Third party technology vendor contracts that do not adequately address adequate safeguards such as roles and responsibilities for security incident response, remediation, loss of revenue, litigation costs and fines, access to data limitations, confidentiality and security requirements, and data destruction can leave your organisation exposed to legal liability and reputational damage. Some organisations have relied solely on the service provider to supply the necessary security protections and haven’t conducted risk assessments to determine what security gaps may exist within the vendors' security program and how those capabilities and gaps impact their own security and compliance obligations.

​

Key IT service provider contracts should be proactively reviewed to ensure that the proper protection and processes are in place with verification standards and enforceability. Multi-year agreements with terms that are often static over the life of the contract may not be keeping pace with the dynamic cybersecurity and technology risk environment. 

​

Our approach to technology risk contract reviews provides a comprehensive report card with actionable recommendations for risk mitigation.