Is a system that stores credentials required to meet the cyber security requirements of the systems it could give access to?

Question

IT companies often use access keys, credentials, and remote management software to maintain their client's infrastructure. These access methods are then saved in some form of database so that the IT technicians can look up how to log into each client's system when it needs work. These IT companies themselves are not storing their client's data, but their database contains information that could be used to grant full access to a client's data.

Do these databases need to meet the legal security requirements of the systems that they could be used to gain access to such as a server containing medical records (HIPPA) or financial information (PCI)?

Answer 1

One source of such a requirement would be contractual: A provides access to B pursuant to a contract, and the contract requires A to observe certain standards. A second source would be direct regulation, following certain statutes. HIPAA (in particular the Privacy Rule) applies to healthcare providers, but also "Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate", which includes "A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate", initially promulgated as a rule, and then authority to set rules delegated to the Office of Civil Rights. However, the PCI security standard is not federally mandated; it falls into the category of contractual mandates.