Letting a vendor use your company's accounts

Checklist for taking back access when a vendor contract ends

Work in this order. List the vendor's accounts, disable its users, change shared passwords, check the login records, and get written confirmation of deletion.

Updated October 16, 2026

When a vendor contract ends, you have three jobs. Close every way the vendor’s staff can get into your systems, confirm that each one is closed, and have the vendor delete what it kept. Do the work in this order: the account list, disabling users, changing shared passwords, checking the records, and confirming deletion. When only one person on the vendor’s team changes, run the same steps for that person. If you’re the firm handing back a client’s accounts, see the account handover checklist when agency staff leave or change roles.

What to settle before the last day

Starting on the day the contract ends leaves no time to find accounts that aren’t on the list. Settle three things beforehand: who on your side does the work, the deadline (the end date itself or the next business day), and who at the vendor confirms the deletion. The 2023 Interagency Guidance on Third-Party Relationships lists access control after the relationship ends among the factors banks weigh when preparing to end one. The same planning works for any company.

Everything rests on the list of your accounts that the vendor uses. An account that isn’t on the list gets missed on the day. How to build the list is in the “Where to start” section of Letting a vendor use your company’s accounts.

Checklist for the end of a contract

Pull every row for that vendor from the list

Check the handover method (own users, shared login, or tool) and the names of the people who use each account.

Why

Each handover method closes in a different way.

How to check

Put the list next to the user list in each app and look for anyone missing.
Disable the users you created for the vendor’s staff

Until you do, each of them can still sign in with the same permissions.

Source

NIST SP 800-53 control AC-2 calls for disabling accounts in line with your policy and for telling account managers when users leave or move (AC-2f and AC-2h).

How to check

In each app’s user list, confirm the status shows as disabled or suspended.
Disable now and delete later

Disabling keeps the user in place; deleting removes it. Check what history the app keeps for a deleted user before you delete anyone.

Source

AC-2 lists disabling and removing accounts as separate actions. AU-11 asks you to keep audit records to support investigations after the fact.

How to check

After disabling a user, confirm you can still open that user’s past activity.
Change the password of any shared login you handed over

You can’t take a password back from someone’s memory. Changing it is the only way to make the old one useless. Give the new one only to the people who still need it.

Source

AC-2k asks for a process to change a shared account’s password when someone leaves the group.

How to check

Your staff can sign in with the new password, and the old one no longer works.
If you used an access management tool, remove the vendor’s people in it

The vendor’s staff never saw the password, so removing them in the tool stops them from signing in through it.

How to check

The vendor’s people no longer appear in the tool’s user list.
Move two-step verification codes to a phone or email your company controls

Two-step verification codes are the one-time codes some apps send at sign-in. If they still go to the vendor’s phone or inbox, your own staff can’t sign in.

How to check

In each account’s security settings, only your company’s phone numbers and addresses remain.
Check the login records after the end date

Look for sign-ins after the last day on the disabled users and the shared logins. A step that didn’t take shows up here.

Source

The FTC Safeguards Rule requires covered businesses to monitor and log the activity of authorized users (16 CFR 314.4(c)(8)). AC-2 asks you to monitor the use of accounts.

How to check

A few days after the end date, filter each app’s sign-in history from that date on.
Ask the vendor to delete saved passwords and data, and confirm it in writing

Passwords saved in a browser and files the vendor downloaded are out of your reach. Only the vendor can delete them. Ask for the date, what was deleted and how.

Source

The banking guidance lists timely return or destruction of data as a contract term. HIPAA requires business associate agreements to cover returning or destroying health information at termination, if feasible (45 CFR 164.504(e)(2)(ii)(J)).

How to check

File the vendor’s report with the contract.
Update the list and mark the vendor as ended

At the next contract or audit, this shows what you shut off and when.

How to check

Write the date and the name of the person who updated the list.

Steps 2 through 5 are what actually close access for each handover method. Until they’re done, the vendor’s staff can still sign in after the contract has ended. Steps 7 and 8 confirm that access is closed and the data is gone.

When one person on the vendor’s team changes

When someone on the vendor’s team leaves or rotates off your work, run the steps above for that person only. Disable their user. For a shared login, change the password and give the new one to the people who stay. In a tool, remove that person. Set up the replacement at the same time. If you don’t, either the work stops or the old person keeps access.

You have no way of knowing on your own when the vendor’s people leave. NIST SP 800-53 control PS-7 asks organizations to require vendors to report transfers and departures of their people who hold the organization’s logins, within a set time. Put that duty in the contract. Without it, you find changes only at a periodic review, by comparing each app’s user list with the vendor’s staff list. For covered financial institutions, the FTC Safeguards Rule requires periodic assessment of vendors (16 CFR 314.4(f)(3)), and comparing lists is one way to do it.

Why the last day matters for oversight

Taking back access and confirming deletion is the last check you make on a vendor. Ongoing checking is part of vendor oversight, explained in What is vendor oversight? The contract terms that make these steps possible are in What your vendor contract should say about accounts.

Frequently asked questions

How do we find out when someone on the vendor's team leaves?

Only the vendor can tell you. NIST SP 800-53 control PS-7 asks organizations to require vendors to report transfers and departures of their people who hold your logins. Put that duty in the contract.

Should we disable or delete the vendor's users?

Disable first. NIST treats disabling and removing accounts as separate steps, and AU-11 asks you to keep audit records for later investigations. Delete once you know the app's history for that user is kept or no longer needed.

Why change a shared password when the vendor leaves?

Everyone on the vendor's team who used it still knows it. A new password is the only thing that makes the old one useless. Give it only to the people who stay.

How do we confirm the vendor deleted our data?

Ask for a written report of the date, what was deleted and how. Banking guidance lists timely return or destruction of data as a contract term, and HIPAA business associate agreements must cover it.

How Junify handles this

Doing this by hand: You keep a list of which vendor staff use which of your accounts, shut off access every time a contract ends or a person changes, and keep checking how the vendor uses them.
With Junify: For accounts you handed over through Junify, you remove the vendor team's access in Junify on the last day, and they can't sign in again. They never received the password, so even a shared account needs no new password sent around. The record of who used each account and when, up to the last day, stays on your side, person by person.

Try the demo Book a 30-minute demo