Contractor Access to Borrower and Policyholder Data: What to Grant, Log and Revoke

Last updated: November 1, 2026

By Khurram Tehseen, FSA, Founder and Principal at Operating Alpha

Give contract data staff named accounts, masked extracts before raw borrower or policyholder data, logged queries and a revocation step that runs the day the assignment ends. Build it before the start date. KORE1 contractors start a median 3 days after an offer (n=1,997), so access design cannot wait for week one.

Here is the form. I made this one up, and you will still recognize it.

Three lines are doing the damage. “Read on everything” takes in the loan tape with Social Security numbers beside it, the claim notes, and the beneficiary table. The business reason is honest. That’s the trouble with it. And the end date is blank, so nothing on this form ever tells anybody to stop.

Nobody here is careless. A manager has a contractor arriving Monday, an offer signed Thursday, and a security team that answers tickets in a week. So contractor access to financial data gets decided by whoever fills in the form fastest, usually the person who wants the work done.

The decision belongs earlier. Before the first interview, if you can manage it. Good contractor access management is least privilege applied to the data itself, so this piece sorts borrower and policyholder records by class, then says what a contractor gets at each level, what gets logged, and what comes off on the last day. KORE1 places these seats through its contract staffing practice, so weigh my view with that in mind. None of it needs KORE1. My lane is the data. If you want the general security version of the last day, the contractor access and offboarding checklist covers SSO, tokens, and cloud keys, and I won’t repeat it.

Which Data Classes Should a Contractor See, and in What Order?

Contractor access tiers sort regulated data by how much it can identify a person, then release it in order: masked extracts first, named fields next, raw records last and only with a logged reason. The contractor moves up when a specific task requires it, and each move has a name attached.

I sort by data here. The data contractor scope template sorts by what the person can do, from documents only to sandbox write, and you need both, because read access on a masked copy and read access on production are the same permission with very different consequences.

Start with what masked has to mean, because nonpublic personal information (NPI) is defined more widely than most access forms assume. Most masked tapes I’ve opened weren’t. The FTC’s Safeguards Rule definitions carve out “aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.” Account numbers. So a tape with the names stripped and the loan number left in is still sitting on the wrong side of that sentence, and on a small book a birth date, a ZIP code, and a face amount will find the policyholder without any name at all. I am reading text there, not giving a legal opinion. Ask your counsel where your own extract lands.

Tokens help. Replace each loan or policy number with a token that stays the same across every extract, and joins still hold. Birth dates become birth years. ZIPs drop to three digits. The map from token back to record stays with an employee, on a system the contractor has no path to.

Some work won’t survive this. I ran person-matching across hundreds of thousands of individuals and policies, and matching needs the raw identifiers, since the whole job is deciding whether two spellings are one human. Ask the person who would do the work which fields the task truly needs. Make them name the fields. A contract engineer rebuilding a delinquency roll-forward usually needs balances, dates, and status codes, and has no use for a Social Security number, while the one fixing duplicate borrowers needs it on day one, in a locked room, with a reason on file.

My defaults, offered as a starting point for your own risk assessment. They are not a regulator’s list.

Why Named-Person Accounts and Logged Queries?

Because a log entry that says dataeng_svc ran a query tells you nothing about who ran it. Shared accounts get made for good reasons. A pipeline needs a login, the contractor needs to test the pipeline, and by week three the human and the job are on one credential. One person is the database. Now the database has a pseudonym.

The Safeguards Rule at 314.4(c)(8) asks for controls “designed to monitor and log the activity of authorized users,” and the definition of authorized user names contractors. Short sentence. A lot of plumbing behind it. Five fields will do: who, which table or file, which fields, how many rows, and why. Snowflake, BigQuery, and Databricks all keep query history that gets you most of the first four, and the why is the one you have to build, which a required comment on the access request gets done cheaply.

Then somebody has to read the record.

