Third party risk assessment

If a third party has access to your customer or cardholder data, there is a risk that you could have a breach of confidentiality or availability of your data via that third party. A risk assessment looks at all the third parties you use and works out the risk associated with each one. We:

  1. List all the companies you use to outsource any business activity where they deal with personal data. Many are obvious (such as an outsourced IT provider) but others will include confidential waste disposal, off-site document storage, solicitors, off-site backup providers, contract printers, contact centre services, marketing companies etc.
  2. Work out what type (personal, financial, sensitive) of information you send to these processors and what volumes of data they get on a monthly basis and will retain. We like to ask, “how much data will the company have in 12 months time?”
  3. Do a simple assessment to help you prioritise your work. We break them down into high-, medium- and low-risk categories.
  4. Perform an information security risk assessment of each supplier. The higher the risk, the more detailed the assessment needs to be. We rate each supplier on the likelihood of there being a breach of confidentiality, integrity or availability of the data. We also assess the risk of data loss in transit to and from the Data Processor.
  5. If they are handling cardholder data on your behalf, verify that the arrangement complies with the PCI-DSS requirements and assess their most recent self-assessment or ROC.
  6. Review each risk assessment and formally decide whether:
    • You are comfortable continuing to work with the Data Processor
    • You want to insist that they make some improvements to their information security (and set a timetable)
    • You want to find a different provider
  7. Check you have a written, signed and in-date contract with each processor that fulfils the requirements of the DPA and whether the processing is compliant with your DPA policy.
  8. Agree when the Data Processor will be re-assessed (at a minimum this should be annually).