home > publications > articles

Published in the October 2008 Privacy & Data Security Law Journal.
© 2008 Alex eSolutions, Inc.

Vendor Management:
Maintaining Privacy Compliance in
Outsourced Business Relationships

BENJAMIN GERBER AND ADAM C. NELSON

The authors discuss vendor management topics prevalent throughout the year.

Last year, we authored “Protecting Outsourced Data: The Role of the Vendor Management Office,”1 in which we discussed current issues centering around utilizing vendors who receive, maintain, and/or utilize organizations’ data—in particular personal data of customers and employees. This article is a sequel of sorts. Throughout the year we have had the opportunity to work with numerous customers—as they created their new vendor management organizations, implemented vendor management programs, performed audits and assessments, evaluated results and figured out what to do next. We also regularly have the opportunity to address privacy and security issues from the perspective of an international vendor—interestingly this is often when we have the opportunity to help customers best understand their needs.

This article discusses major themes we found prevalent and some pointers our clients found most useful throughout the year. For the purposes of this article, we use the term “organization” to refer to the group that is utilizing the outsourcing services. First, we will revisit and expand upon our major recommendations from last year.

• Compliance and accountability can never be fully placed only on vendors
  This point is intended to clarify what remains the most commonly misunderstood concept on both sides of the negotiating table. You cannot simply place your organization’s legal obligations on the shoulders of a third party and expect or hope for the best. We are amazed at how often this liability shift has been portrayed as “law” by organizations seeking to outsource services.

  Reputable IT vendors will never claim that a service or product or any combination of services or products will make a customer compliant with any law or regulation. This is not to say IT vendors do not provide plenty of services and products that help customers achieve their compliance goals.

  Your organization, as a vendors’ customer, may derive requirements from laws and regulations in conjunction with in-house or external legal counsel; in turn, vendors may then provide services or solutions that are intended to assist your organization in meeting those same requirements (which may be derived from laws or regulations).

  Some of these same vendors will provide assistance in deriving these requirements, usually with the involvement of the customer’s legal organization or external counsel. However, unless the vendor provides legal counsel as part of its business offerings, any results from such a service, verbal advice or written reports are usually delivered as drafts and would be actually issued by the customer itself—again, with the involvement of the customer’s legal organization or external counsel.

  There are vendors that certify compliance in addition to providing various IT services. As with any other business function, separation of duties must be kept in mind, and vendors providing services should likely not be the same vendors that certify such services if the certification is granting any (legally binding) guarantee associated with a third party’s standard or regulation.

• Establish a Vendor Management Office
  It is important to gain and maintain a comprehensive, consistent approach to addressing the handling of sensitive data transferred to vendors and third parties. A dedicated group that handles these issues should be created and maintained. Such a group can be formed as a virtual or permanent counsel or a Vendor Management Office (“VMO”).

  In additional to the legal department, personnel with expertise in information security and privacy, as well as representatives from relevant functions related to the data, such as internal governance, human resources or specific lines of business, should be involved in determining the requirements that will be levied on vendors handling sensitive information originating from an organization. For virtual counsels, regularly scheduled committees, rather than ad hoc assemblies, will help maintain viability, authority, purpose and focus of the vendor management initiative.

• Identify and classify the data
  Classification of data is necessary for applying applicable protection mechanisms. Special attention must be given to Personally Identifiable Information (“PII”). While PII is a category of sensitive information, privacy requirements introduce unique aspects. The five mandatory considerations for classification and categorization of PII are sensitivity, legal and regulatory requirements, contractual obligations, purpose specification, and jurisdictional origin.

  Sensitivity of PII will vary. For example, inadvertent disclosure of an information block containing an individual’s Social Security number may expose the individual to a greater risk of harm than would the disclosure of the individual’s phone number.Sensitivity is the grading or ranking of risk associated with the loss of confidentiality of data.

  Legislation and regulation requiring both general and specific handling of PII for jurisdictions and industries is growing. Addressing the legal and regulatory requirements for handling PII can be achieved by mapping out the requirements of applicable legislation against available protection mechanisms.

