A services contract closes at the end of March. The work is finished, the final invoice clears, & every file that should be closed gets closed by the person responsible for closing it. In August the badge issued under that contract still opens a side door, & the account issued with it still authenticates.
Nothing failed. There was no moment at which a failure was available to be made.
That opening is a composite. I built it to show a shape, & it is not a report of any incident or any engagement.
The shape is not mine, though. It has been audited & published three times over, by three federal Inspectors General.
Two Calendars That Never Meet
An employee's access runs on human resources events. Somebody is hired, moves, or leaves, & each arrives in the identity system as a record with a date on it. Imperfect, but a system, & it fires.
A third party's access runs on something else. It begins with an award & is supposed to end with a period of performance, a term written into a document that lives with procurement & with legal. That document was never connected to the directory. The contract has an end date. The credential has no idea what it is.
In May 2023 the Department of Transportation's Inspector General published an audit that did the obvious thing: it started from contracts whose performance period had ended & went looking for the credentials issued under them. Of the 1,184 contractor employee badges analyzed, 294 of them, 25 percent, had not been collected or deactivated. In one case the auditors describe, a support contract ended in April 2021 & the badge issued under it was not collected or deactivated until February 2022, 325 days later.
Bound that figure. The population was one department's non-FAA service contracts over $250,000 that ended across fiscal years 2020 & 2021, sampled statistically at 64 contracts. It measures the real thing, & it is not a rate for American business.
The reflex answer to a number like that is an offboarding checklist. A checklist assumes somebody is told.
The Department of Homeland Security's Inspector General found, in a December 2022 audit, exactly where that assumption breaks. Policy required a card be revoked within 18 hours of security officials receiving notice of a separation. Nothing specified when the notice had to be sent. The clock was well designed, & it started on an event nobody was required to generate.
There are four places the notice reliably does not come from, & only three rest on a documented finding rather than on my own read. The tiers underneath the contract you actually signed, where the requirement to push credential obligations down to subcontractors is written into NIST's supply chain guidance & measured by nobody, anywhere. The account issued to a company rather than to a person. The credential that was never in the directory to begin with: badges, gate remotes, alarm codes, lockbox codes, because IT cannot revoke what IT was never asked to issue.
And the fourth is the engagement that goes quiet rather than ending. Nobody sends a notice about a contract that is technically open & simply has no work left in it. That one is my own judgment after twenty years of this work, & there is no source behind it.
The Join Is Not in Anybody's Job
The same audit sets out who owned each piece of the contractor badge lifecycle. Five roles: a security office that issued & deactivated the cards, a contracting officer's representative responsible for the security clauses & for collecting the cards afterward, & three others. The report annotates three of the five as collateral duties, & the representative's role as usually one too.
Nobody in that table owned the join. The Inspector General said so in structural language rather than accusatory language: the department did not always promptly collect & deactivate contractor badges because it had not established clear accountability over the process.
The same audit is sharper still on one point. Of the 64 contracts sampled, 27 of them, valued together at $161.1 million, did not carry all the required badge related security clauses, including the one obliging the contractor to notify the contracting officer when access was no longer necessary. Nobody failed to send that notice. The notice was never wired.
The plainest statement of the problem came from the General Services Administration's Inspector General in March 2016. Officials reported that cards went uncollected because they were too busy, were unaware of the requirement, did not know how to collect them, or did not know which contractor employees were on which contract.
The two registers did not agree either. GSA's system of record showed over 92,000 active contractor employees; officials told the Inspector General that figure was inaccurate & speculated the real number was nearer 50,000. That estimate is theirs, not the auditors'. Neither review found the join automated anywhere. What both found was people doing it by hand. At GSA, eight of eleven regional credentialing offices ran ad hoc monitoring of their own devising. At Homeland Security, officials compared a two week old payroll report against the identity system to work out who had actually left. Where the join happens at all, it happens as somebody's workaround.
