The agreement may also need to allocate the risk and responsibility of both parties in the event of a data breach. How and when will a security incident or breach be communicated? Data privacy and security issues should not be limited to agreements with technology vendors. The 2013 breach of data security at Target was the result of password credentials being shared by a HVAC vendor. Appropriate technical and administrative safeguards should be implemented and followed by outside contractors as well as employees. Vendor Qualifications and Management. Even the best physical, technical, and administrative safeguards can be called into question when a company allows a third-party vendor to interact with personal data maintained by the company and if the vendor does not have adequate data security protections in place. When assessing risk posed by third-party vendors, it may help to take a complete inventory of all the vendors currently used by the business. An audit of third party vendor agreements can assess their ability to protect data and assure that contractual provisions are in place to ensure compliance. The same due diligence and contract review should be done with all new vendors. Companies should also detail the type of information being transmitted to or stored by various vendors and assess the security of that transmission. What security firewalls or encryption is provided by the vendor? What else can be done to address any security weaknesses? Vendor contracts should at a minimum include limitations on any use of the data that is collected to your specific purpose. Security controls should be reasonable and appropriate for the work performed. Incident response and reporting provisions, audit rights, and indemnification and insurance clauses should all be included. Vendors who handle sensitive personal information might be required to carry “cybersecurity insurance” to cover data breaches, data loss, and related damages. In some cases it may be appropriate to have certain vendors regularly complete a data
166
Made with FlippingBook - Online Brochure Maker