City Bank

The rapid shift toward cloud services— such as Azure, AWS, and Google Cloud Platform—along with the widespread adoption of Software as a Service (SaaS) applications, has fundamentally changed how organizations manage risk. Instead of keeping critical systems in on premises environments, many companies now rely heavily on third party providers to host infrastructure, process sensitive data, and deliver core business capabilities.

This shift makes strategic and financial sense. Outsourcing allows organizations to leverage specialized expertise, reduce operational costs, and focus resources on innovation and differentiation. For example, small and mid sized businesses often find far greater value in using cloud based infrastructure rather than maintaining their own datacenters. Others rely on third party providers for payment processing, customer communication, HR systems, or analytics.

However, the efficiencies of outsourcing introduce new cybersecurity and regulatory risks that leaders must understand and actively manage.

Understanding the Unique Risks of Outsourcing

Cyber threats such as ransomware, data breaches, and unauthorized access affect organizations regardless of whether systems are hosted internally or externally. But outsourcing the processing or storage of sensitive customer or proprietary information brings unique challenges.

Consider a scenario that has become increasingly common:

You have entrusted a well known provider with customer data containing personally identifiable information (PII). After years of incident free service, you are notified that the provider has suffered a cybersecurity breach, and all of your customer data has been stolen.

In nearly every U.S. state, you are required to notify affected customers and relevant Attorneys General. Many states also require remediation steps such as providing free credit monitoring or identity theft protection. If financial or health related data is involved, additional federal requirements (GLBA, HIPAA, etc.) may apply. International operations face even stricter regulations, such as GDPR, which imposes significant penalties for mishandled data.

When a third party breach occurs, critical questions arise:

• Who bears responsibility—you or the provider?

• Is the provider contractually obligated to notify regulators or affected customers?

• Who is liable for regulatory fines?

• Does your cyber insurance policy cover third party incidents?

• Does the provider carry its own cyber insurance that covers downstream client impact?

• What is your exposure to class action lawsuits?

• How will the incident impact your company’s reputation and customer trust?

Ultimately, your organization is responsible for the protection of its data—even when handled by a third party. The good news is that proper planning, due diligence, and strong contractual controls can significantly reduce your exposure.

Essential Steps for Managing Third Party Risk

1. Conduct Thorough Contract and SLA Reviews

Carefully review all agreements—including Master Service Agreements (MSAs), Data Processing Agreements (DPAs), and Service Level Agreements (SLAs). Use internal or external legal counsel specializing in data security and privacy.

Look for:

• Unreasonable or overly narrow limitations of liability

• Vague or absent data breach notification clauses

• Lack of commitment to incident investigation and cooperation

• Absence of obligations for credit monitoring or customer notification

• Weak or undefined security requirements A reputable provider should be willing to:

• Perform full incident investigations.

• Notify you promptly

• Notify impacted individuals when appropriate.

• Support regulatory inquiries

• Provide credit monitoring or other remediation services when responsible.

2. Review Independent Security Assessments

Evaluate the provider’s security posture through trusted, independent sources:

• SOC 2 Type II reports

• Penetration test summaries

• ISO 27001 or similar certifications

• Security architecture documentation Ensure reports are current and show an active commitment to risk management.

3. Continuously Monitor Performance and Financial Health

A provider’s operational performance and financial stability directly influence its cybersecurity resilience. Warning signs include:

"Your organization is responsible for the protection of its data— even when handled by a third party."

• Frequent service outages

• Poor customer support responsiveness

• Mergers, acquisitions, or financial distress

Weak performance or instability can increase the likelihood of cybersecurity incidents.

4. Limit the Data You Share Whenever Possible

Follow the principle of data minimization:

• Share only the data necessary for the provider to perform its function.

• Avoid sending the most sensitive elements, such as Social Security numbers, dates of birth, or full financial account numbers, unless required.

• Use tokenization, masking, pseudonymization, or encryption to reduce exposure.

• Remove and/or set a retention period for sensitive data when it is no longer needed by the provider.

Even if a provider is breached, less sensitive data means lower impact

5. Leverage Cyber Insurance Resources

Most cyber insurance carriers offer valuable pre breach services, including:

• Risk assessments

• Incident response planning

• Vendor risk guidance

Large breaches often involve multiple specialized teams— legal counsel, forensics, negotiators, and public relations experts—coordinated by the insurer. Understanding this process ahead of time can dramatically improve your organization’s response readiness.

Optional Additional Tips to Strengthen Your TPRM Program

6. Maintain a Centralized Vendor Inventory Track:

• All vendors

• Risk levels

• Data types handled

• Contract renewal dates

• Compliance status

A centralized register supports better oversight and reduces surprises.

7. Require Minimum Security Standards

Set baseline expectations, such as:

• MFA everywhere

• Encryption of data at rest and in transit

• Annual penetration testing

• Employee security awareness training

• Vulnerability management SLAs Document these requirements and verify compliance.

8. Implement Ongoing Monitoring Tools

Consider using continuous monitoring platforms that alert you to:

• Data breaches affecting your vendor

• Security control failures

• Domain or certificate issues

• Negative financial or legal indicators

This enables proactive, rather than reactive, risk management.

9. Establish a Formal Third Party Offboarding Process

When discontinuing a vendor:

• Require certified data destruction.

• Terminate access to systems and credentials.

• Collect all company owned hardware or assets.

• Revoke VPN and SSO connections.

• Ensure secure return or destruction of backups.

Data often persists with vendors long after contracts end unless explicitly managed.