Whould you consider a lock box a covered account for "Red Flag" purposes?

We included Safe Deposit Boxes in our Risk Assessment and consider them to be a covered account.

We included safe deposit boxes, but didn't include "lock boxes", as that is a service we provide for specific products customers have, same as ATM cards, debit cards, online banking, etc.

We did not specifically identity lock box as a covered account, but more as a Service Provider for our accounts. We sent a letter to the Provider asking for documentation of how they protect our customer information and mitigate ID theft.

Also, we originally had Safe Deposit box as a covered account, but removed it based on our risk assessment. We determined the controls in place and risk of ID theft occuring was extremely low and thus did not specifically address them.