurity services page. You may also want to review our broader managed IT services to understand how access governance fits into day-to-day operations.

Red Flags That Should End the Conversation

Some answers should immediately change how you think about a vendor relationship. These aren’t minor gaps – they’re signals of a fundamentally immature access control posture.

• Shared administrative credentials used by multiple technicians on a single account
• No documented offboarding process – access removal is informal or handled whenever someone gets around to it
• Credentials managed in a shared spreadsheet, email thread, or personal password manager
• No rotation schedule – “we change passwords when we think about it” is not a policy
• No independent audit – the firm’s only security validation is their own opinion of themselves
• Defensiveness or deflection when asked these questions – competent firms welcome them
• Inability to produce an access list for your environment within 24 hours of the request

How to Use This in a Vendor Evaluation

These three questions work whether you’re evaluating a new IT firm or auditing your existing one. The goal isn’t to catch anyone in a lie. The goal is to understand whether the firm managing your systems operates with the same rigor you’d expect from your bank, your accountant, or any other vendor you hand sensitive business data to.

Put the questions in writing. Ask for written answers. A firm with real controls will produce documentation quickly. A firm without controls will delay, hedge, or answer verbally without follow-through. That behavioral difference is data.

Consider what these questions reveal about the firm’s culture. A team that has thought carefully about privileged access management has almost certainly thought carefully about incident response, data handling, and the other security disciplines that matter when things go wrong. The inverse is equally true.

The person who signs the contract is personally accountable when a breach happens. An insurance adjuster will ask whether you did due diligence on your vendors. Asking the right questions before you trusted someone with your systems is exactly the kind of due diligence that determines the answer.

Privileged access management is not a topic most IT vendors will raise on their own. Ask anyway. The quality of the answer will tell you more about a firm than any sales deck they could hand you. To evaluate your current vendor or explore a new relationship, visit our services overview – or Book a Free Strategy Call and we’ll walk through it with you directly.