Laws, frameworks and account access

US rules on company accounts use different words, but they tend to ask for the same four things. You can tell who used each account. People get only the access their work needs. Access ends when a person leaves or a contract ends. And you check how your vendors handle access. Which rules bind you depends on your industry, the data you hold and where your customers live. Before reading any one rule closely, sort out which ones apply.

Which rules are law and which you choose

Laws and regulations bind the businesses they name, whether or not those businesses agree. Standards and frameworks bind you only if you adopt them, or a contract or customer requires them. The first table lists the laws and regulations, the second the frameworks and reports.

What the laws ask

Section 5 of the FTC Act declares unfair or deceptive acts or practices unlawful. The FTC says it uses section 5 against companies that misled consumers by failing to keep their information secure. The statute itself says nothing about accounts.

The FTC Safeguards Rule is specific. It covers financial institutions that the FTC, not another regulator, oversees. It requires access controls that “Authenticate and permit access only to authorized users” and limit each user to the customer information their duties need (314.4(c)(1)). It requires MFA “for any individual accessing any information system,” unless the person in charge of security approves an equivalent control in writing (314.4(c)(5)). It also requires monitoring and logging of what authorized users do (314.4(c)(8)). See What the FTC Safeguards Rule requires for access, MFA and activity logs.

HIPAA’s Security Rule applies to covered entities and their business associates (164.302). Unique user identification is required, so each user gets a name or number that tracks who they are (164.312(a)(2)(i)). Audit controls must record and examine activity in systems that hold health information (164.312(b)). Procedures to end access when someone’s job ends are “addressable” (164.308(a)(3)(ii)(C)), a label explained in What is the HIPAA Security Rule?. The access rules themselves are in HIPAA Security Rule access control requirements.

Some state laws apply by where your customers live. New York’s 899-bb covers any person or business that owns or licenses computerized private information of New York residents. It asks for reasonable safeguards and lists ways to meet that standard. One of them is a security program whose elements include picking service providers that can keep appropriate safeguards and requiring those safeguards by contract. A small business, such as one with fewer than 50 employees, may use safeguards suited to its size and complexity. The attorney general enforces it, and it creates no private right of action.

California’s CCPA, by contrast, gives consumers a right to sue. Under 1798.150, they can sue a covered business when certain personal information is breached because the business didn’t keep reasonable security. Statutory damages are $100 to $750 for each consumer and each incident, adjusted over time, or actual damages if they’re higher. The CCPA covers for-profit businesses that collect consumers’ personal information and do business in California. A business must also meet at least one threshold, such as annual gross revenue over $25 million, which is likewise adjusted (1798.140(d)).

New York’s Department of Financial Services (NYDFS) sets rules for companies it licenses. Part 500.7 requires them to limit access to what each user’s job needs and to review all access at least once a year. It also says to “promptly terminate access following departures.” Part 500.12 requires MFA for any individual accessing the company’s systems, with a narrower version for companies that qualify for a limited exemption. See What NYDFS Part 500 requires for access privileges and MFA.

Public companies answer to section 404 of the Sarbanes-Oxley Act (SOX). Management reports each year on its internal control over financial reporting. The SEC’s guidance names “access to programs and data” among the IT general controls that management may need to evaluate. What a SOX audit asks about admin accounts, and which records to keep covers the records. Also see How auditors test user access controls in a SOX audit.

What the frameworks and reports ask

PCI DSS is the standard for payment card data, set by the PCI Security Standards Council. It applies, in the Council’s words, to “all entities that store, process, or transmit cardholder data,” and payment brands and acquirers run the compliance programs. Version 4.0.1 replaced 4.0 in 2024 without adding or removing requirements. Requirement 8.2.1 gives every user a unique ID. Under 8.2.2, shared accounts are allowed only by exception, with each person’s identity confirmed first and every action traceable to one person. Requirement 8.2.5 requires revoking a terminated user’s access immediately. See How PCI DSS requirement 8 treats shared logins at online stores and agencies.

The rest are chosen, or asked for by customers. The AICPA says customers often ask service companies for a SOC 2 report. NIST says its Cybersecurity Framework 2.0 may be adopted voluntarily or through government policies and mandates. Its PR.AA outcomes are covered in How NIST CSF 2.0’s PR.AA applies to shared accounts. CIS says its Controls don’t replace any regulatory or compliance scheme. Controls 5 and 6 are in What CIS Controls 5 and 6 (v8.1) ask of your accounts. If a customer names ISO/IEC 27001 instead, see ISO 27001 access controls for SaaS accounts, and the evidence auditors look for.

Four requirements the rules share

MFA sits alongside these four. The FTC Safeguards Rule, NYDFS Part 500.12 and PCI DSS 8.4.2 require it in the cases they name.

Where to start

First, list the accounts your company uses. Mark the ones that several people sign in to with the same username and password. Without that list, you can’t tell which access to end when someone leaves. How to take inventory of shared accounts shows what to record.

Next, write down who removes what when an employee leaves, a role changes or a vendor contract ends. Then check your vendor contracts for what they say about access. Whether to get a SOC 2 report or adopt a framework depends on what your customers ask for and what it costs. The laws in the first table apply before that decision, if they cover you.