Any company that uses a service provider should strongly consider including data security protections in the service agreement if the service provider has access to the personal information about the company\u2019s employees or customers, such as social security numbers, etc.\u00a0 A company\u2019s failure to insist upon data security protections could expose the company to significant liability. At a minimum, the company\u2019s agreement with the service provider should require the service provider to: (i) meet the industry standard of care related to protecting the personal information, (ii) maintain minimum security safeguards, and (iii) have a notice and incident response plan in the event of a breach. Even with adequate protections in place, companies should consider purchasing cyber insurance. Cyber insurance policies differ dramatically in terms of what\u00a0 they\u00a0 cover,\u00a0 what\u00a0 they\u00a0 exclude,\u00a0 and \u00a0the\u00a0 amount\u00a0 of retentions.\u00a0 Strongly consider having your policy reviewed by someone with knowledge in the area.<\/p>\n","protected":false},"excerpt":{"rendered":"
Any company that uses a service provider should strongly consider including data security protections in the service agreement if the service provider has access to the personal information about the company\u2019s employees or customers, such as social security numbers, etc.\u00a0 A company\u2019s failure to insist upon data security protections could expose the company to significant […]<\/p>\n","protected":false},"author":11,"featured_media":14837,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_mo_disable_npp":"no","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4,6],"tags":[100,101,102],"acf":[],"yoast_head":"\n