Hi again Erica
I have never been in that position however we have had clients in the past that have been and our recommendation is when ever you need to provide access to a contractor, you provide the least minimal possible. ie... if they need FTP access create an extra FTP login for them and then delete it when they have completed.
However if they need SSH or CNC access you can't create an extra login for that and in that case we recommend changing the password for the CNC after they have completed their work, to a new never before used password, and then take a look around to make sure that nothing unusual such as an extra FTP login hasn't been created, just for sanity's sake
-Bob