Mechanisms exist to require internal and third-party users to sign appropriate access agreements prior to being granted access.
Does the organization require internal and third-party users to sign appropriate access agreements prior to being granted access?