Temporary staff often leave after a short time, so they may not feel responsible for your security. A contractor who doesn't know your password rules might write passwords on sticky notes. A freelancer accessing your customer database might not realize they should never take photos of screens. A real case: a call centre hired temps during festival season; one temp's weak login let someone access client banking details, causing your bank to flag you for a breach, and three enterprise clients terminated contracts. Without basic guidance, you're liable, not just the contractor.
Find where your organisation is today. Be honest — the self-assessment is only useful if it reflects reality.
Absent
You do not have any formal process for onboarding contractors or temps. When someone arrives, they are handed a computer and told to start work, with no mention of data safety, password rules, or what they can and cannot do.
Initial
You informally tell contractors 'be careful with passwords' or 'don't share client info,' but there is no written document and no proof the message was received or understood.
Developing
You have a basic one-page security handout or email that every contractor receives. It covers passwords, not taking data home, and not discussing clients; however, you do not track whether they read or signed it.
Defined
You have a clear written security briefing document (or online form) that every contractor must read and sign before they get access to systems. The document covers passwords, data handling, and what happens if rules are broken.
Managed
You have a structured onboarding process where contractors sign a security agreement, watch a 5–10 minute video, and take a short quiz to confirm they understand key points. You keep records of completion.
Optimised
Every contractor receives tailored guidance based on their role (e.g., office cleaner vs. IT support), completes a formal induction, signs a confidentiality agreement, and you conduct periodic spot-checks or refresher training for long-term contractors.
| Step | What to Do | Who | Effort |
|---|---|---|---|
| 0 → 1 | Write a one-page 'Contractor Security Rules' document covering passwords, not sharing logins, keeping data safe, and what not to discuss. Print it and give it to every contractor. | Business owner or IT person | 1 day |
| 1 → 2 | Create a simple security checklist (Google Doc or Word file) with 8–10 rules. Ask contractors to sign or initial it before they start. Keep copies in a folder. | HR person or business owner | 3 days |
| 2 → 3 | Convert the checklist into a formal 'Contractor Security Agreement' that mentions confidentiality, data protection, and consequences of breach. Get a lawyer to review if possible. Require signature before system access. | Business owner, possibly with lawyer | 2–3 weeks |
| 3 → 4 | Create a 5–10 minute video or interactive form-based induction covering key rules, and a short 5-question quiz. Use free tools like Google Forms. Log who completed it and when. | IT person or communication owner | 4–6 weeks |
| 4 → 5 | Build a role-based contractor induction process (e.g. office staff vs. data entry vs. support). Conduct quarterly refreshers for ongoing contractors, and maintain a master contractor register with induction dates. | HR manager or designated security owner | Ongoing quarterly reviews and updates |
Documents and records that prove your maturity level.
- Signed contractor security agreement or checklist (physical or digital copy) for each contractor hired in the past 12 months
- A master register or spreadsheet listing contractor name, role, date onboarded, and date security briefing was completed
- A copy of the security briefing document or handout that you give to contractors
- Video or quiz records (if at level 4+) showing date watched, score, and contractor name
- Records of any refresher training or spot-checks for long-term contractors (if at level 5)
Prepare for these questions from customers or third-party reviewers.
- "Can you show me the security briefing or agreement that you gave to your last three contractors? Do you have signed proof?"
- "What specific topics are covered in your contractor security guidance? How do you ensure they understand password rules or data confidentiality?"
- "If a contractor breaches security, what consequences do they face? Is this documented in your agreement?"
- "How do you track that contractors have actually received and understood this guidance? What records do you keep?"
| Purpose | Free Option | Paid Option |
|---|---|---|
| Create and store contractor agreement templates | Google Docs or LibreOffice Writer with version control | Microsoft 365 (approx. ₹6,000–15,000/year for small team) |
| Track contractor inductions and sign-offs | Google Forms + Google Sheets (automated responses logged) | JotForm (₹0–3,000/year) or Typeform (₹0–5,000/year for basic) |
| Create and host induction video or interactive training | Google Drive + YouTube (unlisted video) or Loom (free tier for short videos) | Coursera, Udemy Business, or bespoke LMS (₹20,000–1,00,000/year) |
- Assuming temporary staff 'know what they're doing' because they have IT or business experience—they may not understand your specific rules or care about your data because they're leaving soon
- Not having written proof of induction—if there is a breach and a contractor says they were never told the rules, you cannot defend yourself in court or to regulators
- Giving contractors the same passwords as employees or not changing passwords when they leave—this is a common cause of unauthorized access months after someone departs
- Forgetting that contractors can include office cleaners, delivery staff, and facility managers who may pass by screens or overhear conversations—security guidance should be role-appropriate, not just for technical roles
- Not following up with contractors who work long-term (e.g., outsourced BPO teams)—they become 'invisible' over time and may develop bad habits
| Standard | Relevant Section |
|---|---|
| DPDP Act 2023 | Section 6 (data processor obligations) and Section 8 (lawful processing); contractors are often processors and must be contractually bound to protect personal data |
| CERT-In 2022 | Amended Rule 4(d) requires 'reasonable security practices'; contractor training is evidence of due diligence |
| ISO 27001:2022 | Annex A, A.6.1 and A.6.2 (screening and confidentiality agreements); A.6.7 (removal of access) |
| NIST CSF 2.0 | Govern (GV) function: GV.RO (roles, responsibilities, authorities); Protect (PR) function: PR.AC (access control) |
Ready to assess your organisation?
Answer all 191 questions and get your NIRMATA maturity score across all 12 pillars.
Start Free Self-Assessment →