Access and vendor risk checklist
Twenty questions in five areas, in about fifteen minutes. They ask how far one compromised device, account or vendor could reach into your business.
What happened at Binance
On 29 October 2026 Binance confirmed a security incident affecting about $6.3 billion of assets. Its initial investigation, published on 30 October, found that the incident may involve a compromised engineer's laptop, which gave an attacker access to a service container used to submit unauthorised withdrawal transactions.
Blockchain analytics firms TRM Labs and Chainalysis attribute the attack with high confidence to a North Korea-linked group. Binance has not named an attacker, and the investigation is continuing. Figures as reported on 30 October 2026.
Sources for each of these facts are listed at the end of this page.
Why this is not only a crypto problem
Most businesses have the same shape. A person, a device, a system and the power to move money or data. Add the vendors that sit behind each of them and the same question applies: how far could one failure travel?
How to use this checklist
Answer for what is true today, not what is planned. Score each question Yes, Partial or No. Each one comes with a line on what good looks like.
Run it with your technology lead and your CFO in the same room. They will often answer the same question differently, and that gap is the useful part.
1. Privileged access
Privileged access is the power to change systems, reach production data or approve money. The fewer people and accounts that hold it, the less one mistake can cost.
1. Can you list everyone who holds admin, production or finance-signing access today?
Good looks like: a named list owned by one person and reviewed at least every quarter. Nobody is on it only because they were once on it.
2. Is multi-factor authentication enforced on every privileged account?
Good looks like: enforced by policy and confirmed by a report, preferably with methods that resist phishing. Exceptions are logged with an end date.
3. How quickly does access end when someone leaves or changes role?
Good looks like: the same day for leavers, checked against HR records. A role change triggers a review of what that person can still reach.
4. Do service accounts, API keys and automated agents have owners and limited permissions?
Good looks like: each one has a named owner, the minimum permissions it needs and a rotation or expiry date. They sit in the same review as human accounts, AI agents included.
2. Devices and people
Attackers often go through a person and a device rather than the system itself. These questions ask what a single compromised laptop could reach.
5. Which devices can reach production systems or move money?
Good looks like: only company-managed devices that are enrolled, patched and listed. Personal devices and shared machines are excluded.
6. Can one person on one device complete a sensitive action from start to finish?
Good looks like: sensitive actions need a second person or a second approval path. A single stolen session cannot finish the job.
7. Do people with privileged access get training on targeted lures such as fake recruiters and fake vendor requests?
Good looks like: role-specific training at least once a year, a fast way to report a suspicious approach and no penalty for reporting.
8. What is the rule for running code or opening files that arrive from outside the company?
Good looks like: privileged devices do not run outside code or test tasks. That work happens on separate devices or in isolated environments. Binance said on 27 October 2026 that it had blocked North Korea-linked attempts of this kind. It has not said how the laptop in the 29 October breach was compromised.
3. Vendors and third parties
Your exposure includes the vendors that can touch your data, systems or money, and the vendors they rely on.
9. Do you have a current list of vendors with access to your data or systems, including the vendors they depend on?
Good looks like: a register with an owner, the data each vendor holds, the access it has and the main sub-vendors of your critical suppliers.
10. Does each vendor have only the access it needs, and is that reviewed?
Good looks like: scoped accounts, no shared logins and a review at least yearly or whenever the contract changes.
11. Do contracts set a fixed time for breach notice, and do you know who to call?
Good looks like: a stated notice window (commonly 24 to 72 hours), a named contact on each side and a phone call to test that the contact works.
12. When a vendor says it deleted your data or passed an audit, how do you check?
Good looks like: a deletion certificate or a sample check. A security certification is a snapshot of a past period, not a guarantee of today. In one 2026 incident a provider holding a SOC 2 Type II report was breached through a tool it used, and data its contract required it to delete was still held.
4. Money and data movement
Most losses happen at the moment value moves. These questions ask how much friction sits in front of that moment.
13. What approval does a large payment, a bank detail change or a bulk data export need?
Good looks like: thresholds with two approvers. A change to payee details is confirmed by a call-back to a number you already hold.
14. Are there limits and alerts for unusual movement?
Good looks like: daily limits and alerts for new payees, large exports or odd timing. Alerts go to someone other than the person who made the request.
15. Can you halt payments or exports within minutes, and who may do it?
Good looks like: a documented stop switch, named people who can use it without convening a committee and a test at least once a year.
16. Are high-value credentials and signing authority kept apart from everyday systems?
Good looks like: held in controlled systems separate from the machines used for email and browsing. Access is logged and reviewed.
5. Detection and response
You will not prevent every incident. What you control is how fast you see it, how clearly you decide and how well you recover.
17. Do you keep logs long enough to reconstruct an incident?
Good looks like: at least a year of access and admin logs for critical systems, stored where a compromised administrator cannot erase them.
18. Is there a written breach plan, and has it been tested in the last 12 months?
Good looks like: roles, decision rights, contact lists and notification steps for regulators and customers, tested with a tabletop exercise.
19. Who owns an incident at two in the morning, and do they know it?
Good looks like: one named owner and one deputy, with phone numbers that work out of hours.
20. Could you restore critical systems and data from backups, and have you tried?
Good looks like: a restore test at least once a year, with backups kept apart from production credentials.
How to read your answers
- Count the No and Partial answers in each section.
- Start with sections 1 and 4. They decide how far one compromised device or account can reach.
- Two or more No answers in any section is a priority for the next 30 days.
- Do not aim for all Yes. Aim to know where one mistake would cost you most.
Where to start in the next 30 days
- Write the privileged access list from question 1 and remove what nobody can justify.
- Put a second approval on the money and data movements that would hurt most.
- Call your three most critical vendors and ask the notice and access questions from section 3.
If you handle personal data of people in India
Several of these questions also test obligations under the DPDP Act, which commence on 13 May 2027. The ceiling for failing to take reasonable security safeguards is ₹250 crore, and for failing to notify a breach it is ₹200 crore. The DPDP exposure assessment scores breach readiness and vendor accountability in under six minutes.
If your answers show gaps
Start with an assessment. It runs two to four weeks at a fixed price, and you own the output whether or not you carry on with us.
Start with an assessmentRelated
Sources
- Binance, security incident announcement, 29 October 2026
Binance's own statement. The source for the date of the breach and the figure of about $6.3 billion.
- Binance on X, initial investigation findings, 30 October 2026
Binance's own post. The source for the laptop, the service container and the unauthorised withdrawal transactions.
- TRM Labs, attribution of the Binance hack, October 2026
Attributes the attack with high confidence to TraderTraitor, a North Korea-linked group.
- Chainalysis on X, attribution of the Binance hack, October 2026
States a high degree of confidence that North Korea is responsible.
- ChainCatcher, Binance on blocked North Korea-linked attacks, 27 October 2026
Report of Binance's 27 October statement, referenced in question 8. A secondary report, as no original Binance post was located.
- DS Consulting, DPDP in scope and timeline
Commencement date and penalty ceilings, with links to the MeitY notification and the Schedule to the Act.
This is a management checklist, not legal advice or a security audit, and it does not test your systems. Dates and figures verified on 30 October 2026.
If your answers show gaps
A fixed price assessment over two to four weeks. You own the output whether or not you carry on with us.
Start with an assessmentThe five areas
Former IBM mainframe engineer turned operator across Tata and Tata-Tesco. Works at the seam between systems, governance and commercial execution.
LinkedIn profile →