Survey: Distrust of Vendors Raises Questions on Data Security, Regulatory Compliance

As to why some companies lack faith in their vendors handling of data, Margo H.K. Tank, partner with BuckleySandler, stated that, “In a data-driven economy, there is high need to outsource services and reduce costs. While many companies do have direct relationships with third parties, they still find it difficult to manage, detect and mitigate risks associated with these third parties that have access to confidential and/or sensitive company information. Lack of resources and skill sets are factors.”

Why the Distrust?

Consternation over outside data handling is not unwarranted. About half (49%) of companies reported that they experienced a breach caused by vendors, while 16% reported that they weren't sure if a vendor was to blame. The perception is erring on the negative side as well, with 73% of companies reporting that they see vendor-related cybersecurity incidents increasing.

The distrust deepens at the nth-party level, Tank said, because “the eco-system is further expanded and relationships with vendors become indirect or remote. There may be lack of transparency, control or bargaining power, thus companies find it difficult to manage, detect and mitigate risks associated with these Fourth-nth parties that have access.”

To make matters worse, the majority of companies find it difficult to manage vendor-related cyber incidents, with 65% reporting that they “don't have the internal resources to check or verify” when evaluating vendors' security and privacy practices. Tank said that this finding is “alarming, in light of the focus of federal and state regulators on consumer protection and the need to notify consumers in the event of breach and not being able to do so.”

This inability to look into vendor practices runs deep, with 58% of companies saying that they cannot determine whether vendor “safeguards and security policies are sufficient to prevent a data breach.” Forty-one percent say that these safeguards and policies are sufficient for breach response.

“The results create awareness of the problem. And the reliance solely upon contractual agreements instead of audits and assessments to evaluate the security and privacy practices creates significant risk. Companies will need to establish and track metrics regarding the effectiveness of the vendor risk management program and establish vendor risk management committees,” Tank said.

Vendor Relations

The survey results suggest that for many companies, when it comes to vendor relations, information governance needs to be strengthened ' 31% view their vendor risk management program as “highly effective,” while 38% don't track metrics on their programs' effectiveness. In addition, 62% said that “their boards of directors do not require assurances that vendor risk is being assessed, managed or monitored appropriately, or they are unsure.” This, Tank said, “will have to change,” as “the [Consumer Financial Protection Bureau; CFPB] and other regulators are mandating active involvement of boards in managing data security risks.”

“Companies must understand managing data risk is not merely a compliance and contract issue but a fundamental strategic challenge in which personal data, intellectual property and transactional records must be protected from third-, fourth- and nth-party risk,” Tank said. “Risk assessments, data security program reviews and most importantly, onsite due diligence, kicking the tires and looking under the hood are all warranted in these circumstances.”

The full survey can be found at http://bit.ly/1TGiM8b.

Ian Lopez writes for Legaltech News, an ALM sibling publication in which this article'also appeared.