# Laws, frameworks and account access

US rules on accounts tend to ask for four things: know who used each account, give only needed access, end it when people leave, and check your vendors.

Updated: October 16, 2026

US rules on company accounts use different words, but they tend to ask for the same four things. You can tell who used each account. People get only the access their work needs. Access ends when a person leaves or a contract ends. And you check how your vendors handle access. Which rules bind you depends on your industry, the data you hold and where your customers live. Before reading any one rule closely, sort out which ones apply.

## Which rules are law and which you choose

Laws and regulations bind the businesses they name, whether or not those businesses agree. Standards and frameworks bind you only if you adopt them, or a contract or customer requires them. The first table lists the laws and regulations, the second the frameworks and reports.

| Rule | What it is | Who it covers | What it asks of accounts |
| --- | --- | --- | --- |
| FTC Act section 5 (15 U.S.C. 45) | Federal law | Businesses in general; banks, common carriers and a few others are excepted | No account rules as such; it bars unfair or deceptive practices, and the FTC uses it in data security cases |
| FTC Safeguards Rule (16 CFR Part 314) | FTC regulation | Financial institutions under the FTC's jurisdiction, such as mortgage brokers, tax preparers and collection agencies | Access only for authorized users, limited to their duties; MFA; logs of user activity; vendor oversight |
| HIPAA Security Rule (45 CFR Part 164, Subpart C) | HHS regulation | Covered entities and business associates | Unique user ID (required); granting and ending access (addressable); audit controls |
| NY SHIELD Act (General Business Law 899-bb) | State law | Any person or business that owns or licenses computerized private information of New York residents | Reasonable safeguards; the program it lists includes binding service providers by contract |
| CCPA (Cal. Civ. Code 1798.150) | State law | Businesses covered by the CCPA | Consumers may sue when a breach follows a failure to keep reasonable security |
| NYDFS Part 500 (23 NYCRR 500) | State regulation | Companies licensed under New York's Banking, Insurance or Financial Services Law | Access limited to job needs; review at least yearly; end access promptly; MFA |
| Sarbanes-Oxley section 404 (15 U.S.C. 7262) | Federal law | Public companies | Management assesses its internal control over financial reporting, which reaches access to programs and data |

| Framework or report | What it is | Who uses it | What it asks of accounts |
| --- | --- | --- | --- |
| PCI DSS v4.0.1 | Industry standard from the PCI Security Standards Council | Businesses that handle payment card data | Unique ID per user; shared accounts only by exception; revoke at once when people leave; MFA into the card data environment |
| SOC 2 | A CPA's examination against AICPA criteria | Service companies whose customers ask for a report | Your own controls, which a Type 2 report tests |
| NIST CSF 2.0 | Voluntary framework of outcomes | Any organization | Outcomes on identities, sign-in and access permissions (PR.AA) |
| CIS Controls v8.1 | Free list of security safeguards | Any organization | Account inventory, dormant accounts, granting and revoking, MFA |

## What the laws ask

Section 5 of the FTC Act declares unfair or deceptive acts or practices unlawful. The FTC says it uses section 5 against companies that misled consumers by failing to keep their information secure. The statute itself says nothing about accounts.

The FTC Safeguards Rule is specific. It covers financial institutions that the FTC, not another regulator, oversees. It requires access controls that "Authenticate and permit access only to authorized users" and limit each user to the customer information their duties need (314.4(c)(1)). It requires MFA "for any individual accessing any information system," unless the person in charge of security approves an equivalent control in writing (314.4(c)(5)). It also requires monitoring and logging of what authorized users do (314.4(c)(8)). See [What the FTC Safeguards Rule requires for access, MFA and activity logs](/guides/compliance/ftc-safeguards-rule-access-controls).

HIPAA's Security Rule applies to covered entities and their business associates (164.302). Unique user identification is required, so each user gets a name or number that tracks who they are (164.312(a)(2)(i)). Audit controls must record and examine activity in systems that hold health information (164.312(b)). Procedures to end access when someone's job ends are "addressable" (164.308(a)(3)(ii)(C)), a label explained in [What is the HIPAA Security Rule?](/guides/healthcare-access/what-is-the-hipaa-security-rule). The access rules themselves are in [HIPAA Security Rule access control requirements](/guides/healthcare-access/hipaa-security-rule-access-control).

