Mapping and managing cyber risks from third parties and beyond
Learning from the headlines
Every day, businesses experience cybersecurity incidents that can become disruptive, costly, and significantly damage their reputation. Large companies at the center of vast data ecosystems, however, face a particularly thorny problem: managing cyber and privacy risks around information that travels to third parties and beyond. These businesses share data with service providers and subcontractors to improve service delivery and reduce costs. In the process, data changes ownership multiple times and documentation, often containing information directly identifying their business and customers, travels throughout the ecosystem. Third parties are effectively custodians of the original information, and it’s critical to know what steps they are taking to safeguard the information further down the value chain.
Third party data breaches may force your organization to respond to incidents that are outside of your control or originate from an indirect source. Although you might not have an obligation to respond under current breach regulations, your organization could still suffer significant reputational damage as a result of the incident. Further, your customers could be at increased risk from criminals seeking to exploit a breach regardless of how the incident originated.
No matter which industry you are in, from hospitality to healthcare, consider the risks of your documentation traveling through vast ecosystems. How do you manage data protection risks when a large portion of the data you originate travels beyond your control?
Four solutions to managing risks and preparing your business
- 1. Map your data flow
- 2. Assess how third parties safeguard data
- 3. Use leading practices and industry standards
- 4. Create and stress test a cyber incident playbook
1. Map your data flow
Prioritize data governance and implement mechanisms for tracking data easily, in both digital or physical formats, by maintaining data records from creation to disposal. Enforce discipline through data ownership and accountability, assigning data custodians, implementing system controls, monitoring, and enforcing security policies as well as data handling procedures and auditing.
Summary
The proliferation of cloud and analytics providers who might have data about your customers without your knowledge or oversight is increasing your risk exposure. In the event of a data breach involving third or fourth parties, the key steps we outline can help you quickly answer fundamental questions: Is this our data? Where does it exist? Who did we sell it to? You can’t prevent all breaches involving your customers’ data. But you can do a lot more to provide clarity, transparency, and reassurance in a difficult situation.
Contact us
Global Cybersecurity & Privacy Leader, PwC US; Cyber, Risk & Regulatory Leader, PwC US
