Incorporating Information Security Standards Into Agreements With Vendors

To ensure customers and vendors are clear on what is required to protect a customer's data, customers can rely on information security standards as contractual safeguards.

Still, there are several different standards to pick from, and customers should consider the advantages and disadvantages of each standard when negotiating agreements with vendors.

Businesses and other organizations are increasingly outsourcing information technology (IT) services to third-party vendors. These outsourcing arrangements often involve disclosing personal information and other sensitive confidential information to third-party vendors for processing to support business activities. It is important for organizations to recognize, however, that they typically remain legally responsible for their information, even when it is in the hands of vendors. For example, the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") provides that organizations must