  In addition to requirements levied by legislation or regulation, contractual obligations play a key part in determining classification of data. Specific measures for protecting, limitations on use of, and procedures for processing of data are increasingly specified through contractual arrangements in both business to business and business to consumer relationships—these considerations must not be left out of information systems implementations. These contractual obligations may be for other business to meet legal obligations imposed on them or even as part of enhanced trust features that progressive organizations offer their customers.

  While many privacy considerations fall within the area of confidentiality, a distinguishing factor of PII over other sensitive data is the context in which data are collected and used. PII should be collected for a particular purpose or set of purposes, an instance of PII should not normally be used for any other purposes unless notification and potentially choice are provided to the data subject. For this reason, the purpose for which PII is kept and utilized must be maintained in association with the PII instance.

  The jurisdiction (e.g., country, state, industry) in which PII is collected often determines the laws and regulations that must be addressed for given instances of PII. It may therefore be necessary to track jurisdictional origin in order to comply with several laws and regulations.

  Note that it may not be necessary or practical to apply detailed labeling to track purpose specification and jurisdictional origin. Tracking these elements may be done at a high level, such as categorizing an entire database and not individual records. In looking forward toward automation of data flow compliance, electronic tagging at an information block, record, or element level may be desirable.

• Classify and categorize vendors
  Consider classifying vendor or vendor programs and relationships based upon what data the vendors receive and have access to. Contractual provisions, audits, and security controls can then be baselined according to class or level. Points to consider when classifying vendors include:
  • Vendors’ electronic access to facilities and systems;
  • Vendors’ physical access to facilities and systems; and
  • Level of data classification and the data category/type vendors will legitimately possess or to which they will have access.

• Ensure appropriate controls
  Develop a set of sensitive data protection mechanisms and procedures, based on internal ones, that can be utilized depending on vendor classification level. These can be based upon an internationally accepted set of security controls such as ISO 27001-2 or NIST standards. These baselined sets of contractual requirements can then be applied universally to new and renegotiated contracts and systematically enforced. Small to mid-sized companies are sometimes bullied into accepting vendors’ default contract terms. While default contracts may be used as input into constructing agreements, a company of significant size should not need to fall back to the minimum terms when negotiating for third party services.

• Audit vendors to ensure your controls are in place
  Right to audit clauses permitting the audit of contractually mandated protection mechanisms and process should be consistently included in agreements with vendors or third parties handling sensitive data. When the right to audit exists, audits should be consistently performed. Many companies have the right to audit but do not complete them. Audits are essential for internal reporting purposes (which may have requirements driven by regulations, such as Sarbanes-Oxley or Gramm Leach Bliley) as well as for external entities such as the Federal Trade Commission. It needs to be demonstrated that the organization completed its due diligence in these matters.

Prevalent Issues

Handling Sensitive Data Provided by Vendors to Your Organization

Vendors’ sensitive data is as valuable to them and their employees as your organizations’ is to your customers and employees. Your organization may routinely or even occasionally find that it has a business need—or a perceived business need—to collect sensitive data from vendors. This often occurs when vendor personnel will have access to sensitive data or other materials and background checks are required. If this has ever—or it is likely it should ever—become necessary, your organization should have a comprehensive approach regarding handling of sensitive data, PII in particular, routinely collected from third party contractors, vendors, and suppliers.

The common industry standard practice is for the host company to:

• Contractually mandate a minimum set of vendor personnel criteria.
• Require the vendor to perform the necessary validation of their own employees, (including background checks), and maintain any PII related to these activities (this is considered a privacy best and common practice).

An organization with a large volume of government and Department of Defense business will have a much larger volume of statutorily and contractually required visitor background checks than the average company. If this is the case for your organization, your organization may make a business decision to collect PII and conduct third party background checks itself (collecting and maintaining resulting PII). The standards for handling third party PII should be in line with privacy principles applied to handling your organization’s own PII. Keeping in mind that vendors are usually not presented with the same terms and agreements as employees, privacy statements or other descriptions of how the PII will be used and maintained should be available at the point of collection.

Governance

An effective governance framework can ensure the success of a vendor relationship. Effective vendor governance will promote:

• Partnership. The goal is to find a partner, not just a vendor. There is a focus on achieving business goals through the relationship, rather than just exploiting wage arbitrage. Service providers must have a good cultural match and be able to support smooth change management.

