Survey: Distrust of Vendors Raises Questions on Data Security, Regulatory Compliance

A recent survey of nearly 600 individuals across industries by the Ponemon Institute found that more than a third of U.S. businesses (37%) believe that their primary third-party vendors wouldn't notify them in the event of a breach involving “sensitive and confidential information.” Further aiding this sense of distrust are company views of “fourth-'nth'-party” vendors ' subcontractors or indirect service providers hired by a third-party vendor ' which 73% of respondents believed would “fail to notify” in the event of a breach. Here, an “nth” is used to refer to an unknown number in a series of numbers.

Titled “Data Risk in the Third Party Ecosystem,” the survey was commissioned by law firm Buck- leySandler and Treliant Risk Advisors to provide insight on the challenges facing companies trying to protect client information when sharing data with third parties. All companies surveyed have a vendor data risk management program and were asked to solely consider their outsourcing relationships where they share “sensitive or confidential information or involve processes” that require vendor access to that information. Unveiled in the study were company difficulties with “mitigating, detecting and minimizing” risks posed by third parties handling their data.