Contractor Onboarding Checklist
A contractor onboarding checklist for freelancers and agencies: NDA, scoped access with an end date, secure credential sharing and a clear first task.
- Typical schedule per new contractor
- The checklist 3 sections, 17 items
- Variables
{{contractor_name}}{{company}}{{end_date}}{{sponsor}} - Start from CI
Use this checklist when you bring in a freelancer, consultant or agency team for a project. It covers the paperwork that must exist before access is granted, the access itself, and the first days of work. It pairs with the contractor offboarding checklist, which uses the access list you build here.
Who owns it
The internal sponsor who hired the contractor owns the run. IT or the admin of each system grants access. Finance or the office manager checks that the contract and supplier details are in place. For agencies, name one contact on their side who tells you when people join or leave the project.
Common pitfalls
- Access before paperwork. Do not grant access to code or customer data before the contract and NDA or data processing terms are signed.
- Full employee access by default. Contractors rarely need the whole drive or every repository. Grant only what the project needs, ideally through a dedicated group.
- No end date on accounts. Set an expiry on guest and contractor accounts where your tools allow it. That way access ends even if offboarding is forgotten.
- Credentials shared in email. Use a password manager share or a secrets tool, and prefer personal accounts over shared logins.
- No written access list. Offboarding is only as good as the list of what was granted. Record each grant in this run.
The completed run is your record of what the contractor received. Start the offboarding run from it when the engagement ends.
The checklist: Onboard contractor {{contractor_name}} ({{company}})
Paperwork first
-
Contract or statement of work signed, with scope and end date
{{end_date}} -
NDA signed, or confidentiality covered in the contract
-
Data processing terms in place if the contractor handles personal data optional
-
Supplier and payment details recorded by finance
-
Sponsor
{{sponsor}}named as the owner of this engagement
Access
-
Access needed for the project listed and approved by
{{sponsor}}Write down each system and permission level. This list drives offboarding later.
-
Contractor account or guest account created with an expiry date of
{{end_date}}where supported -
MFA enforced on every account the contractor uses
-
Added to a contractor group with only the project's repositories, folders and channels
-
Credentials shared through the password manager or a secrets tool, never by email or chat
-
Access to production systems approved separately optional
-
Company device issued, or minimum requirements for their own device agreed optional
For example a supported OS, disk encryption and screen lock.
First days
-
Kick-off call held: goals, deliverables, contacts and working hours
-
Relevant documentation, coding standards and brand guidelines shared
-
Communication channels and the escalation contact confirmed
-
First task assigned with a clear definition of done
-
Reminder created for
{{end_date}}to start contractor offboarding
Checklist as Markdown
Start this checklist from your pipeline
When a contractor purchase order is approved, POST /api/v1/runs with template "Onboard contractor {{contractor_name}} ({{company}})" and end_date and sponsor.
curl -X POST https://runbook.metastic.ch/api/v1/runs \
-H "Authorization: Bearer $RUNBOOK_TOKEN" \
-H "Content-Type: application/json" \
-d '{"template": "Onboard contractor {{contractor_name}} ({{company}})", "variables": {"contractor_name": "…", "company": "…", "end_date": "…", "sponsor": "…"}}'Frequently asked questions
What should a contractor onboarding checklist include?
Paperwork first (contract, NDA, data processing terms if personal data is involved), then scoped access with an end date, secure credential sharing and a clear first task. Record every access grant so offboarding can reverse it. Adapt the contractual parts to your jurisdiction; this is a practical checklist, not legal advice.
How much access should a freelancer get?
Only what the project needs. A dedicated contractor group with access to specific repositories, folders and channels is easier to review and remove than individual grants. Ask for separate approval before granting access to production systems or customer data.
Can contractors use their own laptops?
Many teams allow it for short engagements, with minimum requirements such as a supported operating system, disk encryption and a screen lock. For access to sensitive data, a company-managed device is the safer choice. Write the decision down in the run.
Updated