• Relationship maturity. As vendor management organizations move to a new level of maturity, relationships between companies and their vendors must be more focused and structured. Companies look to vendors who can understand their business and move across multiple divisions to reach economies of scale.

• Performance as per commitment. Many vendors underperform, resulting in a loss to companies. This is especially true around security and privacy responsibilities. These types of engagements require a mechanism to measure, monitor, and amend performance parameters.

• Flexibility. Flexibility has become a key criterion of vendor assessment. Rigid contractual frameworks often lead to failure as both parties find themselves locked into criteria that do not work. Many attorneys have run into this issue when negotiating contracts with their outsourcer.

• Transparency. Companies want a clear exchange of information across the various channels and levels of the organization. To ensure that all stakeholders understand the goals, status, and performance level of the engagement, vendors must provide frequent and focused information.

• Transfer of risk. Through the relationship, companies expect that some risk is transferred to the vendor. Outsourcing is about balancing risks and costs to achieve business objectives. Companies want to ensure that the vendor puts “skin in the game” to share risks. However, the ultimate responsibilities remain with your organization (as it is your organization’s compliance and brand value on the line).

Leading practices illustrate several guidelines for the successful integration of a multi-sourcing management and governance model. Some of the keys to your vendor management governance framework may include:

• Establishment of an appropriately skilled and empowered organization.
• Development of clear and practical processes, organizations, and performance measures around the vendor functions.
  • Develop unambiguous standards for managing multiple suppliers.
  • Form governing bodies to identify sourcing methods and oversee interactions across multiple suppliers.
  • Create a VMO that serves as a competency center for sourcing management and has decision authority for overseeing service providers.
  • Create a management matrix that identifies key processes and process owners and maps management functions across providers.
  • Establish control measures to provide early warning of any problems and facilitate overall performance management.
  • Have an educated legal department that is trained to discuss and negotiate vendor management issues.
• Specify problem escalation and dispute resolution processes that ensure service continuity and executive-level attention at the service provider.
• Establish a sourcing management dashboard that provides an integrated view across all service providers, by service line, of the key operational and business performance metrics.

Motivation and Why

The big questions that start with “Why” lead to recurring topics—even with executives who already know it is important to address vendor management and data protection proactively.

“Why are vendors handling data (including access to information systems) different from other types of vendors?”

This comes down to an understanding of one’s business—many truly are information based businesses today. As an example we look briefly at financial services.

Financial services companies have two major assets:

1. Money
2. Information

Key points to keep in mind:

• Information (data) is the foundation of financial services businesses and must be protected as a critical asset.
• The value and confidentiality of data are unrecoverable and irreplaceable—once data is breached, containment is difficult and potentially nonpermanent.

“Why should we be concerned?”

• You cannot outsource compliance—for US companies with US customers this includes GLBA, PCI, various states’ legislation—when handling Europeans’, Canadians’ and many other citizens’ data—national legislation and cross-border data transfer require meticulous attention.
• Trust and brand value are ever increasingly important attributes to possess; without respect for and a proactive approach regarding privacy for both customers and employees, no business will exist in a competitive market in jurisdictions with democratic regimes.
• Competitive advantage of data—if all the “do the right things” and “abide by the law” motives are not enough—information based business must continue to be cognizant of their key competitive advantages—there is a great deal of competitive advantage in keeping confidential data and data gained through trust relationships confidential.

Change Is Constant

Successful organizations adapt and change—both process and technology—this goes for not just your organization, but your vendors’ as well. Just like your organization, vendors too are interested in trying to improve their bottom line. This is why it is necessary to regularly assess vendors’ security and privacy compliance posture beyond initial due diligence. Indications that a significant change in business is about to or has occurred include mergers, acquisitions, and vendors moving to outsource their own operations.

Accidental outsourcing does occasionally occur. While your organization may take every precaution to make sure data is handled properly and in compliance with the organization’s policy and regulation goals, take every step to ensure your vendor is doing the same. If the vendor makes a sudden change in its operations such that data is transferred to another agent not bound to follow all the necessary precautions or in an inappropriate jurisdiction, detection and remediation must be swift.

