What to check when a vendor says its team uses one shared login

When a vendor tells you its team works from one shared login, find out whether the sharing is under control. Check four things: which account it is, who knows the password, how the password changes when people leave, and how each use is tied to a person. If the vendor can’t answer, you have three options: create a user for each person, put an access management tool in between, or narrow what the shared login can reach.

First, whose shared login is it?

Shared logins come in two kinds. One is an account of yours that you gave the vendor. The other is a login the vendor uses inside its own systems. What you can do depends on which one it is.

If it is your account, you decide whether to switch to individual users or add a tool. The vendor got one login from you and has no way to stop sharing it on its own. The three handover methods are compared in Letting a vendor use your company’s accounts.

If it is the vendor’s internal login, it is part of the vendor’s own safeguards, which the rules ask you to check. The FTC Safeguards Rule requires you to require safeguards of service providers by contract and to assess them periodically (16 CFR 314.4(f)). A vendor that is a HIPAA business associate must comply with the Security Rule, and your business associate agreement must say so (45 CFR 164.314(a)(2)(i)(A)). That rule lists “Unique user identification” as required (164.312(a)(2)(i)). NIST SP 800-53 control AC-2(9) asks organizations to weigh “the lack of accountability” of shared accounts before allowing them. So ask the four questions, then agree on a deadline for any fix.

The four questions, in order

Ask them in this order. Without the account, you can’t ask who knows its password. Without the list of people, a change process means little.

Which account

Ask which app and which username. Confirm whether it is your account or the vendor’s. Check the answer against your list of accounts the vendor uses. If the account isn’t on your list, you have no record of handing it over.

Who knows the password

Ask for a list of names. Look for people who have left the vendor, people who moved off your work, and people at subcontractors. If the vendor can’t list the names, treat the account as open to anyone. Your app can’t fill the gap, because it sees one account and not the people behind it.

How the password changes when someone leaves

Ask when the password was last changed, who changes it, and who gets the new one. For your own account, also ask how the vendor asks you to change it. If nobody knows the last change date, people who left may still know the password. NIST SP 800-53 AC-2k asks for a process to change a shared account’s password when someone leaves the group.

How each use is tied to a person

Ask whether the vendor keeps a work log, who writes it, and how long it is kept. Without a log, you can’t trace any action in the shared account to one person. The FTC Safeguards Rule requires covered businesses to monitor and log the activity of authorized users (16 CFR 314.4(c)(8)).

Judge the log by whether you can match it against your own sign-in records. Your app records only the shared account. When the work times in the vendor’s log line up with the sign-in times in your app, the log tells you which person was working.

Keep the answers with your account list, or in the notes of your vendor questionnaire. At the next review, compare them with the last ones. Watch for two changes: more people know the password, or the last change date hasn’t moved.

If the vendor can’t answer

If even one answer is missing, the shared login shouldn’t continue as it is. You have three options, and you can combine them.

With a tool, the vendor’s staff don’t see the password, but setting up the tool takes work. With a narrower scope, you still have to check that the vendor stays inside it.

Narrowing the scope follows the FTC rule’s access controls, which limit users to the customer information they need for their duties (314.4(c)(1)(ii)). Don’t keep customer information in an app the vendor can reach only through the shared login. Or remove the shared login’s permission to view it.

For the vendor’s internal shared login, the fix is on the vendor’s side. Your part is to write the fix and the deadline into the contract or an amendment, and to ask the same four questions at the next review. If nothing has changed by the deadline, reconsider how much of your data the vendor handles. The FTC rule requires you to assess vendors periodically, based on the risk they present (314.4(f)(3)).

If the vendor answers everything

If the vendor answers all four and the answers match your records, the shared login is under control. Even so, your records still show one account, and tying actions to people still depends on matching the vendor’s log. If the shared login is yours and the app can add users, plan the switch to individual users at the next renewal, even for a vendor with good answers. The switch is your work, so you don’t need the vendor’s help to start it.