Some state laws apply by where your customers live. New York's 899-bb covers any person or business that owns or licenses computerized private information of New York residents. It asks for reasonable safeguards and lists ways to meet that standard. One of them is a security program whose elements include picking service providers that can keep appropriate safeguards and requiring those safeguards by contract. A small business, such as one with fewer than 50 employees, may use safeguards suited to its size and complexity. The attorney general enforces it, and it creates no private right of action.

California's CCPA, by contrast, gives consumers a right to sue. Under 1798.150, they can sue a covered business when certain personal information is breached because the business didn't keep [reasonable security](/guides/compliance/what-is-reasonable-security). Statutory damages are $100 to $750 for each consumer and each incident, adjusted over time, or actual damages if they're higher. The CCPA covers for-profit businesses that collect consumers' personal information and do business in California. A business must also meet at least one threshold, such as annual gross revenue over $25 million, which is likewise adjusted (1798.140(d)).

New York's Department of Financial Services (NYDFS) sets rules for companies it licenses. Part 500.7 requires them to limit access to what each user's job needs and to review all access at least once a year. It also says to "promptly terminate access following departures." Part 500.12 requires MFA for any individual accessing the company's systems, with a narrower version for companies that qualify for a limited exemption. See [What NYDFS Part 500 requires for access privileges and MFA](/guides/compliance/nydfs-part-500-access-privileges).

Public companies answer to section 404 of the Sarbanes-Oxley Act (SOX). Management reports each year on its internal control over financial reporting. The SEC's guidance names "access to programs and data" among the [IT general controls](/guides/compliance/what-is-itgc) that management may need to evaluate. [What a SOX audit asks about admin accounts, and which records to keep](/guides/privileged-access/sox-itgc-privileged-access) covers the records. Also see [How auditors test user access controls in a SOX audit](/guides/compliance/sox-itgc-user-access-testing).

## What the frameworks and reports ask

PCI DSS is the standard for payment card data, set by the PCI Security Standards Council. It applies, in the Council's words, to "all entities that store, process, or transmit cardholder data," and payment brands and acquirers run the compliance programs. Version 4.0.1 replaced 4.0 in 2024 without adding or removing requirements. Requirement 8.2.1 gives every user a unique ID. Under 8.2.2, shared accounts are allowed only by exception, with each person's identity confirmed first and every action traceable to one person. Requirement 8.2.5 requires revoking a terminated user's access immediately. See [How PCI DSS requirement 8 treats shared logins at online stores and agencies](/guides/compliance/pci-dss-requirement-8-shared-ids).

The rest are chosen, or asked for by customers. The AICPA says customers often ask service companies for a [SOC 2 report](/guides/compliance/what-is-soc2). NIST says its Cybersecurity Framework 2.0 may be adopted voluntarily or through government policies and mandates. Its PR.AA outcomes are covered in [How NIST CSF 2.0's PR.AA applies to shared accounts](/guides/compliance/nist-csf-2-identity-management). CIS says its Controls don't replace any regulatory or compliance scheme. Controls 5 and 6 are in [What CIS Controls 5 and 6 (v8.1) ask of your accounts](/guides/compliance/cis-controls-account-access-management). If a customer names [ISO/IEC 27001](/guides/compliance/what-is-iso-27001) instead, see [ISO 27001 access controls for SaaS accounts, and the evidence auditors look for](/guides/compliance/iso27001-access-control-for-saas).

## Four requirements the rules share

| Requirement | Where it appears | What to check at your company |
| --- | --- | --- |
| You can tell who used each account | HIPAA 164.312(a)(2)(i) and (b); FTC 314.4(c)(8); PCI DSS 8.2.1 and 8.2.2; NIST PR.AA-02 | Can you say which person used a shared login on a given day? |
| Only the access the work needs | FTC 314.4(c)(1)(ii); NYDFS 500.7(a)(1); NIST PR.AA-05 | Do you have a list of who may use each account? |
| Access ends when people leave | HIPAA 164.308(a)(3)(ii)(C); NYDFS 500.7(a)(6); PCI DSS 8.2.5; CIS 6.2 | Can anyone who left, or any vendor whose contract ended, still get in? |
| Vendors are checked | FTC 314.4(f); NY 899-bb; NYDFS 500.11; HIPAA 164.308(b) | Do your contracts and reviews cover how vendors control access? |

MFA sits alongside these four. The FTC Safeguards Rule, NYDFS Part 500.12 and PCI DSS 8.4.2 require it in the cases they name.