Do Not Just Audit—Assess

Oftentimes, audits are performed strictly against checklists, asking questions such as “do you have ‘a,’ ‘b’ and ‘c,’ and may we see them?” and then checking off that the vendor has what is required. It is important to go beyond such basic audits and perform full assessments; remember that while answers can look good on the surface, often more questions must be asked—ultimately protecting the data is not just about liability, but mitigating tangible risk. Utilizing an assessment methodology allows for an adaptive process and a more dynamic approach toward achieving your goals then traditional audit methods do. Active participation such as seeing how a policy is executed, how processes are implemented and in some cases actively taking a detailed hands-on approach to assessing IT infrastructure will produce more accurate and informative results. For example, during site visits—which we absolutely recommend—are the storage rooms clean, are there boxes filled with documents in the corners of the room, did you notice any physical security barriers to entry? An adaptive, iterative approach that leverages the diverse experience and expertise of individuals (that form the VMO) also saves time and resources.

Plan for Incidents

Your organization has incident response and business continuity plans. Vendor practices must also include procedures to deal with incidents, such as data breach, leakage or exposure incidents—including communication (with your organization and appropriate third parties) and emergency response plans. These practices must also include an agreed upon definition of what an incident consists of.

Budget and Consolidating Vendors

When considering outsourcing, selecting vendors, and renewing existing contracts, money is always a factor: how much are we saving, spending, earning through this relationship? Organizations must remember to include the cost of maintaining a vendor in the budget—from contract negotiation through to regular audits or assessments and regular communications.

Consolidating vendors can save money, and we are often asked what having your eggs in one or more baskets means from a data protection perspective. While consolidation of vendors may add risk to some operations—it almost always reduces risk from a data protection perspective. Unless different vendors work with completely different sets of data, the eggs are not really different no matter how many baskets they are in. If customer data is breached—it is breached. If one vendor mishandles data, exposing the data, it may be just as bad as any other of the vendors doing so with the same data. However, if your VMO has fewer vendors to guide and keep on course, stronger, well performing relationships may be the result of a more focused VMO. Additionally there are fewer eggs that might fall out of a basket.

When Failure Is an Option (Have a Plan)

One of the significant business situations in which organizations are not prepared is when a vendor fails an audit. There are many reasons why this occurs. Often, the organization may have been working with their vendors for a considerable length of time, and are not prepared for failure. Other times, it is simply a lack of preparation for such a situation. However, it is important to understand that failure is an option.

If this situation does occur—whether it be a failed audit or a vendor simply failing to live up to its contractual obligations, the organization must be prepared to address the issue immediately.

One of the most significant possible results of an audit failure is that the organization does nothing. This should never happen. If there is an issue with a vendor—any vendor, but especially a vendor who handles PII—your organization needs to have a well defined action plan to address the failure. This plan should include:

• Notification
  Who should be told of the failure? Depending upon your organization, it may be the VMO, legal, business units, compliance, human resources, procurement, IT or depending upon the situation, government or regulatory bodies.

• Accountability
  One business unit, usually the VMO, will need to be accountable for addressing the failure with the vendor. This unit will also be responsible for the development and subsequent monitoring of the remediation plan.

• Remediation
  Which group should take the lead in developing a remediation plan? For protected data, this is usually completed with input from several groups including the VMO, IT and legal.

• Reinstatement / Removal
  This decision is made after a thorough review of the results of the remediation plan. The results will have to be reviewed by the VMO as well as other appropriate business units in order to make a final decision.

If the organization does remove a vendor, it needs to be ready to move forward immediately with a suitable replacement. The research on the new vendor should not wait until a key vendor has failed an audit.We recommend, at minimum, you have potential replacement vendors for consideration and/or a fast-track process to identify new vendors to complete your due diligence. If this is impractical—and for some large organizations it is—focus on the critical vendors and have at least one replacement available. It is always good to have options.

There should be established guidelines as part of your assessment, audit or review processes that address immediate failure of a vendor’s data protection posture. The organization should also have preexisting guidelines for how remediation can be achieved (if the business should desire to maintain the relationship with the vendor).

Being proactive in the vendor relationship helps to avoid failures. We have found that most failures are due to a change in the vendor’s organization or operating procedures, and these can be detected early through regular communication, even when it is not time for an audit/assessment.

