One of the common misconceptions about cyber security is that outsourcing IT removes the cyber risk. Whilst it may provide multiple advantages for your organisation, it is vital to carry out due diligence still and be aware of the risk of indirect cyber attacks where criminals breach a supplier’s network and gain access to your organisation’s data.
Consider the following risks of using third-party service providers:
▶ Reputational damages
Should one of your suppliers experience a cyber breach, your reputation could be damaged. After all, data has been entrusted to you, and your management or association with the affected company could be under scrutiny.
▶ Compliance concerns
Regulators are increasing pressure on organisations to better manage their supply chain risk. For instance, a third-party donor relationship management service that processes your donors’ contact details, would still make you the data controller, if they had no purpose for the data besides processing on your behalf. As such, you could suffer financial penalties for failing to comply with appropriate regulations if a supplier experiences a cyber-security breach.
▶ Operational issues
If a software vendor experiences a cyber-attack, your services could be offline for a significant time. Extensive downtime may result in productivity losses and a damaged reputation.
Access Insurance Services explore these risks in the post:
Understanding the risks of third-party service providers
