Thinking About Sharing Data With A New Vendor? Will You Be Responsible If The Vendor's Systems Are Breached?

In recent months, our firm has counseled clients through data breaches that were the result of unauthorized access into a third party's systems.  In these scenarios, our clients were not compromised directly, but hackers attacked a third party that hosted or had access to our clients' data.  The responses to these events varied, depending in large part on the extent to which the third party stepped up to handle the fallout.

These events serve as a good reminder that data is frequently shared or integrated with third parties such as vendors and cloud-based providers.  Sharing data with these parties creates its own set of risks that if overlooked can create real problems in the future.  Vendor management is key, and it must be exercised with discipline not just at the outset of a new relationship, but throughout its course.  When selecting vendors, include in your process detailed questions about the security the vendor will deploy and its insurance coverage