Managing the Vendor Relationship

Managing the vendor relationship needs to start early.We recommend that you begin during the initial contract negotiation stage. Usually, there are several parties involved at this time. Corporate counsel, selected business units, sourcing and possibly representatives from the information technology group will give input. We recommend that the VMO lead the negotiations with input from the legal department. If this is not possible, have one organization designated as the point group for these discussions. If it is the VMO, legal will also most likely be involved to assist with the discussions and certainly to approve any final document. We have been involved in situations where legal leads the negotiations, others where the VMO leads the negotiations; this will depend upon your corporate culture. Also, do not forget other interested parties—human resources, corporate compliance, and selected business units may also provide valuable input.

Before you get into the negotiations, do your homework. Identify what type of data it is that you are moving to the third parties. Ask yourself a few questions:

• Do I know where this data is located?
• Do I have data stewards for this data?
• Is it protected data?
• Is this data covered by any retention requirements?
• Are we moving this data across international borders?
• Why are we moving this data to the third parties?

There are also two very important documents when initiating a vendor relationship. These are the due diligence questionnaire and the security and privacy requirements document.

The due diligence questionnaire should be presented to any interested party either right before the relationship has begun or soon thereafter. This document will allow the vendor to elaborate on its entire background and history. You will want information on its relevant security and privacy programs, responsible parties, governance modules, audit expectations, monitoring expectations, special handling considerations, disaster recovery plan and maybe even their financial viability. Most due diligence documents are very comprehensive. Do not be afraid to ask questions. The data is very important and you need to make the correct decision regarding its care.

The second most important document for your vendor relationship is the data privacy and security requirements roadmap document. These privacy and security guidelines and requirements should be provided to vendors so that they understand your organization’s requirements; they should be provided early in the relationship. If this is an existing relationship, provide this as soon as possible; if you are negotiating a new contract, include this with your other requirements; if you are in an existing contract and cannot retroactively enforce the requirements, provide them to the vendor as upcoming requirements. This is an extremely significant document and will always be reviewed by auditors should there be an incident. However, this roadmap is usually the document that most vendor relationships are missing. Specifically, it is the listing of data protection, handling and governance instructions that should be undertaken by the vendor in order to for the data security and privacy aspect of the relationship to be judged a success.

This document is generally based upon internationally accepted data security and privacy frameworks and your organization’s own policies and compliance requirements. It will list out all the actions and expectations that you want the third party to undertake when handling, accessing, storing and processing your data. This will include definitions of protected information, security protocols, privacy protocols and possible compliance issues. Every possible data issue should be contained in this document. Usually, many of these points are pulled directly from ISO 17799/27002, NIST or CoBIT; the AICPA have also provided guidance in this area.

If possible, provide this document during the contractual negotiation phase. Let their personnel review it, comment on it and finally accept it. Also, have some flexibility, they will not accept everything. Determine what is important to your organization. IT, legal and business need to work together on this to set expectation and to ensure that all aspects of your outsourcing agreement are covered in relation to data privacy and security expectations.

In many of the contractual negotiations that we have been involved with, the opposing counsel very often makes the following statement, “Go Ahead and protect our data like you protect yours.…”2 If you are presented with this situation, it demonstrates a clear lack of understanding about both the law and common sense around this issue. As has been stated earlier in this article, the vendor is not in the same business as the outsourcer, may not be in the same country, and does not have the same data and data practices as the outsourcer. Because of this, it will need direction from the outsourcer. This is what the aforementioned roadmap document addresses. We recommend that you always request such a document from opposing counsel when addressing data privacy practices in contractual discussions.

Success Criteria

It is difficult to evaluate procedures in which the relationship will be judged a success. However, this is essential to your agreement. We recommend that you develop metrics and/or success criteria before this process begins and consistently evaluate the vendor relationship. Evaluate all vendors on a yearly basis and make adjustments as necessary. Do not forget also to audit your vendor on a regular basis. For vendors who handle critical data, the time frame should be more frequent, perhaps quarterly. If you do not have a quarterly audit with these vendors, it is important, at minimum, to set up a communications plan in which you will receive a regular status update from the vendor. Judge success based upon the metrics, the communications and performance quality for the services provided.

