Authorization Research
After-hours vendor authorization control study
A source-based protocol for auditing whether urgent vendor requests stay within approval, identity, and payment boundaries.
Finding and scope
Public cybersecurity and fraud guidance supports independent verification, least privilege, and documented approvals. It does not prove that any particular vendor call is legitimate or set a universal spending limit. This review defines an audit protocol; no private vendor records or financial losses were analyzed.
Evidence base
NIST Cybersecurity Framework 2.0 emphasizes governance and access controls. The NIST small-business cybersecurity guidance translates security practices for smaller organizations. The FTC small-business cybersecurity guidance warns businesses to protect accounts and information, while CISA phishing guidance recommends recognizing and reporting suspicious requests. These sources do not authenticate a caller.
Proposed method
Freeze a period of eligible after-hours vendor contacts. For each, code claimed vendor, request type, callback channel, directory verification, purchase or work-order reference, requested access, requested payment change, approving owner, approval timestamp, work outcome, and exception. Distinguish a known phone number from an independently verified contact route.
The primary control result is the share of consequential requests that show both required identity verification and approval before action. Report missing records and attempted bypasses. Sample ordinary and urgent requests because urgency may change behavior, and review false positives so a control is not judged only by blocks.
Decision boundaries
An assistant may capture facts, use an approved directory, and notify the on-call owner. It should not disclose access details, change banking information, approve spend, waive verification, or treat caller ID as proof. A named human owner decides exceptions and documents the reason.
Limitations
Logs can show that steps were recorded, not that the underlying person was legitimate. The study cannot estimate fraud prevented without a validated outcome process. Local policy, contracts, and law may impose requirements beyond this protocol.
Sources
1. NIST Cybersecurity Framework 2.0 2. NIST Small Business Cybersecurity Corner 3. FTC Cybersecurity for Small Business 4. CISA, Recognize and Report Phishing