Stick with Security: Make sure your service providers implement reasonable security measures

Even if a breach ultimately traces back to a service providers conduct, from the perspective of a customer or employee whose personal information has been comprised, the buck stops with you.

Metadata

Provider:

FTC

URL:

https://www.ftc.gov/business-guidance/blog/2017/09/stick-security-make-sure-your-service-providers-implement-reasonable-security-measures

Retrieved on:

Thursday, December 1, 2022

Information

Summary

Key Points:

Even if a breach ultimately traces back to a service providers conduct, from the perspective of a customer or employee whose personal information has been comprised, the buck stops with you.
Thats why Start with Security cautions companies to make sure their service providers implement reasonable security measures.
Before bringing service providers on board, spell out what you expect in terms of security.
Drawn from FTC law enforcement actions, investigations, and questions we get from companies, here are some examples that illustrate steps you can take to encourage your service providers to start with security and stick to it.
Before putting it in someone elses control, be sure you know how that information will be used and secured.
The company gives the service provider access to account information including customers preferred payment methods and the service provider creates a spreadsheet of the data.
The contract between the company and the service provider doesnt include any requirement to maintain reasonable security.
Thats why careful companies verify that service providers are complying with security-related contract provisions.
In addition, make sure you have a way of monitoring what theyre doing on your behalf.