How do we protect our data when our third-party vendors have weak cybersecurity?

All answers to this question.

This is the "Supply Chain" risk that is dominating headlines. In 2023, you must include a "Right to Audit" clause in your vendor contracts. You don't necessarily need to go to their office; just ask them to provide a SOC 2 Type II report or a completed security questionnaire. If they can’t show you how they handle your data, they aren't a safe partner. Also, ensure you are using encrypted tunnels like a VPN or TLS 1.3 for any data being transferred between your systems and theirs.

   Answered 2025-06-17 by Sandra Mendez

Sandra, when dealing with giant vendors like cloud providers, we obviously can't audit them. Should we just trust their public compliance pages, or is there more we should look for?

   Answered 2025-06-19 by Jeffrey King

• Jeffrey, for the big players, their "Shared Responsibility Model" is your guide. They secure the infrastructure, but you are responsible for securing the data you put in it. Always check if they offer "bring your own key" (BYOK) encryption so that even they can't see your sensitive files if they were subpoenaed or breached.

     Commented 2025-06-20 by Sandra Mendez

I always recommend "Data Minimization." Don't give a vendor access to your whole database if they only need one specific list of names to do their job.

   Answered 2025-06-22 by Maria Lopez

• Exactly, Maria. If the data isn't there, it can't be stolen. Restricting the scope of shared data is one of the most effective ways to limit your liability.

     Commented 2025-06-23 by Ryan Miller