Every measured example above is a federal badge, & that is not an artifact of where I looked. Federal agencies have Inspectors General who audit them & publish what they find. Commercial contract security has no equivalent public record: a contractor who kept a badge is handled by taking the badge back & saying nothing. So when somebody quotes you a percentage of private sector contractor badges still live after contract end, ask where it came from. No public figure exists to draw it from, & that absence is part of the same problem.
The contract ended. The credential did not. In between there was no system whose job it was to notice.
When the Actor Is a Company
It is easy to file this under housekeeping. The Transportation audit opens with the reason not to.
In 2014 a contractor employee transferred from a control center facility in Illinois to one in Hawaii. During the twelve days between assignments the badge was not collected, was not deactivated, & the access to the Illinois building was not removed. He went back in & deliberately set a fire. The equipment destroyed disrupted the national transportation system for weeks, & the Inspector General put the cost to the public at over $350 million. The report bounds the case in its own footnote: agency policy at the time did not address collection & deactivation for a situation of that kind. Nobody had been terminated. Nobody had resigned. The gap opened during a transfer.
The digital version has the cleaner record, & it belongs to the company that filed it. Home Depot's annual report for the fiscal year ended February 2015 recorded, in the company's own words, that its investigation to date had determined "the intruder used a vendor's user name and password to enter the perimeter of our network." After that, the intruder acquired elevated rights. A filed disclosure describing an investigation as it stood eleven years ago, quoted here for one thing: where the intruder came in.
A Senate Commerce Committee majority staff report read the 2013 Target breach the same way, & every hedge in it is the committee's. Writing in March 2014, the staff concluded on the public record as it then stood that Target had given network access to a Pennsylvania HVAC & refrigeration contractor. The staff also found that attackers had reportedly gained their first access by stealing that contractor's credentials. The report says on its own first page that it was assembled from media reports & expert analyses rather than a completed forensic examination. What survives the hedging is the nature of the access: remote access held for electronic billing, contract submission & project management. A business process connection, not a technical one.
The number everybody reaches for at this point is the wrong one. Verizon reports third party involvement in 48 percent of the confirmed breaches in the corpus behind its 2026 Data Breach Investigations Report, up from 30 percent the prior edition. Read the definition before spending the figure. The metric combines a vendor inside the software supply chain, a vendor hosting the organization's data, & a vendor with a connection into its environment. None of the three is a credential that outlived its contract. Verizon also states in its own methodology that it makes no claim the findings represent all breaches in all organizations; its collection is a sample of convenience. A real number about a different question. The one that belongs to this question is the Inspector General's 25 percent, because that audit measured the contract.
This is the part of it I have spent the most time inside. Twenty years in federal law enforcement & executive protection is twenty years of asking who, & a credential attributed to a company cannot answer. A Treasury Inspector General audit in February 2020 put the adversary's side of it plainly: attackers frequently exploit legitimate but inactive accounts to impersonate legitimate users, & terminated contractor & employee accounts have often been misused that way. That is the auditor's professional assertion inside its discussion of findings rather than a measured result.
The rest of the problem is structural. The records that would settle who was at the keyboard sit inside a company you do not control & cannot assess, which NIST states flatly about external services. Meanwhile the contract may already be closed, which is where this started.
Manufacturing the Missing Event
None of this is an offboarding failure, so an offboarding fix will not reach it. No event exists at all. The work is to manufacture one.
Five recommendations. They are mine, they are security practice rather than anybody's standard, & none of them makes anybody compliant with anything. Each matches control language NIST already publishes, which matters mainly because it means none of this is exotic.
- Set the credential's expiration from the contract's end date, at the moment it is issued. Not a review date. An expiration. NIST's supply chain guidance puts it in one sentence: contractor accounts should not exceed the period of performance of the contract. A credential that expires on its own needs nobody to remember it.
- Drive recertification from the contract register, not from the directory. A directory review asks whether everybody on the list still belongs on it, a question the list cannot answer about itself. The contract register asks a different one: this contract closed, so what did it authorize, & is any of that still live?