Having vendor termination procedures addressed in your contract prior to allowing a vendor to receive data from your organization is vital to being able to neatly wrap up an outsourcing relationship when the time should come to do so. This should include provisions for safe return transfer of any data or derived data the vendor holds, as well as secure deletion or destruction of any media used to store the data, and a communication process in the case of later discovery of your organization’s data that may not have been removed from the vendor or later discovery of a breech that may have occurred while the vendor was still in possession of your organization’s data.

Outsourcing to India

For years India has been a lead destination of outsourcing. This trend is still on the rise for many business processes, including back office operations, though even the latest laws do not sufficiently address data protection. As with any jurisdictions not yet providing adequate levels of data protection within their own legal regimes, businesses need to continue to be concerned with the laws that pertain to the data they are handling within their own frameworks.

The current state of privacy regulation in India is unsettled. The National Association of Software and Service Companies (“NASSCOM”)3 has been pushing for more privacy regulation, though no such regulation has yet made it through the legislature.4

India does have some basic protections and there are remedies for a privacy breach, but there are many remedies and they have not yet been codified into one cohesive piece of legislation.5 Also, new privacy impacting directives have been mandated almost in a haphazard fashion. One such example of this is the recent demand made by the Indian government on Research in Motion6 (the producers and service provider for BlackBerry devices and software) to provide the ability to decrypt encrypted data transmitted by BlackBerry devices used in India.7

Even if your organization has established privacy and security process and technology for outsourced operations today, it is important to keep in mind that that the reengineering of infrastructure for purposes of moving to an overseas vendor can affect security controls.

Walk Through of the Development of a Data Related Vendor Management Program

As an example of how an organization may come to establish a data related vendor management program, we will walk through the experience of one of our clients. This client is a multibillion dollar provider of consumer services.

The organization was adopting a risk management approach to the handling of their assets. As they calculated the level of risk posed to all assets—they soon realized a cross functional team was necessary to assess risks associated with their data—in particular their customer and employee data. It became clear they needed to pay special attention to the vendors handling their data, as these “data related vendors” are involved in every aspect of their services.

The organization’s motives for addressing data protection go beyond compliance and competitive advantage, their motivation stems from the organization’s culture and a strong desire to:

• Maintain trusted relationships with both customers and employees.
• To not disrupt or have negative impact on either their customers’ or employees’ lives.

The risk management effort was spearheaded by the organization’s Chief Information Officer and Vice President of Finance, who were able to gather a cross functional team to handle the data aspects of their vendor risk management program. This included representatives from legal, internal audit, finance, marketing, purchasing, information technology, information security and selected lines of business.

Early on, they established the mission of the data related vendor management program:

• Assess the overall level of information privacy and security risk that utilizing a given vendor might pose.
• Determine the level of assurance that vendors who will have access to the organizations’ information will adequately protect and adhere to all information privacy and security requirements (derived from the organization’s polices, including all legal and regulatory obligations).
• Develop a process for the business lines to mitigate or accept the identified level of risk, including the ability to address underperforming vendors.
• Develop sustainable process and tools (a methodology) to support the continuous operation of this mission.

A vendor management lead role was appointed for each line of business, it was these individuals’ responsibility to gather and maintain information from their lines of business regarding vendors. This information was used to identify what each vendor provides to the organization (services) and what the organization provides to each vendor (access to information). Initial analysis of this information also allowed for developing a relevant tier structure for their vendors.

Each vendor was assigned a tier ranking according to:

• Type of information the vendor has access to (taking into consideration the degree of sensitivity of the data, compliance requirements, and/or quantity of data) and the consequences if the vendor should fail to meet its data protection and handling obligations.
• Criticality of the service the vendor provides for the organization and the organization’s customers and/or employees and the practicality of replacing the vendor with another vendor or in-house operations.

