The document discusses best practices for managing cybersecurity and data privacy risks from third party vendors. It recommends (1) conducting due diligence on third parties' security practices before engaging them, (2) using contracts to obligate third parties to comply with security standards and notify clients of incidents, and (3) periodically assessing third parties' security based on risk. Following these practices can help companies minimize risks from third parties as required by laws and frameworks.

1. Shawn E. Tuma
Cybersecurity & Data Privacy Attorney
Scheef & Stone, LLP
Shawn.Tuma@solidcounsel.com
Contracting for Better
Cybersecurity

2. A smart man learns from his mistakes.
A wise man learns from the mistakes of others.
A fool never learns.

3. Cybersecurity is no longer just an IT issue—
it is an overall business risk issue.

4. Security and IT protect companies’ data;
Legal protects companies from their data.

5. Laws and regulations
 Types
 Security
 Privacy
 Unauthorized Access
 International Laws
 Privacy Shield
 GDPR
 Federal Laws & Regs.
 HIPAA, GLBA, FERPA
 FTC, SEC, FCC, HHS
 State Laws
 48 states (AL & SD)
 NYDFS & Colorado FinServ
 Industry Groups
 PCI, FINRA
 Contracts
 3rd Party Bus. Assoc.
 Data Security Addendum

6. Laws and regulations
 Types
 Security
 Privacy
 Unauthorized Access
 International Laws
 Privacy Shield
 GDPR
 Federal Laws & Regs.
 HIPAA, GLBA, FERPA
 FTC, SEC, FCC, HHS
 State Laws
 48 states (AL & SD)
 NYDFS & Colorado FinServ
 Industry Groups
 PCI, FINRA
 Contracts
 3rd Party Bus. Assoc.
 Data Security Addendum

7. 1. Risk assessment.
2. Policies and procedures focused on cybersecurity.
• Social engineering, password, security questions
3. Training of all workforce on P&P, then security.
4. Phish all workforce (esp. leadership).
5. Multi-factor authentication.
6. Signature based antivirus and malware detection.
7. Internal controls / access controls.
8. No outdated or unsupported software.
9. Security patch updates management policy.
10. Backups segmented offline, cloud, redundant.
11. Incident response plan.
12. Encrypt sensitive and air-gap hypersensitive data.
13. Adequate logging and retention.
14. Third-party security risk management program.
15. Firewall, intrusion detection and prevention systems.
16. Managed services provider (MSP) or managed security services
provider (MSSP).
17. Cyber risk insurance.
Common
Cybersecurity
Best Practices

8. 1. Risk assessment.
2. Policies and procedures focused on cybersecurity.
• Social engineering, password, security questions
3. Training of all workforce on P&P, then security.
4. Phish all workforce (esp. leadership).
5. Multi-factor authentication.
6. Signature based antivirus and malware detection.
7. Internal controls / access controls.
8. No outdated or unsupported software.
9. Security patch updates management policy.
10. Backups segmented offline, cloud, redundant.
11. Incident response plan.
12. Encrypt sensitive and air-gap hypersensitive data.
13. Adequate logging and retention.
14. Third-party security risk management program.
15. Firewall, intrusion detection and prevention systems.
16. Managed services provider (MSP) or managed security services
provider (MSSP).
17. Cyber risk insurance.
Common
Cybersecurity
Best Practices

9. Ancient Cybersecurity Wisdom
“Water shapes its course according
to the nature of the ground over
which it flows; the soldier works out
his victory in relation to the foe
whom he is facing.”
“In all fighting the direct method
may be used for joining battle, but
indirect methods will be needed to
secure victory.”

