Insights: Article

Confidential Data and Third-Party Vendors

By   Eric Pulse

August 16, 2016

Cloud computing is one of the latest and biggest technological revolutions to emerge. In general, cloud computing refers to a set of technologies and service models that focuses on IT applications and data storage that are accessed and used through the Internet. Many companies are embracing it—including third-party software vendors who may be handling confidential information for your business. This brings up a question: If your data is accessible through the Internet, how safe is it? How do you even know if your third-party vendor is using cloud-based storage?

Taking Stock of the Situation
There are many different storage solutions offered by cloud providers, and each provides a different level of security. The following are questions you should ask third-party vendors that assist you in network and core back-up solutions:

  • Are they using a cloud-based storage solution?
  • If so, what type of cloud is being used?
  • What type of information is being stored on the cloud?
  • Who has access to the information?
  • Are nondisclosure agreements in place for those third-party vendors that have access to the information?
  • Who is responsible if confidential information is compromised?
  • Is network traffic encrypted to/from the cloud and while stored and/or at rest?

Educate Yourself

It is important to do due diligence by reading third-party vendor contracts to see if they address cloud storage. It is also important to perform a risk assessment on each vendor prior to hiring them for service, and annually thereafter.

You can become more familiar with cloud computing through the FFIEC, which addressed outsourcing cloud computing in a statement in 2012. The statement can be found in the Reference Materials Infobase section available online at The FFIEC Outsourcing Technology booklet also addresses cloud computing.

Latest Insights

May 25, 2018
While revenue recognition implementation guidance under FASB is still being finalized, a significant portion of health care industry information is now available.
May 25, 2018
Did your U.S. business have direct or indirect ownership or control by a foreign person or enterprise at any time during 2017? If yes, you need to read on.
May 24, 2018
Do you owe tax in Alabama, Connecticut, Indiana or Texas? If so, you should consider participating in an available amnesty program.
May 21, 2018
Firm News
Today, accounting firm Brad Rhodes and Associates of Greenwood Village, Colo.
May 21, 2018
The mission of the organization may sing to your heart strings, but sometimes the nicest people who appear to live for the mission create unimaginable havoc, and you can’t turn a blind eye.
May 21, 2018
Whether it be accidentally or on purpose we have all deleted a file.