Confidential Data and Third-Party Vendors
August 16, 2016
Cloud computing is one of the latest and biggest technological revolutions to emerge. In general, cloud computing refers to a set of technologies and service models that focuses on IT applications and data storage that are accessed and used through the Internet. Many companies are embracing it—including third-party software vendors who may be handling confidential information for your business. This brings up a question: If your data is accessible through the Internet, how safe is it? How do you even know if your third-party vendor is using cloud-based storage?
Taking Stock of the Situation
There are many different storage solutions offered by cloud providers, and each provides a different level of security. The following are questions you should ask third-party vendors that assist you in network and core back-up solutions:
- Are they using a cloud-based storage solution?
- If so, what type of cloud is being used?
- What type of information is being stored on the cloud?
- Who has access to the information?
- Are nondisclosure agreements in place for those third-party vendors that have access to the information?
- Who is responsible if confidential information is compromised?
- Is network traffic encrypted to/from the cloud and while stored and/or at rest?
It is important to do due diligence by reading third-party vendor contracts to see if they address cloud storage. It is also important to perform a risk assessment on each vendor prior to hiring them for service, and annually thereafter.
You can become more familiar with cloud computing through the FFIEC, which addressed outsourcing cloud computing in a statement in 2012. The statement can be found in the Reference Materials Infobase section available online at http://ithandbook.ffiec.gov/. The FFIEC Outsourcing Technology booklet also addresses cloud computing.