Last updated: August 31, 2026
By Tom Kenaley, Co-Founder and President, KORE1
A contractor onboarding checklist works backward from the start date: access requested at T-10, equipment decided at T-7, scope document signed at T-3, and a named internal owner assigned before anyone says day one. Run it in that order and the first week produces work instead of tickets. Run it on day one and you pay for a week of waiting.
He started on a Monday. Email by Wednesday. VPN the following Tuesday, after a second ticket, and the Snowflake role he had actually been hired to build in landed on the Thursday of week two.
Sixty-four billable hours before he touched the warehouse.
Nobody did anything wrong, which is the part worth sitting with. The hiring manager submitted the access request the morning the contractor walked in, because that is when you submit access requests for new employees and nobody had told him contractors run on a different clock. IT processed it in four business days, which is inside their SLA and better than most. Security needed a manager attestation for the production role, and the manager was in Lisbon. Every individual link in that chain performed to standard. The chain still cost a mid-market medical device manufacturer in Irvine about nine thousand dollars to produce nothing.
That is the whole problem with contractor onboarding. It is not hard. It is early. And almost nobody starts early enough.
Full disclosure on the incentive structure here, because it runs in the opposite direction from what you would expect. KORE1 invoices by the hour on contract staffing engagements. Those sixty-four dead hours were revenue. Writing a guide that eliminates them takes money off our own invoice, and I am doing it anyway because clients who lose two weeks on their first contractor do not run a second one. That trade is not close.
The Ten Days Before Day One
Everything that decides how the first month goes gets done before the contractor exists in your building. Ten days out, not one. Here is the sequence, working backward.
| When | What happens | Who owns it |
|---|---|---|
| T-10 days | Access request submitted, every system named individually. Not “developer access.” | Hiring manager |
| T-8 days | Background and drug screen results confirmed received, not “in process” | Staffing partner |
| T-7 days | Equipment decision made and ordered, or BYOD approved in writing by security | Hiring manager plus IT |
| T-5 days | Any privileged or production role escalated with the attestation already signed | Hiring manager |
| T-3 days | Deliverable scope document finalized and sent to the contractor to read before day one | Hiring manager |
| T-2 days | Day-one point of contact named and told they are it. A calendar hold, not a hallway mention. | Hiring manager |
| T-1 day | Credentials tested by someone who is not the contractor. Actually log in. | IT |
The T-1 line is the one people skip, and it is the one that catches the most problems. A provisioned account and a working account are different states. A surprising share of the week-one access problems we hear about are accounts that were genuinely created, genuinely assigned, and genuinely broken, usually a group membership that did not propagate or an MFA enrollment nobody completed. Make sure the IP assignment is signed before day one too, not chased down after the engagement ends.
Test it yourself. Four minutes.
Access Is the Whole Game
Write down every system by name. This sounds insultingly obvious and it is the single highest-value thing on the list, because the request that says “standard developer access” gets fulfilled as whatever standard developer access meant the last time somebody asked, which was for a full-time hire in a different group two years ago. Name the repositories. Name the Snowflake role and the warehouse. Name the AWS account and whether it is the sandbox or the one with customer data in it. Name the Jira project, the Confluence space, the Okta groups, the VPN profile, the shared drive, the Databricks workspace, and the specific Salesforce sandbox. If your contractor needs to open a PR against a repo, say the repo. Somebody at some point is going to read your ticket literally, and that is the good outcome, because the alternative is them guessing. Guessing is expensive.
Sequence the escalated stuff first. Standard accounts come back in a day or two at most shops. Production database roles, anything touching PHI or cardholder data, admin consoles, and privileged access management enrollment all route through a separate approval that involves a human who has other priorities. Those are your T-10 items. The Okta group for the internal wiki is a T-2 item and nobody has ever lost a week over it.
Then write the offboarding date next to each one on the same ticket.
Do it at provisioning, while you are already thinking about it, because the alternative is what actually happens at most companies, which is that a contract ends and the accounts do not. I have seen a client discover an active VPN certificate belonging to a contractor who had rolled off fourteen months earlier. It surfaced during a SOC 2 audit. Bad time to meet it. Access control standards like the account management controls in NIST SP 800-53 exist partly because this failure mode is so reliable, and the fix costs nothing at the front end and a remediation memo at the back end.
The Equipment Decision Nobody Documents
Two options. Pick one on purpose.
You issue the machine, which means you control the endpoint, you can enforce disk encryption and EDR and your DLP policy, and you eat the procurement lead time plus the cost of getting it back. Or the contractor works on their own hardware, which is faster and cheaper and means your data is sitting on a laptop you have never seen. Neither is wrong. Both are common. The failure is not choosing, which produces the outcome where a contractor shows up on day one with a personal MacBook, IT says absolutely not, and now you are ordering a ThinkPad with a nine-day lead time while the contractor bills for reading documentation.
If you go BYOD, get security to approve it in writing before the start date and get the specifics down: what endpoint agent has to be installed, whether the contractor can use their own email client, what happens to local copies at rolloff. Name all three. If you issue hardware, order it at T-7 and put a shipping tracking number in the onboarding thread. Then decide who chases the return. Name a person. “The manager” is not a person, and the laptop will not come back.
