Insights: Article

Confidential Data and Third-Party Vendors

By Eric Pulse

August 16, 2016

Cloud computing is one of the latest and biggest technological revolutions to emerge. In general, cloud computing refers to a set of technologies and service models that focuses on IT applications and data storage that are accessed and used through the Internet. Many companies are embracing it—including third-party software vendors who may be handling confidential information for your business. This brings up a question: If your data is accessible through the Internet, how safe is it? How do you even know if your third-party vendor is using cloud-based storage?

Taking Stock of the Situation
There are many different storage solutions offered by cloud providers, and each provides a different level of security. The following are questions you should ask third-party vendors that assist you in network and core back-up solutions:

  • Are they using a cloud-based storage solution?
  • If so, what type of cloud is being used?
  • What type of information is being stored on the cloud?
  • Who has access to the information?
  • Are nondisclosure agreements in place for those third-party vendors that have access to the information?
  • Who is responsible if confidential information is compromised?
  • Is network traffic encrypted to/from the cloud and while stored and/or at rest?

Educate Yourself

It is important to do due diligence by reading third-party vendor contracts to see if they address cloud storage. It is also important to perform a risk assessment on each vendor prior to hiring them for service, and annually thereafter.

You can become more familiar with cloud computing through the FFIEC, which addressed outsourcing cloud computing in a statement in 2012. The statement can be found in the Reference Materials Infobase section available online at The FFIEC Outsourcing Technology booklet also addresses cloud computing.

Latest Insights

March 15, 2019
An emergency fund may help alleviate the stress associated with a financial crisis.
March 15, 2019
A recent FASB update will significantly affect the accounting for operating leases. Here’s a breakdown of the changes.
March 13, 2019
Properly documenting opioid use in patients is critical to avoiding a denial. Here are seven strategies that should be present in every entry in a patient's health record.
March 13, 2019
Think you know the difference between an email from a friend and an email from a hacker? You may be surprised to find out the answer.
March 12, 2019
When fraud is suspected, analyzing your organization’s data can be difficult. A fraud examiner can help you break down the information, so you can detect and prevent questionable activity.
March 11, 2019
Taxpayers and businesses dealing with first-time tax debt may qualify for relief through the Fresh Start initiative.