What your vendor contract should say about accounts

The account clauses in a vendor contract say who on the vendor’s side may get into your systems, what record they leave, and what happens when the work ends. US rules that require vendor contracts ask for safeguards and a way for you to keep checking. Applied to accounts, that gives four clauses: scope of use, no sharing, records and incident notice, and shutdown at the end.

Why the contract has to cover accounts

Several rules require the contract itself. The FTC Safeguards Rule requires covered financial institutions to require safeguards from service providers “by contract” (16 CFR 314.4(f)(2)). Under HIPAA, a business associate agreement must require the vendor to use appropriate safeguards and comply with the Security Rule (45 CFR 164.504(e)(2)(ii)(B) and 164.314(a)(2)(i)). The meaning of oversight behind these rules is in What is vendor oversight?

The California Consumer Privacy Act spells out the contract in the most detail. Civil Code 1798.100(d) requires an agreement with every service provider, and 11 CCR 7051(a) lists the terms it must contain. Four of them bear on accounts:

1. The specific business purposes for the data, described specifically rather than by pointing to the whole contract (7051(a)(2)).
2. Compliance with the CCPA. The regulation gives, as an example, a term requiring reasonable security procedures (7051(a)(5)).
3. Your right to take reasonable steps to check the vendor’s use of the data, which may include audits or testing at least once every 12 months (7051(a)(6)).
4. Your right, after notice, to stop and fix unauthorized use (7051(a)(8)).

A firm without a contract that meets 7051(a) is not a service provider under the CCPA (11 CCR 7050(e)). Your disclosure to it may then count as a sale or sharing of personal information.

Banks get a fuller list from the 2023 Interagency Guidance on Third-Party Relationships. Its contract topics include reports from the vendor, the right to audit, confidentiality, breach notice, and the timely return or destruction of the bank’s data at termination.

Four clauses and sample wording

The samples are not copied from any company’s contract. They are general wording matched to the rules above. Each comes with the requirement it answers.

Scope of use

The Vendor shall use accounts issued or provided by the Company only for the services under this Agreement, and only through personnel the Vendor has named to the Company in writing. The Vendor shall notify the Company in writing before adding or replacing personnel. The Vendor shall not let any subcontractor use the accounts without the Company’s prior written approval.

This clause answers the CCPA’s limited-purpose terms (7051(a)(2) and (3)) and the FTC rule’s access controls, which limit users to the information they need for their duties (314.4(c)(1)(ii)). Naming personnel also gives you the list you need when the contract ends. Limit each account’s permissions to the work too, as the FTC rule’s access controls ask.

No sharing

The Vendor shall not let anyone other than its named personnel use the accounts, and shall not disclose usernames or passwords to any third party. If the Company provides a shared account, the Vendor shall give the Company the names of everyone who knows its password, and shall ask the Company to change the password promptly when any of them leaves the work.

The first sentence answers the FTC rule’s requirement to “Authenticate and permit access only to authorized users” (314.4(c)(1)(i)). The second covers the case where you hand over a shared login. NIST SP 800-53 control AC-2 asks for a process to change a shared account’s password when someone leaves the group (AC-2k).

Records and incident notice

The Vendor shall keep records showing who used each account and when, for the term of this Agreement and [period] after it ends, and shall provide them to the Company on request. The Vendor shall notify the Company within [hours] of learning of any suspicious sign-in or any disclosure of a username or password, and shall cooperate with the Company’s investigation.

This clause gives you the material for the CCPA’s right to check (7051(a)(6)) and the FTC rule’s periodic assessment (314.4(f)(3)). HIPAA requires the business associate agreement to make the vendor report security incidents it becomes aware of (164.314(a)(2)(i)(C)). Firms covered by SEC Regulation S-P need policies that have service providers notify them no later than 72 hours after learning of a breach (17 CFR 248.30(a)(5)(i)(B)). Where no rule sets a deadline, choose the period and the hours by how much data the work involves and how much harm a leak would cause.

Shutdown at the end

When this Agreement ends, or when any named person leaves the work, the Vendor shall stop using the affected accounts at once, delete any usernames, passwords and Company data stored on its devices, and confirm the date and method of deletion to the Company in writing.

This clause answers HIPAA’s term that the business associate return or destroy health information at termination, if feasible (164.504(e)(2)(ii)(J)). It also matches the banking guidance on the timely return or destruction of data. NIST SP 800-53 control PS-7 asks organizations to require vendors to report when their people who hold your logins transfer or leave. The steps on your side are in the checklist for taking back access when a vendor contract ends.

What clauses can and can’t settle

The clauses bind the vendor’s conduct: who uses the accounts, who sees the passwords, what gets recorded, what gets deleted. How you hand over the accounts is your decision, made outside the contract. You can create a user for each person, hand over a shared login, or put an access management tool in between. The three are compared in Letting a vendor use your company’s accounts.

One mismatch to avoid is a “no sharing” clause next to one shared login. The vendor’s staff have no choice but to share it, so the clause can’t be kept. If you give a shared login, use the second half of the sample: names on file and a change process. If the app can add users, create a user for each person and keep the plain ban.

A clause only works if someone checks it. The FTC rule requires periodic assessment of providers. The CCPA regulation warns that a business that never enforces the contract or uses its audit rights may lose a defense it would otherwise have (11 CCR 7051(c)). The records and deletion confirmations from these clauses are what you check against.

Rewrite the wording for your work and systems, and have your lawyer review it. This article is not legal advice.