One thing that is not optional either way. Contractors get their own credentials. Never a shared service account, never a borrowed login from someone on the team, and never the departed employee’s account reactivated because “it already has the right permissions.” That last one happens more than you would think and it destroys your audit trail completely.
What the Scope Handoff Actually Has to Contain
A contractor is not a new employee and should not get the new-employee onboarding path. Your employee onboarding process for tech teams is built to produce belonging and long-run retention, and it is measured in quarters. This one is measured in the first two weeks, and it is built to produce output against a defined end.
The handoff document is one page. Longer than that and nobody reads it.
- What has to be true when the engagement ends, written as a state of the world rather than a task list. “Fourteen services running on EKS with runbooks in Confluence” beats “migrate services.”
- The end date. An actual date. Contractors who do not know their end date manage themselves toward the wrong things.
- Who accepts the work. One name.
- Which decisions the contractor makes alone, which need a conversation, and which are not theirs. This is the section that prevents the most week-three friction and it is the section people leave out.
- What is explicitly out of scope. Write the boundary down and you will not have to defend it in a meeting later.
Strategy for the engagement itself, tenure caps, conversion planning, and the vendor relationship. Different conversation, and we wrote it up separately in our IT staff augmentation best practices playbook. This page is the operational sequence. Read that one if you are deciding how to run the engagement, this one if you already are and somebody starts in two weeks.
Co-Employment: What You Can and Cannot Do
Here is where the standard advice has gone stale, and it went stale recently enough that most of what ranks for this topic was written against rules that are no longer the rules.
Four different federal bodies can call you a joint employer, and they use four different tests. Four. Which one is looking at you changes what you should actually worry about, and nearly every co-employment warning you will read flattens all four into a single vague threat.
Start with the two where you are almost certainly a joint employer already and no amount of careful management changes it. OSHA treats staffing agencies and host employers as jointly responsible for temporary workers as a baseline, with the agency typically handling general safety training and the host handling training specific to your equipment and your hazards. OSHA’s language is direct about it. Host employers must treat temporary workers like any other workers for training and safety protections. The EEOC’s enforcement guidance on contingent workers lands in the same place, treating the staffing firm and its client as joint employers in most placements. Your harassment policy, your accommodation process, and your complaint channel cover the contractor. They just do.
Now the two that moved.
Under the National Labor Relations Act, the 2023 joint-employer standard was vacated by the Eastern District of Texas in March 2024, and the NLRB formally withdrew the 2023 regulatory text effective February 27, 2026. What governs now is the 2020 rule, which requires a company to possess and exercise substantial direct and immediate control over essential terms and conditions of employment. That is a meaningfully higher bar than the vacated standard, which reached indirect and unexercised control. The distinction is not cosmetic.
Wage and hour is unsettled in a different way. The Labor Department’s Field Assistance Bulletin 2025-1, issued May 1, 2025, told Wage and Hour investigators to stop applying the 2024 independent contractor rule and fall back on longstanding principles in Fact Sheet 13. Then on February 27, 2026 the Department proposed rescinding the 2024 analysis outright and restoring the 2021 framework, which leads with the nature and degree of the worker’s control over the work and the worker’s opportunity for profit or loss. Comments closed April 28, 2026. A separate proposal on FLSA joint employer status followed on April 23, 2026, with comments closing June 22. Neither one has landed yet.
So the honest state of things is that two of the four tests are mid-rewrite and nobody can tell you where they land. Which sounds alarming and mostly is not, for a reason that gets lost in the panic.
The controls that protect you are the same under every version of every test. They always have been. Direct control over the person, tenure that drifts toward permanent, and pay decisions made by you rather than your vendor are the things that show up in all four analyses. If you are clean on those, you are clean whichever way the rulemaking goes.
| Do | Don’t |
|---|---|
| Route performance concerns through your staffing partner’s account manager | Put a contractor on a performance improvement plan yourself |
| Assign work, set deadlines, and review output | Set or negotiate the contractor’s pay rate directly with them |
| Give site-specific safety and systems training | Enroll contractors in your benefits, 401(k), or holiday pay |
| Extend your harassment and accommodation policies to cover them | Discipline, suspend, or fire the contractor directly |
| Set a tenure cap and calendar the review before you hit it | Let an engagement roll indefinitely with no end date on file |
| Keep timekeeping and approval inside the vendor’s system | Approve PTO, leave, or schedule changes as though you were the employer |
The last row is worth a sentence of its own. A hiring manager telling a contractor “sure, take Friday off” feels like ordinary decency and reads, in a deposition, as employer conduct. Say “check with your account manager.” It costs you eight seconds.
Standard caveat, meant sincerely. I run a staffing desk, not a law practice. The IRS applies its own three-part common-law analysis covering behavioral control, financial control, and the type of relationship, and if your contractors are engaged as 1099s or through their own entities rather than on a staffing firm’s W2, the risk profile changes substantially. We broke that comparison down in W2 vs C2C vs 1099 engagement models. Run anything unusual past your own counsel.
