These best practices included:

Evaluation of the security and privacy practices of all third parties. Vigilant companies conduct regular audits and assessments to appraise security and data management practices of third parties.
Keeping an inventory of all third parties with whom they share information. It's important to track all third parties that have access to sensitive data and how many of these parties are sharing this data with others.
Reviewing third-party management policies and programs often. The idea is to implement formal processes to regularly gauge security and privacy practices of third parties, particularly as they relate to new technologies and innovations like Internet of Things devices.
Requiring third parties to provide notification when data is shared with others. High performers mandated that third parties provide information and transparency into their Nth party relationships prior to sharing sensitive data.
Boards and executives maintained third-party oversight. Success often hinges on involving senior leadership and boards of directors in third-party risk management programs. High-level attention to third-party risk may increase the budget available to address these threats.

"While corporate executives understand the implications of a data breach or cyberattack to their business, far fewer are aware of the source of the attacks and the vulnerabilities that their organizations need to address to properly secure data," said Dr. Larry Ponemon. "Considering the explosive growth of outsourced technology services and the rising the volume of third parties, companies need to take control of their third-party exposure and implement safeguards and processes to reduce their vulnerability."

Special Reports /

Third-party breaches are a threat — and many companies aren't ready

Related Stories

Recommended For You