Which ISO 27001 controls apply when a vendor uses your accounts

ISO/IEC 27001:2022, the third edition, is the current ISO standard for information security management systems, and ISO lists the 2013 edition as withdrawn. When a vendor’s people work in your company’s accounts, NIST’s crosswalk from its SP 800-53 controls to the standard points to two groups of ISO controls. The supplier controls, A.5.19 to A.5.23, cover the relationship with the vendor. Others, such as A.5.16, A.5.18, A.8.2 and A.5.2, cover the accounts and the people who use them. ISO sells the standard’s text, so this article works from NIST’s free crosswalk and the SP 800-53 text it maps to.

What NIST’s crosswalk shows

ISO describes the standard as defining the requirements an information security management system must meet. NIST’s crosswalk links each ISO control to the SP 800-53 controls that cover similar ground, and SP 800-53 is free to read. NIST cautions that “the mappings are not always one-to-one and may not be completely equivalent”. So a mapped NIST control tells you where to look in the standard, not what the standard says. The tables below describe NIST controls and give the ISO numbers NIST maps them to. They don’t quote ISO.

The crosswalk also shows that no single group of controls covers a vendor in your accounts. The supply chain controls map to A.5.19 to A.5.23. The controls on accounts, passwords and a provider’s staff map to other ISO numbers. A vendor review that stops at the supplier controls can miss who knows the passwords, because those questions sit under the account controls.

The vendor relationship

The FTC Safeguards Rule sets out three steps for covered financial institutions: select capable service providers, require safeguards by contract, and assess providers periodically (16 CFR 314.4(f)). NIST’s Cybersecurity Framework (CSF) 2.0 has matching outcomes for any organization. Beneath all three steps sits a supply chain risk management policy and plan. In SP 800-53 those are SR-1 and SR-2, which NIST maps to A.5.19.

NIST maps the remaining supplier control, A.5.21, to SR-2 through SR-5. Those cover the supply chain plan, its processes and controls, records of where components come from, and contract tools against supply chain risk. SR-6 reaches past the vendor itself. Its discussion includes whether the supplier can assess its own subcontractors, which matters when the vendor passes your work on.

For your accounts, each step comes down to a concrete question. Before you sign, ask how the vendor will handle your accounts. In the contract, say who may use them, whether logins may be shared, what gets recorded, and how access ends. In reviews, compare your user lists with the vendor’s roster. CSF 2.0 also has an outcome for plans that cover what happens after the agreement ends (GV.SC-10). For accounts, that means disabling the vendor’s user accounts and changing any shared passwords. Sample wording is in What your vendor contract should say about accounts.

The accounts the vendor uses

The controls that govern the accounts themselves come from other parts of SP 800-53. NIST maps them to ISO controls outside the supplier group.

A shared login is where these controls meet. SP 800-53 lists shared and group accounts among the account types an organization may choose to prohibit because of increased risk. Where you allow one, AC-2k and IA-5i both ask for the password to change when someone leaves the group. You can only do that if you hear about the departure. PS-7d asks you to require the vendor to tell you, within a time you set. Without that notice, a person who has left the vendor still knows a password that works.

The record is the other gap. AU-3 asks that each audit record establish the identity of the individuals involved. A platform’s sign-in history for a shared login names the account, so if five people on the vendor’s team use it, they show up as one. To give each use a name, create a user account for each person, or put an access tool in between that records who signed in. The ways to hand over access are compared in Letting a vendor use your company’s accounts.

When the vendor holds ISO 27001 certification

ISO says conformity with the standard means a company has a system to manage risks to the data it owns or handles. It calls certification one way to show customers a company can manage information securely. A certificate doesn’t show who uses the accounts you handed over, or how their use is recorded. So the rules for your accounts come from your contract and your checks. When you ask for the certificate, check the edition it names. ISO asks that the standard always be cited in full, as in “certified to ISO/IEC 27001:2022”.

Some vendors offer a SOC 2 report instead. What it covers is in What is a security questionnaire?

If your company is the one getting certified

A vendor’s use of your accounts falls under both groups of controls above. Be ready to show the certification body three things: the accounts you’ve handed over, who knows each shared password, and how each person’s use is recorded.

If your company is the vendor, the same controls apply from the other side. Your clients’ accounts are accounts your staff use but don’t own. Put them in your own account records: who on your team may use each one, who knows any shared password, and what ties each use to a person. A client that applies PS-7 will require you to tell it when your people on its accounts move or leave (PS-7d). One that applies SA-9 will monitor whether you meet its requirements. Some removals also take the client’s admin, so your process should name the step you ask the client to take.