- Require a named human behind every external credential, service accounts included. Not tidiness. A credential attributed to a company cannot be attributed to a person during an investigation, & that bill comes due on the worst available day.
- Require the notice, & put the requirement where it can be enforced. NIST's external personnel control asks organizations to require providers to give notice of any transfer or termination of external personnel holding organizational credentials or badges. That obligation lives in the agreement or it lives nowhere: at Transportation, 27 of the 64 sampled contracts did not carry it. What your own agreements should say is a question for your counsel, not for me.
- Treat an external credential with no live contract behind it as an incident rather than a housekeeping item. Housekeeping gets deleted quietly. An incident gets asked how long, who used it, & what it reached, which are the only questions whose answers you will want later.
One boundary runs under all five. Each is executed on records the reader already owns. Reconciling a contract register against an access directory is a comparison of two lists. It is never a test of whether a credential still works, & where a step needs records the vendor holds, the authority for that comes from the contract & stops there.
Go back to the composite, because the uncomfortable part of it was never the badge.
It is that everybody in it did their job. Procurement closed the contract on the date the contract named. Facilities issued a badge to somebody authorized to hold one. IT provisioned an account somebody with authority had requested. Five departments, five correct outcomes, & one date only one of them ever saw.
The reconciliation that would have caught it is not technically hard. It is a comparison of two lists the organization already owns, & at least two federal departments have been performing it by hand, run by people with no mandate to run it.
At Scopos Strategies, that comparison is the assessment. We lay the contract register against the access directory & report what the comparison shows, independently of what the vendor reports & independently of what the internal owner reports. It is investigative work before it is anything else, & that is the background we bring to it.
Pull two lists this quarter, the contract register & the access directory, & put one question to them: what appears in one that does not appear in the other?
Sources
- U.S. Department of Transportation, Office of Inspector General, Report ZA2023030, "Fragmented Processes Weaken DOT's Accountability for Contractor Employee PIV Cards," May 24, 2023. oig.dot.gov, Report ZA2023030. Backs the article's central mechanism and most of its figures: 294 of 1,184 contractor employee PIV cards analyzed, 25 percent, not collected and/or deactivated; one card collected 325 days after the contract ended; 27 of 64 sampled contracts, valued at $161.1 million, missing required security clauses including the duty to notify when access is no longer necessary; the five-role split with three roles annotated as collateral duties; and the 2014 Illinois facility case, carrying the report's own footnote that agency policy at the time did not address collection and deactivation for that situation. The population is DOT non-FAA service contracts over $250,000 ending in fiscal 2020 or 2021, drawn as a probability-proportional-to-size sample of 64, so it measures one department's large service contracts and no national rate. DOT concurred with all six recommendations.
- U.S. Department of Homeland Security, Office of Inspector General, OIG-23-04, "DHS Did Not Always Promptly Revoke PIV Card Access and Withdraw Security Clearances for Separated Individuals," December 20, 2022. oig.dhs.gov, OIG-23-04. Backs the mechanism this article is named for, stated as policy: revocation was required within 18 hours of security officials receiving notification of a separation, and the plan set no timeframe for sending that notification. Also the ad hoc practice of comparing a two-week-old National Finance Center report against the identity system. Its 137,375 separated cardholders for fiscal 2018 through 2021 combine employees and contractors with no contractor breakout, and the OIG states it could not determine the exact magnitude of the problem because departmental records were incomplete.
- U.S. General Services Administration, Office of Inspector General, JE16-002, "GSA Facilities at Risk: Security Vulnerabilities Found in GSA's Management of Contractor HSPD-12 PIV Cards," March 30, 2016. gsaig.gov, JE16-002. Backs the missing join in officials' own reported words, and the ad hoc monitoring run by eight of eleven regional credentialing offices. The 92,000 versus roughly 50,000 discrepancy is GSA officials' characterization of their own system of record reported to the OIG, not an OIG count. This is an evaluation rather than a statistical audit, it is ten years old, and GSA agreed with the recommendations and initiated corrective actions.