Day One, Week One, Day Thirty
Day one is short and it has three jobs. Confirm every credential works with the contractor sitting there. Introduce the named point of contact, in person or on video. Actually introduce them. Walk the deliverable scope out loud, because reading it and hearing it produce different questions.
Week one, get them into something real by Wednesday. Not a training environment. A small piece of actual work with an actual reviewer, sized so it can ship inside the week. Contractors calibrate fast on whether an engagement is serious. A first week of shadowing tells them it is not.
Then day thirty. It is the checkpoint most people skip, because nothing is wrong yet. Thirty days in, you know whether the scope was right. Half the time it was not. Adjusting the scope document at day thirty costs a twenty-minute conversation, and adjusting it at day ninety costs a renegotiation.
What I’d Cut From Most Onboarding Checklists
Skip the culture onboarding. Company values deck, mission and history, the team lunch, and the swag bag. Contractors are polite about it and it does not change anything, and if you are running a proper contract engagement it can cut the other way, because it is the exact set of facts that makes a worker look integrated into your organization rather than engaged for a scope.
Skip the buddy program. Contractors want a named person who answers questions, which is not the same as an assigned peer relationship with scheduled coffees.
Skip the ninety-day plan. Half these engagements are shorter than ninety days.
And here is the one that costs KORE1 money directly. If you are running your fourth contractor in the same role in eighteen months, stop onboarding contractors. Open a req. At that point you are paying a markup to solve a problem that is not temporary, and direct hire is cheaper. Our own retention numbers argue for this too. KORE1 runs a 92% twelve-month retention rate on placements, which only means anything when the role is actually permanent. We would rather place that one well than bill the fourth contract.
What Hiring Managers Actually Ask Us
How far ahead should access requests really go in?
Ten business days before the start date for anything privileged, and five for standard accounts. Production database roles, PHI systems, and admin consoles need a separate approval that routes through security rather than the help desk, and that queue does not care about your start date. Standard email and repo access is usually fine at T-5. The number that matters is not the SLA, it is the SLA plus however long your approver takes to notice the request, and approvers go on vacation.
Can I just have my contractor use a shared team login to save time?
Never. Of everything on this page, that is the single line I would not bend on. Shared credentials destroy the audit trail, which matters most in the situation where you need it, meaning something went wrong and you need to know who did what. It also makes offboarding impossible, because you cannot revoke a shared account without breaking it for the team. Every contractor gets a named account. The four minutes it saves is not worth the conversation with your auditor.
Does treating a contractor like part of the team create co-employment exposure?
Ordinary integration into daily work is not what creates exposure. Direction, discipline, pay, and duration are. Assigning tasks, reviewing output, inviting someone to the standup, and being pleasant to them are all normal client conduct in a staffing arrangement, and none of it is what the tests look at. What the tests look at is who sets the rate, who fires the person, who approves the leave, and how long the arrangement has run. Be warm. Route the employment decisions to your vendor.
Who is responsible if a contractor gets hurt on our site?
Both of you, under OSHA’s framework, and the split of duties is fairly clear. The staffing agency typically covers general safety training and workers’ compensation, and you cover hazards specific to your site, your equipment, and your processes, because the agency has never seen your floor. OSHA’s position is that each employer should address the hazards it is in a position to prevent and correct. Practically, that means your site-specific safety orientation applies to contractors on the same terms as employees, and skipping it because “they’re the agency’s worker” is the assumption that generates the citation.
Same contractor, two years running. Are we exposed?
It is a flag rather than a violation, and what makes it risky is the combination of long tenure with employee-like treatment. Duration alone converts nobody. Duration plus you setting the rate, plus you handling discipline, plus a role indistinguishable from the full-time person sitting next to them, is the pattern that draws attention. Either tighten the engagement so the boundaries are real, or convert the person. Most clients in that position should convert.
What should the staffing firm be doing that we shouldn’t have to chase?
Background and drug screen results delivered before T-8, classification paperwork on file, and a named account manager who answers on the first call. You should also get a written conversion fee schedule at contract signature rather than at the moment you want to hire someone. If your partner is vague on any of those, that is worth more than whatever they saved you on rate. Rate is easy to compare. Everything else is where firms actually differ.
The Short Version
Contractor onboarding fails at the front, not in the middle. The failures are boring. They also repeat. Access requested too late, equipment undecided, scope described verbally, and no named human on day one. Every one of them is fixed in an afternoon of preparation ten days out.
Do the T-10 through T-1 sequence once and it becomes muscle memory. Skip it and you will pay for the first two weeks twice, once to your staffing partner and once in the work that did not happen.
If you want help building the sequence around your own approval chains, or you want to compare what you are paying now against current market, our 2026 tech contractor rate benchmarks are a reasonable starting point. When you are ready to run a search, talk to a KORE1 recruiter and we will scope it with you. We have placed contract technology talent across more than thirty U.S. metros since 2005, and the onboarding conversation is one we have already had a few thousand times.
