Developers, administrators, and technical contractors may receive access to source code, cloud services, integrations, and credentials. The hiring process should account for that access before a candidate opens a coding test or receives a company device.
What the evidence supports
The FBI has documented fraudulent remote IT-worker schemes involving false identities, device-forwarding arrangements, unauthorized remote-access tools, and access to U.S. company networks. Those facts justify stronger onboarding controls without assuming that every remote candidate is suspicious.
Why it matters to a Connecticut operator
Smaller operators often combine hiring, IT, and access approval informally. A simple separation of duties can prevent one person from both validating an identity and granting powerful access.
Operator checklist
- Run coding exercises only in an isolated environment with no production credentials.
- Verify identity and work location before shipping a managed device.
- Require a second approver for privileged roles and third-party administrative access.
- Use time-limited onboarding access and review it after the first week and first month.
Scope note: This briefing separates documented facts from practical recommendations. It is cybersecurity guidance, not legal advice or a statement that every recommended control is expressly required by Connecticut cannabis regulations.