Unread logging is storage. Fifteen minutes a week from the contractor’s manager covers it. One question. Did this person pull anything the task didn’t call for? A seat that normally returns 2,000 rows a query and returns 400,000 on a Friday afternoon is worth a phone call. Say the contractor had a fine reason. Good. Now you know it, and it goes in the file.

How Do You Know the Contractor Is the Person You Interviewed?

You check. Then you keep checking after the interview. The FBI said in its January 2025 public service announcement that North Korean IT workers “have been observed using artificial intelligence and face-swapping technology during video job interviews,” and that once inside they have copied data and held it for ransom.

Finance is a target. Okta Threat Intelligence tied these operatives to more than 6,500 job interviews at over 5,000 companies through mid-2025, and it names banks and insurance firms among the targeted entities, with a pointed line about financial services relying on third-party recruiters and contractors, which it says “creates an environment where identity verification is not performed directly by the hiring organization.” That’s my kind of seat. Yours too, if you buy through a staffing firm.

KnowBe4 ran the case in public. Four video interviews went fine and the background check came back clear, since the identity was valid and stolen. Endpoint detection caught the laptop. Access design limited what it could reach. In the company’s own words, new employees sit “in a highly restricted area when they start, and have no access to production systems.”

That’s the tiering argument in one sentence. Identity checks fail sometimes. A masked extract limits what a failed check costs you.

Run both anyway. The FBI’s list includes completing as much hiring and onboarding in person as you can, checking identity through employment and not just at the start, and verifying that “third-party staffing firms conduct robust hiring practices and routinely audit those practices.” So ask yours, KORE1 included, what it checks and who has actually spoken to the candidate. The guide to vetting remote contractors for identity fraud walks an interview team through the checks, and what to require from a staffing supplier covers the contract side. KORE1 partner Devin Hornick’s version is short: “A recruiter who actually knows the candidate is now a security control, not overhead.” He sells recruiting. Discount accordingly. Then ask how many calls your supplier had with this person.

What Breaks If a Contractor’s Access Outlives the Contract?

The review cycle breaks first. Quietly. Part 500 at 500.7 sets at least an annual review of access privileges as its floor. Ended contract assignments at KORE1 ran a median 116 days (n=1,887). The 25th percentile was 44 days, the 75th 227. Put those side by side. A typical contractor starts and leaves between two annual reviews, and a quarter of them are gone inside seven weeks. Filled at that median, one seat turns over about three times a year, so eight contract seats means about 25 revocations a year, and every one of them is a date somebody has to own. The annual review is a backstop. It can’t be the control.

What goes wrong after that is mostly unglamorous. An orphaned warehouse role nobody can explain to the auditor, a scheduled extract still writing borrower rows to a folder the contractor’s old team owns, and the nightly tape refresh that was running under a personal credential, which fails the morning after somebody finally removes it, on the day the borrowing base goes out.

And the hard one. Say the account was used after the assignment ended. You now have to work out what was read, by whom, and whether it counts. Under the same FTC rule, a notification event involving at least 500 consumers goes to the FTC within 30 days of discovery, and unauthorized access to unencrypted customer information is presumed to be acquisition unless you hold reliable evidence otherwise. New York’s clock under 500.17 is 72 hours once a covered entity determines a cybersecurity incident has occurred. Evidence means logs. I won’t guess how any regulator would read a given set of facts, and you shouldn’t trust anybody who does. A named account with five logged fields is a question you can answer, and a shared login with a departed contractor attached is one you can’t.

What Should Revocation Look Like on the Last Day?

Boring. On the calendar from the day the form was approved. Put the end date on the access request and make the field required, and when an extension comes, move the date by a new approval, so that nobody can extend an assignment by simply forgetting it exists. Your staffing firm can confirm the date. It can’t touch your warehouse. KORE1 confirms end dates and has no hand in the client’s systems, so the runbook has to live on your side, with an employee’s name on it.