Risk Tier	Failure Consequences (and Data Sensitivity and/or Quantity)	Criticality (and Practicality of Replacement)
1 (Critical)	Significant financial loss Significant adverse privacy and security risk for customers or employees Large number of customers or employees affected Significant legal/regulatory compliance risk High risk of damage to reputation and/or brand value	Critical to the enterprise Loss of service would result in financial and reputation loss Difficult to replace, would incur significant time and expense
2 (High)	Large financial loss Significant adverse privacy and security risk for customers or employees Large number of customers or employees affected Legal/regulatory compliance risk High risk of damage to reputation and/or brand value	Critical to several main line(s) of business Loss of service would result in financial loss Difficult to replace, would incur significant time and expense
3 (Medium)	Moderate financial loss Significant adverse privacy and security risk for customers or employees Large number of customers or employees affected No or little legal/regulatory compliance risk Medium risk of damage to reputation	Negative impact to non-mission critical line(s) of business Loss of service would result in financial loss Replaceable, would incur some time and possible expense
4 (Low)	Little financial loss Non-sensitive data Small number of customers or employees affected No or little legal/regulatory compliance risk Low risk of damage to reputation	Non-critical services Loss of service may result in financial loss Easy to replace, would incur little time and/or expense

The type of data handled that automatically classifies vendors into Tier 1 (Critical) or Tier 2 (High) vendors, includes all data that falls under the jurisdiction of privacy or security protection or breech notification laws and regulatory requirements. Additionally the organization made a decision that vendors that handle any significant quantity of customer data that is in any way personally identifiable (including customer account numbers), regardless of whether it is covered by any law or regulation, will be classified as a Tier 1 (Critical) vendor. Volume also is factored into assigning vendors to a tier. It was decided that vendors performing transactions on 250,000 or more distinct records annually would fall under Tier 1. By classifying vendors into tiers the organization also knows where to concentrate its resources.

The organization’s internal security controls framework, which is utilized to maintain compliance with its own privacy and security policies, was based on ISO 17799/27002 as well as laws and regulations applicable to the organizations use of data. This was leveraged to develop the tools against which vendors were assessed. Careful consideration of requirements along with efficiency and clarity were taken into account, and 35 individual controls were determined for validating vendors’ data privacy and security controls.

Of the 35 controls, five were selected by the organization as key risk indicators. Failing any of these five criteria resulted in an automatic controls assessment failure:

• Proof of information privacy and security program(s) and an executive specifically responsible for maintaining and updating the program
• Proof of a documented employee termination process
• Proof of documented access validation criteria and processes (including employee termination process)
• Documented processes and procedures directly pertaining to the vendor relationship with the organization
• Documented process for incident handling (including communication and emergency procedures plans)

A questionnaire was created in order to query the vendors regarding the 35 controls. Upon return of the questionnaires, automated scoring of the weighted questions was performed before the answers were manually scrutinized. Then a determination was made as to what evidence would be requested of the vendors to support their questionnaire answers. For example, an information classification policy or an employee confidentiality agreement might be requested. Demonstration of supporting evidence was then used by the organization to confirm or deny suspicions of where the vendors’ data protection practices may be flawed.

On a quarterly basis, the Tier 1 (Critical) vendors receive this questionnaire on their practices. If any anomalies or deficiencies appear, contact is made by phone. The Tier 2 (High) vendors also receive questionnaires biannually and the other vendors receive questionnaires on an annual basis. For all Critical and High vendors, an onsite visit was made within six months of establishing this program and continues on a regular and as needed basis, with most Critical and High vendors scheduled for annual on-site visits. Tier 3 (Medium) and Tier 4 (Low) ranked vendors found to have deficiencies that may be able to be addressed, can opt to address their gaps and be reassessed by the organization.

The results of these assessments are presented back to the lines of business that utilize the given vendor. A summary of the vendors risk ranking is presented as high, medium or low, color coded as the familiar red, yellow or green. From this, the business is charged with making an educated decision with options to accept risk, request a further risk remediation plan be implemented or move toward terminating the vendor relationship. We have found that most, but certainly not all, organizations elect to work with their vendors in order to address any deficiencies rather than eliminating them. This is changing however; in recent months underperforming vendors are frequently being eliminated.

Conclusion

Data related vendor management is a growing, and complex, area of information technology, compliance and the law. It is important that your organization develop a comprehensive solution in order to manage your data related vendors. The completion of these activities will provide procedural clarity for your organization’s data protection practices and compliance responsibilities. Having a well structured vendor management practice will allow your organization to maintain a high level of data security and privacy maturity while leveraging the benefits of outsourcing.

