What NIST CSF 2.0 asks about the accounts you give vendors

NIST’s Cybersecurity Framework (CSF) 2.0 handles vendors under cybersecurity supply chain risk management, category GV.SC. Its outcomes ask you to know your suppliers and rank them, put security requirements in contracts, and manage the risk while the relationship lasts. They also ask you to plan for what happens after it ends. For accounts, NIST SP 800-161 Rev. 1 fills in the detail. It asks for one account per vendor staff member, access only while the contract runs, and terms set in the agreement.

Where vendor accounts fit in CSF 2.0

NIST published CSF 2.0 as Cybersecurity White Paper 29 on February 26, 2024. It’s a list of outcomes that any organization can use, whatever its size. It may be adopted voluntarily or through government policies and mandates. NIST says the CSF doesn’t prescribe how outcomes should be achieved.

GV.SC sits in the Govern function, which covers risk management strategy, expectations and policy. For deeper guidance, the framework points to SP 800-161 Rev. 1. Who may sign in to what is a separate category, identity management and access control (PR.AA). PR.AA-05 asks that access permissions be managed and reviewed, following least privilege and separation of duties.

The GV.SC outcomes that touch accounts

GV.SC has 10 outcomes. These six bear most directly on the accounts you hand to vendors. The wording in the middle column is a paraphrase. The right column is how it applies to accounts, which the framework itself doesn’t spell out.

How SP 800-161 makes it concrete

SP 800-161 Rev. 1 is NIST’s guide to cybersecurity supply chain risk management. The current version is dated May 2022, with an update published on November 1, 2024. It’s written for federal agencies, and NIST says nongovernmental organizations may use it voluntarily. Its appendix adds supply chain guidance to the controls in SP 800-53 Rev. 5.

On access in general, it says outside parties should get only the type, duration and level of access they need, and that access should be monitored.

On accounts (AC-2), it says enterprises must use unique accounts for contractor personnel and make sure those accounts don’t outlast the contract’s period of performance. Privileged accounts should go only to contractor staff who have been properly vetted. Under IA-2, it counts contractors among the organization’s users, alongside employees.

On remote access (AC-17), it says to allow remote access only to vetted people, and only as their tasks require. Requirements such as multi-factor authentication, allowed hours, specific assets and allowed locations “must be properly defined in agreements.”

On staff security (PS-7), it says vendor staff with access must meet the same personnel security requirements as your own people. The base control in SP 800-53, PS-7, also asks vendors to report when their staff with your logins move or leave.

On records (AU-2 and AU-6), it suggests reviewing a vendor’s logs when the contract comes up for renewal. Contracts should also say how audit findings will be reported and settled.

On subcontractors, the AC-2, AC-17 and AU-2 entries, like many others, tell you to require the prime contractor to pass the requirement down to its own subcontractors.

Where shared logins fall short

The simplest way to give a vendor access is one login, with the password sent to the vendor’s team. That runs against the unique-account guidance above, for two reasons. First, the app’s log shows the account name, so you can’t see which of the vendor’s people acted, and GV.SC-07’s monitoring has little to work with. Second, the account has no end date for any one person. When someone at the vendor leaves, the only way to lock them out is a new password for everyone else.

What to ask a vendor that works this way is in What to check when a vendor says its team uses one shared login. The steps for the last day are in the checklist for taking back access when a vendor contract ends.

A starting list per vendor

• Which of your accounts the vendor uses, and the people who use each one.
• The contract terms: one login per person, remote access rules, and when the vendor must report a departure.
• How you’ll see who used each account, and when you’ll review it.
• What happens to each account on the last day, and who confirms it.