What is vendor oversight?
- Term
- Vendor oversight
- Meaning
- Vendor oversight is your duty to make sure an outside firm handling your customers' data protects it: choose a capable firm, bind it by contract, and check it.
Vendor oversight is your duty to make sure that an outside firm handling your customers’ or patients’ data protects that data. The FTC Safeguards Rule frames it as three steps: choose a vendor that can protect the data, bind it by contract, and keep checking on it. Other rules cover parts of it.
Why the duty stays with you
Under the rules below, handing work to an outside firm does not hand off your duty to protect the data it touches. No single US law defines the term for every business. Each rule has its own term. The FTC Safeguards Rule and SEC Regulation S-P say “service providers”, HIPAA says “business associates”, and banking guidance says “third-party relationships”.
Which rules require it?
| Rule | Who it covers | What it says |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(f) | Financial institutions under the FTC’s authority, such as tax preparers and mortgage brokers (314.2) | Select providers capable of appropriate safeguards, require the safeguards by contract, and assess providers periodically based on their risk |
| HIPAA, 45 CFR 164.308(b) | Health plans, clearinghouses, and health care providers that send health information electronically in transactions HIPAA covers (160.103) | Before a vendor handles electronic health information for you, get satisfactory assurances, documented in a written contract, that it will safeguard the information |
| SEC Regulation S-P, 17 CFR 248.30(a)(5) | Broker-dealers (including funding portals), investment companies, registered investment advisers, and transfer agents | Written policies for overseeing service providers through due diligence and monitoring |
| Interagency Guidance on Third-Party Relationships (June 2023) | Banks supervised by the Federal Reserve Board, the FDIC and the OCC | A life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination |
HIPAA calls such a vendor a business associate. That is someone who creates, receives, maintains or transmits health information for you, other than as a member of your workforce (45 CFR 160.103). Billing, claims processing, accounting and consulting are among the listed examples.
What does it involve in practice?
The FTC rule gives the plainest version. First, take reasonable steps to select and keep vendors that can maintain appropriate safeguards. Second, require those safeguards in the contract. Third, assess each vendor periodically, based on the risk it presents. Regulation S-P adds a specific duty. A covered firm’s policies must have its vendors notify it no later than 72 hours after learning of a breach in a system they maintain. These amendments, published June 3, 2024, now apply to all covered firms.
The banking guidance spreads the same steps over the life of the relationship and adds the end. It names access control after a relationship ends as a risk to manage at termination.
How does it relate to account access?
When a vendor works in your systems, it touches your data through the logins you give it. If each person on the vendor’s team has their own user, your own records show who signed in and when. With a shared login, your records show only the account, so checking who did the work depends on the vendor’s notes. The three ways to hand over access are compared in Letting a vendor use your company’s accounts.
Frequently asked questions
Do we need vendor oversight if the vendor never touches customer data?
The rules covered here apply when a vendor receives or can reach the protected data, such as customer information or health information. For other work, how you handle the vendor's access is up to your contract and your own practice.
Is signing a contract enough?
No. The FTC Safeguards Rule lists the contract as one of three steps. You also have to choose a capable vendor first and assess it periodically afterward, based on the risk it presents.
Is the banking guidance binding?
The agencies say supervisory guidance does not have the force and effect of law. It describes how they expect supervised banks to manage risks from third-party relationships.
How Junify handles this
- Doing this by hand
- You keep a list of which vendor staff use which of your accounts, shut off access every time a contract ends or a person changes, and keep checking how the vendor uses them.
- With Junify
- With Junify, a vendor's staff work in your company's accounts without getting the password. Junify records who used each account and when, person by person, so you can check the vendor's use from your own side instead of relying on its reports. When the engagement ends, you remove their access in Junify and they can't sign in again.
Sources
- 16 CFR Part 314, Standards for Safeguarding Customer Information (FTC Safeguards Rule), eCFR
- 45 CFR 160.103, Definitions (HIPAA), eCFR
- 45 CFR 164.308, Administrative safeguards (HIPAA Security Rule), eCFR
- 17 CFR 248.30, Regulation S-P, procedures to safeguard customer information, eCFR
- SEC press release 2024-58, SEC adopts amendments to Regulation S-P
- Interagency Guidance on Third-Party Relationships, Risk Management, 88 FR 37920 (June 9, 2023), Board, FDIC and OCC
-
Checklist for taking back access when a vendor contract ends
Work in this order. List the vendor's accounts, disable its users, change shared passwords, check the login records, and get written confirmation of deletion.
-
How to write the account questions in a vendor security questionnaire
Name the accounts you gave the vendor and ask who checks each answer, how often and against what record. Tie each question to a rule and check the answers.
-
What your vendor contract should say about accounts
Write four account clauses: who may use your accounts, no sharing beyond named staff, records and incident notice, and shutdown and deletion at the end.