Every assessor eventually asks the same three questions. Who was on the network? What could they reach? Can you show me? For the locum doctor on a six-week placement or the elevator technician with a laptop, the honest answer is usually the guest Wi-Fi password, often the same one as last year.
Most guest Wi-Fi guides explain how to get visitors online. This one starts from the audit instead: three kinds of non-employee access, a control map across five frameworks, and a comparison of authentication methods. It’s design guidance, not legal advice, so check obligations with your compliance team and assessor.
What is contractor network access? It’s connectivity for third-party staff and their devices, limited in scope and time, so they reach only the systems the engagement needs. Unlike guest Wi-Fi, it needs authentication tied to a real identity, segment-level authorization, a way to cut access when the engagement ends, and records showing who connected, when, and what they could reach.
Why this is an audit problem
A separate guest network with a shared password gives you basic isolation but no idea who is on it. Regulated organizations have to show that access to patient records, payment systems or operational technology is limited to people allowed it. The Authentication, Authorization and Accounting (AAA) server does that by making a decision, and keeping a record, for every session.
Three kinds of access
A visitor, a contractor and a contractor’s badge reader stay for different lengths of time and reach different things. Give each its own lane.
| Population | Lifetime | Privilege | Authentication that fits |
| Visitors and guests | Hours to a day | Internet only | Sponsored captive portal with one-time passcode (OTP) |
| Contractors, vendors, agency staff | Weeks to years | Named internal systems | 802.1X with EAP-TLS certificates, or directory-backed EAP with expiry |
| Contractor-managed devices (IoT, OT, medical, POS) | Life of the asset | One or two flows | MAC authentication bypass (MAB) with profiling |
Guests can offer accountability but not strong identity. Nobody enrolls a certificate for a two-hour meeting, so insist on a named sponsor, a session that ends after set hours, and no route to regulated systems.
Contractors stay too long for guest access and sit too far outside for staff access. They need an identity that expires with the engagement, access scoped to the work, and records that point to a named person.
Contractor-managed devices can’t log in. Infusion pumps, badge readers and payment terminals arrive with a vendor, and many can’t run an 802.1X supplicant. Authenticate them as far as the hardware allows, confine them to the traffic they need, and log it.
What frameworks expect from third-party network access
No framework certifies a Wi-Fi design, but they all ask for the same four things: identify the person or device, limit what it can reach, end access when it should end, and keep records proving all three. Run this mapping past your assessor before relying on it; it’s design guidance, not legal advice.
| Framework | What AAA has to enforce | Evidence to keep |
| HIPAA Security Rule (45 CFR 164.312) | Unique user IDs; authentication before access; third parties kept off systems holding electronic protected health information (ePHI) | Per-identity session records; segment assignment; log reviews |
| PCI DSS v4.0.1, Req. 1, 7, 8, 10 | Untrusted networks isolated from the cardholder data environment (CDE); third-party remote accounts enabled only while in use | Session logs with identity; 12 months of history, 3 immediately available |
| NERC CIP-004, 005, 007 | Multi-factor authentication (MFA) for Interactive Remote Access; ability to see and end vendor sessions; revocation within 24 hours | Revocation records; vendor session logs; 90 days of security events |
| NIST SP 800-53 Rev. 5 (AC-2, AC-17, IA-2, AU-2) | Account lifecycle with automatic disabling; controlled remote access | Account expiry records; remote-access logs |
| ISO/IEC 27001:2022 and SOC 2 CC6 | Documented supplier access rights; segregated third-party traffic | Access-rights register with expiry dates; retained logs |
PCI DSS v4.0.1 is current, and v4.0 retired at the end of 2024. HHS has proposed a Security Rule update that would make MFA and segmentation explicit, so check its status.
Authentication options by population
No single method fits all three groups. Force one and contractors end up on the guest portal.
| Method | Best for | Identity assurance | Evidence produced |
| Sponsored portal with OTP | Visitors | Low: contact detail, named sponsor | Sponsor, consent, session times |
| 802.1X with EAP-TLS | Laptops that can hold a certificate | High: revocable public key infrastructure (PKI) certificate | Certificate subject, device, sessions |
| 802.1X with EAP-TTLS or PEAP | Contractors with directory accounts | Medium to high: expiring credential | Inner username, realm, sessions |
| MAB with profiling | Devices without a supplicant | Low: a hardware address | Device, profile match, segment |
Portal.
A portal records consent and a contact detail, never identity. It’s still right for visitors if a sponsor approves each request through single sign-on (SSO) and the session clock runs in hours. In switch-based designs, login ends with a Change of Authorization (CoA) message that moves the device onto the guest segment, so a broken CoA path shows up here first.
802.1X.
For laptops that can hold a certificate, EAP-TLS (RFC 5216; RFC 9190 for TLS 1.3) is strongest: revoke the certificate and access ends. For shorter engagements, EAP-TTLS or PEAP against the contractor’s directory account lets its end date govern access. Both can send an anonymous outer identity, so make sure the AAA server returns the real inner identity in the Access-Accept (RFC 2865).
