Contractor governance is the set of controls that define what third-party staff can do, how their work is reviewed, and when their access must end. It covers account provisioning, role-based access, approval workflows, logging, separation of duties, and periodic access recertification. In security terms, it turns a vendor relationship into a controlled administrative boundary.
This matters because contractors often handle privileged tasks such as patching, support, or system administration. If governance is weak, an attacker can abuse overbroad permissions, stale accounts, or unclear responsibility to move through trusted systems without immediate detection. Strong contractor governance reduces that risk by limiting privileged access, requiring named ownership for each task, and verifying actions after changes are made. In real defenses, it appears as just-in-time access, time-limited credentials, supervised admin activity, and rapid offboarding when work ends.