## Where to start

First, list the accounts your company uses. Mark the ones that several people sign in to with the same username and password. Without that list, you can't tell which access to end when someone leaves. [How to take inventory of shared accounts](/guides/shared-accounts/shared-account-inventory) shows what to record.

Next, write down who removes what when an employee leaves, a role changes or a vendor contract ends. Then check your vendor contracts for what they say about access. Whether to get a SOC 2 report or adopt a framework depends on what your customers ask for and what it costs. The laws in the first table apply before that decision, if they cover you.


## Articles in this guide

- [What access logs need to show when you decide whether to report a breach](/guides/compliance/breach-notification-access-logs): Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
- [Password sharing and the federal anti-hacking law (CFAA)](/guides/compliance/cfaa-password-sharing): The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
- [What CIS Controls 5 and 6 (v8.1) ask of your accounts](/guides/compliance/cis-controls-account-access-management): Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.
- [Account requirements for small federal contractors](/guides/compliance/federal-contractor-account-requirements): FAR 52.204-21 requires limiting access to authorized users and verifying each one. Defense work with CUI adds NIST SP 800-171 Rev. 2, including MFA.
- [What the FTC Safeguards Rule requires for access, MFA and activity logs](/guides/compliance/ftc-safeguards-rule-access-controls): Covered financial institutions must give access only to authorized users who need it, require MFA for anyone using their systems, and log what those users do.
- [Account controls in US insider threat guidance](/guides/compliance/insider-threat-guidance-account-controls): US insider threat guidance asks that account use trace to one person, shared accounts exist only when needed, access fit the job, and accounts close at exit.
- [What internal audit should check about accounts](/guides/compliance/internal-audit-account-checklist): Use NIST SP 800-53A's procedure for account management (AC-2). Examine account lists against HR and approval records, interview admins, and test removal.
- [ISO 27001 access controls for SaaS accounts, and the evidence auditors look for](/guides/compliance/iso27001-access-control-for-saas): NIST maps its account, least-privilege and password controls to ISO 27001:2022 A.5.15 to A.5.18 and A.8.2. Keep SaaS user lists, approvals and sign-in records.
- [What NIST SP 800-46 says about telework and personal devices](/guides/compliance/nist-800-46-telework-byod): NIST SP 800-46 Rev. 2 says to assume outside devices and networks are hostile, decide which devices may reach which systems, and prefer multi-factor sign-in.
- [How NIST CSF 2.0's PR.AA applies to shared accounts](/guides/compliance/nist-csf-2-identity-management): PR.AA limits access to authorized users, services and hardware, in six outcomes. CSF names no method, but NIST's examples say one credential per person.
- [What NIST CSF 2.0 asks about the accounts you give vendors](/guides/compliance/nist-csf-supply-chain-vendor-accounts): CSF 2.0's supply chain outcomes (GV.SC) ask you to know vendors, set contract terms, monitor them and plan the exit. SP 800-161 applies this to vendor accounts.
- [What NYDFS Part 500 requires for access privileges and MFA](/guides/compliance/nydfs-part-500-access-privileges): Part 500 requires DFS-regulated firms to limit access to job need, review it at least yearly, end it promptly at departure, and use MFA for nearly all access.
- [How PCI DSS requirement 8 treats shared logins at online stores and agencies](/guides/compliance/pci-dss-requirement-8-shared-ids): PCI DSS 8.2.2 allows shared accounts only by exception, with approval and every action traced to one person. The account rules also cover agency users.
- [What to hand over when your IT or security admin leaves](/guides/compliance/security-admin-handover-accounts): Name the successor first, give them admin rights, change the passwords the old admin knew, then remove the old admin's access and keep a record of each step.
- [What federal small business security guides say about accounts](/guides/compliance/small-business-cybersecurity-guidance-accounts): NIST and CISA guides for small businesses ask for access by job need, MFA, unique passwords, and removing access when people leave. One adds a login per person.
- [How auditors test user access controls in a SOX audit](/guides/compliance/sox-itgc-user-access-testing): The auditor takes samples of new users, leavers and access reviews from the year and checks each one against its approval, removal date or review record.
- [What is ISO 27001?](/guides/compliance/what-is-iso-27001): ISO/IEC 27001 is the ISO standard that sets requirements for an information security management system. Certification bodies audit companies against it.
- [What are IT general controls (ITGC)?](/guides/compliance/what-is-itgc): IT general controls are controls over the systems themselves, such as who can access them and how programs change, that automated financial controls rely on.
- [What is reasonable security?](/guides/compliance/what-is-reasonable-security): Reasonable security is a US legal standard of safeguards that fit your size, data and risks. Some state rules spell it out for logins and access.
- [What is SOC 2?](/guides/compliance/what-is-soc2): SOC 2 is a CPA's examination of a service company's system description and controls, measured against the AICPA's trust services criteria.

