1E9Ct5D

a significant security challenge. Outside law firms, payroll companies, and on-linedatabase managers are all examples of third parties that a hacker or criminal may gothrough in an attempt to obtain a company’s data. Thanks largely to the Target breach,third parties are being required to demonstrate reasonable controls and acceptablestandards like never before.In that regard, financial institutions have been at the forefront in conducting meaningfuland exhaustive audits of their vendors, including outside counsel, to determine thevendor’s compliance with security requirements. Many banks now ask hundreds ofdetailed, targeted questions ranging from Human Resources policies and procedures tofire extinguishers, visitor procedures, access cards, and training. The vendor mustexplain their responses in detail (yes or no answers are not acceptable), and the bankmay conduct an onsite visit to confirm the veracity of the responses.While financial institutions are leading the way here, following the Target breach, it iscritical for companies of all industries to audit and monitor the security compliance oftheir outside attorneys and other vendors, as well as to have controls in place to restrictthird parties from certain protected data.C. Avoid Internal Complacency.Even the best security warnings are of little use if nobody is paying attention to them.Several action items to minimize the risk of a breach going unnoticed are:• Auditing logs of access to company data;March 6, 2015 20 © 3-6-2015 ALFA International Business Litigation P.G.