The general steps are in the checklist I pointed to above. For a data seat, add these, because they are where regulated records actually hide:

• Extract copies. Pull the query log for the whole assignment and list every export. Each one gets deleted or moved into a governed location, with the contractor confirming in writing.
• Sandbox schemas. They’re full of half-joined tapes nobody thinks of as data.
• Notebooks and scheduled queries. Reassign anything that runs, and read it first, since hardcoded file paths and pasted SSNs turn up in cells people forgot about.
• The token map. Confirm the contractor never had a path to it. If they did for a task, that path closes today.
• Service accounts they could read the password for. Rotate them after the job owner has been reassigned, in that order, or the morning tape fails.
• Your retention schedule. 314.4(c)(6) sets a two-year outer limit on keeping customer information after its last use, with exceptions, and contractor workspaces are where that date gets lost.

Close it the same day. One page in the file, listing what was held, what came off, who did it, and at what time. If you want the front half, the contractor onboarding checklist covers the first week, and Kris Drouet’s piece on provisioning contract engineers under SOC 2 handles the engineering seats.

What Do the GLBA Safeguards Rule and NYDFS Part 500 Ask About Third Parties?

Start with whether each one reaches you. The Safeguards Rule, 16 CFR 314, applies to financial institutions under FTC jurisdiction, which takes in many non-bank lenders. Banks answer to their own regulators’ version. 23 NYCRR 500 covers anyone licensed under New York’s Banking, Insurance, or Financial Services Law. Insurers elsewhere look to state law, often built on the NAIC Insurance Data Security Model Law, so check what your state actually adopted. DFS keeps its own materials on its cybersecurity resource center.

Here is the text, as of this writing, with no prediction attached about how anyone applies it. Read it with counsel.

Size limits apply. See 314.6 (fewer than 5,000 consumers) and 500.19, neither of which removes the access limits above.

Notice what the two share. Neither mentions masked extracts or tiers, and neither gives you a number of days. They ask for the need-to-know limit, the log, and the supervision, and leave the design to you. A W2 contractor on a staffing firm’s payroll is an authorized user on your systems however the invoice reads. Whether the firm also counts as a service provider depends on what it can reach, and that is the question for your counsel.

What a CISO Asks Before the First Contractor Login

Can a contractor work on masked data only?

Yes, for most reconciliation, pipeline, and reporting work, provided the tokens stay consistent across extracts so joins still hold. Duplicate-borrower matching and record-level exceptions are the usual cases that need raw fields. Give those a named task and a logged reason.

So does masking take the extract out of scope?

Don’t assume it. The FTC’s definition carves out blind data with no personal identifiers such as account numbers, names, or addresses, and a tape that keeps loan numbers, or lets a birth date and ZIP code single someone out, may not qualify. Ask counsel about your specific extract.

Who owns revocation, KORE1 or the client?

The client owns revocation, because the client owns the systems. KORE1 confirms the end date. A named employee on your side runs the steps and signs the page, and if the date moves, the access request moves with it.

How fast can a vetted contractor start?

KORE1 contractors start a median 3 days after an offer (n=1,997, KORE1 engagement data through October 16, 2026). A median is no promise on your seat. Three days does beat most access tickets, though, which is why the tiers get built first.

We already have a contractor on read-everything. Now what?

Pull 30 days of their query log and grant what they actually used. In my experience the real list runs far shorter than the grant. Ask the manager about anything missing, write the end date on the form, and move raw fields to the logged-reason tier.

Start With the Last Contractor Who Left

Replay it. Pick the most recent contractor who finished an assignment near borrower or policyholder data, and ask for four things: every account they held, the date each one closed, every extract they ran, and where those extracts are now. Score it against the date the assignment ended. Don’t warn anybody first.

It takes an afternoon. It tells you more than the policy will. If the answers come back clean, your form is fine. If they come back as a shrug, you have your first project, and your next start date is probably three days after somebody’s next offer.

If you run it, I would like to hear what you found. Connect with me on LinkedIn.