Checklists

Rolling Out New Programs—Challenges & Solutions

• Creating your VMO
  • Gaining executive level support, understanding risks, vulnerabilities, liability and cost (savings)


• Assembling framework, determining requirements, creating/obtaining tools, templates, process, procedures
  • Utilizing existing internal data protection requirements, developing as necessary, leverage knowledge and skills of diverse groups in your organization, leverage outside assistance


• Vendors have not yet been held to specific requirements
  • Liability reductions and quality increases not just for your organization, but also for the vendor—clear requirements are advantages for the vendor
  • Work closely with the vendors in order to address concerns


• Additional controls may cost more
  • Reductions in risk have monetary value (e.g. insurance), also cost (savings) of outsourcing must include management overhead going forward


• Vendors may not have been required to comply with audits/assessments
  • Build it into contracts as relationships are established, for existing contracts, notify vendors of this need for upcoming contract renewals, exercise change options in existing contracts

Points to Consider Before Transferring Data to Vendors

• Are there any specific regulatory requirements for this data? Do you have health data, financial information, is the data being transferred across international borders?

• What is the media type of this data? It might be easier to transport electronic data, but it may be cheaper to store hard copy data (e.g. a climate controlled vault vs. a warehouse).

• How is this data classified? Value is also tied to classification.

• What is this data worth? Customer information is very valuable. If it is lost or misplaced, trust is lost. This directly affects your brand and is very difficult to regain.

• Who owns the data? Do you own it or are you a custodian? When it leaves your organization, do you have any control over this information? Does this change if the data is going to be destroyed or if it is just going to be stored?

• Who touches/handles the data? How many vendors does it take to transfer your information offsite? You need to set up a chain of custody for this information as soon as it leaves your servers. This needs to be documented with signoff sheets, electronic tracking activities and well established procedures.

• Is this transaction single or multi-sourced? Are all of the data handlers covered by your vendor agreements?

• You are ultimately responsible for a data breach, so choose your vendors wisely!

Successful Vendor Management Office (“VMO”) Practices

There are similarities in the successful VMOs that we have observed. Some of the key activities of these groups include:

Strategy and Leadership

• Successful VMOs have a vision for their success
• They retain all decision making related to data related vendor issues
• They have a vendor strategy template

Opportunity Evaluation

• They have an opportunity evaluation template
• They have a detailed opportunity assessment tool
• They have an vendor comparison tool
• Portfolio of governance framework

Quality and Risk Management

• Incident and risk procedures
• Offshore operations success markers
• Risk assessment samples
• Performance metrics

Business Integration/Operations Support

• Change management methodology
• Training development criteria
• Sourcing technology checklist
• Transition process

Sourcing Program/Project Management

• Sourcing process procedures
• Project planning and management methods
• Governance structures, roles and responsibilities
• Data collection templates

Financial Management

• Business case templates
• Benefit realization framework (if necessary)
• Cost case—both domestic and overseas

Vendor Contracting and Management

• Vendor selection process
  • RFI/RFP template
  • Vendor capability matrix
  • Vendor communications templates
  • Vendor evaluation templates
  • Due diligence checklist
• SLA list
• Roles and responsibilities samples

Communication

• Communication strategy templates
• Communications plan template

---

The authors spoke on the topics covered in this article at the West LegalWorks Second Annual Information Security and Data Privacy Summit in November 2007.

At the time of writing, Benjamin Gerber, CISSP, CISA, CPP, CIPP/G, was a Senior Managing Consultant and the Privacy Services Competency Co-Lead with the Security and Privacy Practice at IBM.
He is now a Principal in the Privacy Strategy group at The MITRE Corporation.
He can be reached at privacy.us/contact or .

Adam C. Nelson, Esq., CIPP/IT, a member of the Board of Editors of the Privacy & Data Security Law Journal, is a Senior Managing Consultant in the Security and Privacy Practice at IBM and the Privacy Services Competency Lead.
He can be reached at .

Published in the October 2008 Privacy & Data Security Law Journal.
© 2008 Alex eSolutions, Inc.

privacy.sg