Provide the vendor with permanent VPN credentials to avoid delays during future incidents.

Deny all remote access and require the vendor to perform all diagnostics on-site.

Allow the vendor to connect directly using their own remote access tools for speed and convenience. 

Grant the vendor a secure, time-limited, monitored remote access session using multi-factor authentication (MFA), then revoke their access after they complete the task.