MAB.
The switch sends the device’s MAC address as its username, and anyone can copy one off a label. Pair it with profiling, confine the device to its management server, and document the exception with an owner and a review date. An undocumented MAB bypass into the CDE is a finding.
Federation.
eduroam and OpenRoaming let visitors use their home institution’s identity. You’re trusting someone else’s checks, so treat it as a stronger guest option, never contractor authentication.
Authorization: segmentation, least privilege and time limits
After accepting a session, the AAA server returns attributes the switch or controller enforces: Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID for the VLAN (RFC 3580), and Filter-Id or vendor-specific attributes for ACLs and roles. Guests land on a VLAN that reaches the internet and nothing else, contractors on a segment scoped to the engagement, devices behind an ACL permitting one management flow. Set a Session-Timeout too, since re-authentication is when a disabled account finally takes effect.
The unplanned ending matters most, such as a contractor dismissed at noon. RFC 5176 lets the AAA server send a Disconnect-Request, or a CoA-Request that moves the device to quarantine. The switch must support it, the firewall must pass UDP 3799 from the server, and the request must name the session by Acct-Session-Id, so accounting has to be complete first. The CoA record, with timestamp and reason, is your evidence.
Some contractors configure the network. TACACS+ (RFC 8907) authorizes each command and logs it against their identity. Alepo’s TACACS+ Server does this on the same platform as the AAA described here.
Accounting and audit evidence
Log the authentication result and identity, the network access server, attributes returned, session start and stop with Acct-Terminate-Cause, every CoA and Disconnect event with a reason, and every command in a privileged session. Tie each record to a person through your identity store and send it to the security information and event management (SIEM) platform.
Set retention to the strictest framework you answer to: twelve months for PCI DSS with three immediately available, ninety days for NERC CIP-007. HIPAA sets no log period, so many organizations use its six-year documentation rule.
Reference architecture
Controllers, access points and switches enforce 802.1X, MAB and portal redirection. A pair of active-active AAA servers authenticates against a PKI, a directory with end-dated contractor accounts and a sponsor portal behind SSO, then returns segment attributes, issues CoA and writes accounting. A firewall guards the regulated zones and a SIEM holds the evidence.
Keep third-party identities in their own realm, and make sponsor approval fast enough that nobody falls back on the shared password. Alepo’s AAA Server covers the policy layer, with RADIUS, Diameter and TACACS+ on one stack, CoA, LDAP and SQL integration, and multi-realm support.
Implementation checklist
What an assessor looks for first:
- Separate SSIDs or realms for guests, contractors and devices.
- A named sponsor for every guest session.
- A certificate or directory identity for every contractor.
- An expiry date on every third-party identity.
- Segments returned by the AAA server, not set per port.
- CoA reachability tested, not assumed.
- Accounting tied to identity and sent to the SIEM.
- Retention set to the strictest framework in scope.
For operators and MSPs
Operators and MSPs can offer this as a service, with three added requirements: tenants in their own realms, policy set per tenant, and logs scoped so one customer’s evidence export never contains another’s. Alepo’s WiFi Monetization offers a branded captive portal with OTP and voucher login, multi-tenant deployment with dedicated SSIDs and role-based access, and the AAA platform behind it.
Review your design with an Alepo specialist
Bring your population model, segmentation diagram and frameworks, and we’ll walk through where the AAA server has to enforce policy and what evidence it should keep. Talk to an expert. Not ready? Read how command accounting maps to ISO 27001, SOC 2 and PCI DSS in our TACACS+ compliance article.
Frequently asked questions
Q1. What’s the difference between guest access and contractor access?
Guests get internet-only access for a few hours under a named sponsor. Contractors get a named identity that expires with the engagement, access scoped to their work, and records that point to them. Guests get a portal; contractors get 802.1X.
Q2. Is guest Wi-Fi HIPAA compliant?
HIPAA doesn’t certify Wi-Fi. Its safeguards call for access control, authentication and audit controls over systems holding ePHI. A segmented guest network with sponsored, time-limited sessions and retained logs supports them. A shared password with a route to clinical systems works against them.
Q3. Does PCI DSS require guest networks to be segmented?
Not as a standalone rule, but segmentation keeps assessment scope small, and Requirement 1 expects untrusted networks, guest Wi-Fi included, to be isolated from the CDE.
Q4. Is a captive portal secure enough for contractors?
No. A portal records consent, not identity. Use 802.1X with a certificate or an expiring directory account.
Q5. How do you revoke a contractor’s access immediately?
Disable the identity, then have the AAA server send a Disconnect-Request or CoA-Request under RFC 5176. Skip that step and the session lasts until its next re-authentication.
Q6. How long should access logs be kept?
It varies: twelve months for PCI DSS, ninety days for NERC CIP-007, no fixed period for HIPAA. Use the longest that applies and confirm with compliance.
Q7. Can an operator deliver compliant guest and contractor access as a service?
Yes, with multi-tenant AAA: realm isolation, per-tenant policy and tenant-scoped logs.