## Frequently asked questions

**Is it illegal to share an account at work?**

It depends on which rules cover you. HIPAA requires a unique ID for each user, which one shared login can't give. PCI DSS, an industry standard rather than a law, allows shared accounts only by exception, with each person's identity confirmed first.

**Which of these rules apply to a small business?**

That depends on your data and industry more than your size. New York's 899-bb lets a small business, such as one with fewer than 50 employees, use safeguards suited to its size.

**Do we need a SOC 2 report if no law requires one?**

No law here requires one. Service companies get a SOC 2 report because customers ask for it. The laws that cover you apply whether or not you have a report.

**Does any US rule require multi-factor authentication?**

Yes, for some. The FTC Safeguards Rule requires MFA for anyone accessing a covered financial institution's systems, and NYDFS Part 500.12 requires it for any individual accessing a covered entity's systems.

## Sources

- [15 U.S.C. 45, Unfair methods of competition unlawful (FTC Act section 5)](https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap2-subchapI-sec45.htm)
- [FTC, Privacy and Security Enforcement](https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-security-enforcement)
- [16 CFR 314.1, Purpose and scope (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.1)
- [16 CFR 314.4, Elements (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4)
- [45 CFR 164.302, Applicability (HIPAA Security Rule)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.302)
- [45 CFR 164.308, Administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)
- [45 CFR 164.312, Technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)
- [New York General Business Law 899-bb, Data security protections (NY Senate)](https://www.nysenate.gov/legislation/laws/GBS/899-BB)
- [California Consumer Privacy Act of 2018, Cal. Civ. Code 1798.140 and 1798.150 (text posted by the California Privacy Protection Agency, August 2024)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [NYDFS, Second Amendment to 23 NYCRR 500, Cybersecurity Requirements for Financial Services Companies (adopted text)](https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf)
- [15 U.S.C. 7262, Management assessment of internal controls (Sarbanes-Oxley Act section 404)](https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap98-subchapIV-sec7262.htm)
- [SEC Release No. 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting (2007)](https://www.sec.gov/rules/interp/2007/33-8810.pdf)
- [PCI SSC, PCI DSS v4.0 Self-Assessment Questionnaire C (requirement text for 8.2.1, 8.2.2, 8.2.5 and 8.4.2)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-C.pdf)
- [PCI SSC blog: Just Published: PCI DSS v4.0.1](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1)
- [AICPA & CIMA, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (guide, updated October 15, 2022)](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy)
- [NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
- [CIS, CIS Critical Security Controls FAQ](https://www.cisecurity.org/controls/cis-controls-faq)

## How Junify handles this

**Doing this by hand** You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.

**With Junify** Junify helps with three of the four. For each login you add, an admin picks who may use it. People verify on their own phone and sign in without seeing the password, so even a shared login shows who used it and when. Change the password at setup so only Junify holds it. Then once you remove someone in Junify, they can't sign in again, and there's no new password to send around. The record exports as CSV.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=compliance)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)