# What NIST CSF 2.0 asks about the accounts you give vendors

CSF 2.0's supply chain outcomes (GV.SC) ask you to know vendors, set contract terms, monitor them and plan the exit. SP 800-161 applies this to vendor accounts.

Updated: October 16, 2026

NIST's Cybersecurity Framework (CSF) 2.0 handles vendors under cybersecurity supply chain risk management, category GV.SC. Its outcomes ask you to know your suppliers and rank them, put security requirements in contracts, and manage the risk while the relationship lasts. They also ask you to plan for what happens after it ends. For accounts, NIST SP 800-161 Rev. 1 fills in the detail. It asks for one account per vendor staff member, access only while the contract runs, and terms set in the agreement.

## Where vendor accounts fit in CSF 2.0

NIST published CSF 2.0 as Cybersecurity White Paper 29 on February 26, 2024. It's a list of outcomes that any organization can use, whatever its size. It may be adopted voluntarily or through government policies and mandates. NIST says the CSF doesn't prescribe how outcomes should be achieved.

GV.SC sits in the Govern function, which covers risk management strategy, expectations and policy. For deeper guidance, the framework points to SP 800-161 Rev. 1. Who may sign in to what is a separate category, identity management and access control (PR.AA). PR.AA-05 asks that access permissions be managed and reviewed, following least privilege and separation of duties.

## The GV.SC outcomes that touch accounts

GV.SC has 10 outcomes. These six bear most directly on the accounts you hand to vendors. The wording in the middle column is a paraphrase. The right column is how it applies to accounts, which the framework itself doesn't spell out.

| Outcome | What CSF 2.0 says | For vendor accounts |
| --- | --- | --- |
| GV.SC-02 | Security roles and duties for suppliers are set and shared | Decide who at the vendor asks for access and who reports departures |
| GV.SC-04 | Suppliers are known and ranked by criticality | Keep a list of vendors with access, and the accounts each one uses |
| GV.SC-05 | Security requirements are set and written into contracts | Write account terms into the contract |
| GV.SC-06 | Planning and due diligence happen before the relationship starts | Settle how access is given before the first login |
| GV.SC-07 | Supplier risk is assessed and monitored while the relationship lasts | Check who at the vendor is using which account |
| GV.SC-10 | Plans cover what happens after the agreement ends | Plan how access ends on the last day |

## How SP 800-161 makes it concrete

SP 800-161 Rev. 1 is NIST's guide to cybersecurity supply chain risk management. The current version is dated May 2022, with an update published on November 1, 2024. It's written for federal agencies, and NIST says nongovernmental organizations may use it voluntarily. Its appendix adds supply chain guidance to the controls in SP 800-53 Rev. 5.

On access in general, it says outside parties should get only the type, duration and level of access they need, and that access should be monitored.

On accounts (AC-2), it says enterprises must use unique accounts for contractor personnel and make sure those accounts don't outlast the contract's period of performance. Privileged accounts should go only to contractor staff who have been properly vetted. Under IA-2, it counts contractors among the organization's users, alongside employees.

On remote access (AC-17), it says to allow remote access only to vetted people, and only as their tasks require. Requirements such as multi-factor authentication, allowed hours, specific assets and allowed locations "must be properly defined in agreements."

On staff security (PS-7), it says vendor staff with access must meet the same personnel security requirements as your own people. The base control in SP 800-53, PS-7, also asks vendors to report when their staff with your logins move or leave.

On records (AU-2 and AU-6), it suggests reviewing a vendor's logs when the contract comes up for renewal. Contracts should also say how audit findings will be reported and settled.

On subcontractors, the AC-2, AC-17 and AU-2 entries, like many others, tell you to require the prime contractor to pass the requirement down to its own subcontractors.

## Where shared logins fall short

The simplest way to give a vendor access is one login, with the password sent to the vendor's team. That runs against the unique-account guidance above, for two reasons. First, the app's log shows the account name, so you can't see which of the vendor's people acted, and GV.SC-07's monitoring has little to work with. Second, the account has no end date for any one person. When someone at the vendor leaves, the only way to lock them out is a new password for everyone else.

What to ask a vendor that works this way is in [What to check when a vendor says its team uses one shared login](/guides/outsourcing-access/when-contractor-uses-shared-id). The steps for the last day are in the [checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end).

## A starting list per vendor

- Which of your accounts the vendor uses, and the people who use each one.
- The contract terms: one login per person, remote access rules, and when the vendor must report a departure.
- How you'll see who used each account, and when you'll review it.
- What happens to each account on the last day, and who confirms it.


## Frequently asked questions

**Do we have to follow NIST CSF 2.0?**

NIST says any organization can use CSF 2.0, whatever its size, and that it may be adopted voluntarily or through government mandates. It doesn't prescribe how to reach its outcomes.

**What's the difference between CSF 2.0 and SP 800-161?**

CSF 2.0 names the outcomes, such as GV.SC-05 on contract terms. SP 800-161 Rev. 1 explains how to manage supply chain risk in depth, control by control. The CSF itself points to it.

**Should each person at a vendor get their own login?**

SP 800-161 says organizations must use unique accounts for contractor staff and make sure those accounts don't outlast the contract. It's written for federal agencies; others may use it voluntarily.

**How do we find out when someone at the vendor leaves?**

Usually only the vendor knows. NIST SP 800-53 control PS-7 asks you to require vendors to report transfers and departures of their staff who hold your logins, within a time you set.

## Sources

- [NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
- [NIST SP 800-161 Rev. 1 (May 2022, updated November 1, 2024), Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)
- [NIST SP 800-161r1-upd1 (PDF)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (PS-7)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)

## How Junify handles this

**Doing this by hand** You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.

**With Junify** With Junify, the vendor's people sign in to your accounts without being given the password. Each person verifies on their own phone before Junify fills in the login, so the admin sees which accounts each vendor's people may use and who signed in when. When a person leaves the vendor or the contract ends, the admin removes their access in Junify, and nobody has to change the password and send it around.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=compliance&slug=nist-csf-supply-chain-vendor-accounts)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What access logs need to show when you decide whether to report a breach](/guides/compliance/breach-notification-access-logs): Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
- [Password sharing and the federal anti-hacking law (CFAA)](/guides/compliance/cfaa-password-sharing): The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
- [What CIS Controls 5 and 6 (v8.1) ask of your accounts](/guides/compliance/cis-controls-account-access-management): Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.