Protecting your business from a third party data breach

It is common for marketing to be taken care of by an outside vendor. The need to keep up with technical breakthroughs and track results, on top of everything else that comes at a business owner daily can make keeping up with marketing an impossible task.

Outsourcing sounds like a fast and easy solution but you need to dig a little before trusting anyone with your data. Data breaches start at the vendor level more than you may have known. In the United States, over 60% of the breaches started with a vendor (Ponemon Institute, 2018). The number of records exposed jumped from 1,7 billion to over 4 billion in 2019 (Vijayan, 2019).

From the point of view of an old insurance guy, there are a steps that you can take to at least attempt to minimize the risk of a data breach caused by a vendor. First, making sure you have control over the access to your client data. Make sure you understand what the vendor is doing with your data and have signed agreements regarding expectations of security and responsibility. This way the vendor understands you are serious about data security.

Next, check the vendor out as thoroughly as possible. Make sure you are listed as an additional insured on their business liability policy and that the policy covers expenses related to breaches. To see if there have been breaches with a particular vendor, you can check with the FTC:

https://www.consumer.ftc.gov/taxonomy/term/1627

It is imperative that you understand how the laws of the state you are in deal with third party breaches. In many states, responsibility for data security stays with the data owner, meaning that third party vendors have no liability, even if the breach is their fault.

References

Ponemon Institute. (2018). Data Risk in the Third-Party Ecosystem: Third Annual Study Sponsored by Opus. https://www.ponemon.org/userfiles/filemanager/nvqfztft3qtufvi5gl60/

Vijayan, J. (2019). Third-Party Breaches — and the Number of Records Exposed — Increased Sharply in 2019. Darkreading.com. https://www.darkreading.com/attacks-breaches/third-party-breaches-and-the-number-of-records-exposed-increased-sharply-in-2019