- The Home Depot, Inc., Annual Report on Form 10-K for the fiscal year ended February 1, 2015, filed with the U.S. Securities and Exchange Commission March 26, 2015 (CIK 0000354950). sec.gov EDGAR, Form 10-K. Backs the first named example in the company's own filed words: its investigation to date had determined the intruder used a vendor's user name and password to enter the perimeter of its network, after which the intruder acquired elevated rights. Cited solely for the documented entry point, bounded to the investigation as it stood in March 2015. A separate 2020 multistate attorney general settlement resolved different allegations and does not state this mechanism, so it is not relied on here.
- U.S. Senate Committee on Commerce, Science, and Transportation, Majority Staff Report for Chairman Rockefeller, "A 'Kill Chain' Analysis of the 2013 Target Data Breach," March 26, 2014. commerce.senate.gov, Kill Chain Analysis. Backs the second named example: the committee staff's conclusion that Target had given network access to a third-party HVAC and refrigeration contractor holding remote access for electronic billing, contract submission, and project management, and that attackers reportedly entered on that contractor's credentials. The report states on its first page that it was assembled from media reports and expert analyses rather than a completed forensic examination, and it hedges throughout; those hedges are carried into the body above. Describing the contractor generically is this article's choice, not the source's.
- National Institute of Standards and Technology, Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations," September 2020 (updates as of December 10, 2020). nvlpubs.nist.gov, SP 800-53 Rev. 5. Backs the countermeasures in the standard's own vocabulary: PS-7 on requiring external providers to give notice of transfers or terminations of external personnel holding credentials or badges, AC-2 on expiration and alignment with termination and transfer processes, AC-2(9) on weighing the accountability loss before permitting shared accounts, and SA-9 on the absence of direct control over an external provider's implementation. This is a control catalog, not an obligation on any private reader. A minor Release 5.2.0 is maintained in NIST's CPRT catalog and was not diffed against the Revision 5 text cited here.
- National Institute of Standards and Technology, SP 800-161r1-upd1, "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations," updated November 1, 2024. nvlpubs.nist.gov, SP 800-161r1-upd1. Backs two of the recommendations directly: its AC-2 supplemental guidance states that contractor personnel get unique accounts which do not exceed the period of performance of the contract, and directs prime contractors to flow the requirement down to sub-tier contractors. Cited as control language rather than as a legal obligation on the reader. The predecessor SP 800-161r1 was withdrawn on November 1, 2024 and is not the version cited.
- Verizon, 2026 Data Breach Investigations Report, 19th edition. verizon.com, 2026 DBIR. Backs the trend figure only: third-party involvement at 48 percent of the confirmed breaches in the report's corpus, up from 30 percent in the prior edition, across more than 22,000 confirmed breaches. Two limits are load-bearing and are stated in the body: the metric combines three vendor-relationship archetypes, none of which is a credential that outlived its contract, and Verizon states it makes no claim the findings are representative of all breaches in all organizations, its corpus being contributed data and, in its own words, a sample of convenience. This is vendor-published research and is never the warrant for this article's mechanism.
- Treasury Inspector General for Tax Administration, Report 2020-20-006, "Active Directory Oversight Needs Improvement," February 5, 2020. oversight.gov, TIGTA 2020-20-006. Backs the adversary-value point: attackers frequently discover and exploit legitimate but inactive accounts to impersonate legitimate users and evade network monitoring, and terminated contractor and employee accounts have often been misused this way. That is the Inspector General's professional assertion inside its discussion of findings rather than a measured result, with no study cited behind it, and it is attributed that way in the body. The report's countable figures are Active Directory policy violations in one IRS environment and are not contractor counts, so none of them appear here.
This article was produced with AI assistance. The perspective and security expertise are the author's own.