Home labs & practical projects
Review a supplier access design
A project to do with your own tools, with guidance on what to create and capture.
What you could create
A supplier wants shared administrator access to support a customer platform. The business needs support coverage while retaining accountability and control over sensitive data.
| Design concern | Possible consequence | Proposed improvement |
|---|---|---|
| Shared supplier administrator account | Individual actions cannot be attributed reliably | Named access with appropriate privileges and review |
What you'll need
Fictional business brief
Describe a small company, its important information, a supplier support need and the service owner. Avoid using confidential work material.
Architecture diagram
Show the supplier connection, identity checks, privileged actions, logging and sensitive data boundaries.
Risk and decision record
Use a document or spreadsheet to connect each concern to evidence, business impact, options and an accountable owner.
Suggested milestones
- 1
Describe the business need
Define what the supplier needs to do, which information it can reach and which assumptions still need confirming.
- 2
Review the proposed access
Consider shared accounts, excessive privileges, session oversight and removal of access. Identify the evidence needed to support each concern.
- 3
Compare safeguards
Set out proportionate options, their operational cost and the risk left after treatment. Explain why the strongest-looking control may not be the most suitable one.
- 4
Write a defensible recommendation
Record conditions, unresolved questions, proposed assurance checks and the person who would accept remaining business risk.
One example to adapt
| Design concern | Possible consequence | Proposed improvement |
|---|---|---|
| Shared supplier administrator account | Individual actions cannot be attributed reliably | Named access with appropriate privileges and review |
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Check relevance, platform versions and current access terms.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Draw a customer platform, a supplier team and a privileged access path. Define support hours, data sensitivity and a one-hour restoration objective.
What a good result looks like
- The design identifies who accepts residual risk.
- Emergency access remains attributable and subject to review.
- The recommendation explains the business trade-off instead of simply listing controls.
Finish the project
Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.