10. Lesson: Evaluate and audit third-parties’ security
• In re GMR Transcription Svcs., Inc., Consent
Order (Aug. 14, 2014).
• FTC’s Order requires business to follow 3 steps
when working with third-party service providers:
1. Investigate before hiring data service
providers
2. Obligate data service providers to adhere
to the appropriate level of data security
protections
3. Verify that the data service providers are
complying with obligations (contracts)

11. Lesson: Evaluate and audit third-parties’ security
In January 2014, SEC indicates that the new standard of care for
companies may require policies in place for:
1. Prevention, detection, and response to cyber attacks and
data breaches,
2. IT training focused on security, and
3. Vendor access to company systems and vendor due
diligence.

12. NIST Cybersecurity Framework (prop. ver. 1.1)
• Adds “Supply Chain Risk Management (SCRM)” as a “Framework
Core” function
• Coordinate cybersecurity efforts with suppliers of IT and OT
(operational technology) partners
• Enact cybersecurity requirements through contracts;
• Communicate how cybersecurity standards will be verified and
validated; and
• Verify cybersecurity standards are met.

13. Lesson: Know your contractual obligations
• Addendum to business contracts
• Common names: Data Security & Privacy Agreement; Data Privacy;
Cybersecurity; Privacy; Information Security
• Common features:
• Defines subject “Data” / “Network” protected in categories
• Establishes acceptable and prohibited uses for Data / Network
• Establishes standards for protecting Data / Network (3rd / Nth)
• Allocates obligations and responsibility for incident
• Notice, roles, expenses
• Requires binding third-parties to similar provisions

14. New York Department of Financial Services Cybersecurity (NYDFS)
Requirements for Financial Services Companies + [fill in]
• All NY “financial institutions” + third party service providers.
• Third party service providers – examine, obligate, audit.
• Establish Cybersecurity Program (w/ specifics):
• Logging, Data Classification, IDS, IPS;
• Pen Testing, Vulnerability Assessments, Risk Assessment; and
• Encryption, Access Controls.
• Adopt Cybersecurity Policies.
• Designate qualified CISO to be responsible.
• Adequate cybersecurity personnel and intelligence.
• Personnel Policies & Procedures, Training, Written IRP.
• Chairman or Senior Officer Certify Compliance.

15. Third Party
Service Provider
Security Policy
Section 500.11
“Each Covered Entity shall implement written policies and
procedures designed to ensure the security of Information
Systems and Nonpublic Information that are accessible to,
or held by, Third Party Service Providers.”
• P&P should be based on CE’s Risk Assessment and
address the following, as applicable:
• The identification and risk assessment of TPSPs;
• Minimum CP required by TPSP to do business with CE;
• Due diligence process used to evaluate the adequacy of CP
by such TPSP;
• Periodic assessment of such TPSP based on risk they
present and continued adequacy of their CP.
• P&P shall include relevant guidelines for due diligence
and/or contractual protections relating to TPSP and
applicable guidelines addressing:
• TPSP’s P&P for access controls and MFA to IS / NPI
• TPSP’s P&P for use of encryption in transit and at rest;
• Notice to be provided to CE for Cybersecurity Event; and
• Reps and warranties addressing TPSP’s cybersecurity P&P
NEW YORK DEPARTMENT OF FINANCIAL SERVICES
CYBERSECURITY REGULATIONS

16. EU – General Data Protection Regulation (GDPR)
• Goal: Protect all EU citizens from privacy and data breaches.
• When: May 25, 2018.
• Reach: Applies to all companies (controllers and processors):
• Processing data of EU residents (regardless of where processing),
• In the EU (regardless of where processing), or
• Offering goods or services to EU citizens or monitoring behavior in EU.
• Penalties: up to 4% global turnover or €20 Million (whichever is greater).
• Remedies: data subjects have judicial remedies, right to damages.
• Data subject rights:
• Breach notification – 72 hrs to DPA; “without undue delay” to data subjects.
• Right to access – provide confirmation of processing and electronic copy (free).
• Data erasure – right to be forgotten, erase, cease dissemination or processing.
• Data portability – receive previously provided data in common elect. format.
• Privacy by design – include data protection from the onset of designing systems.

17. Third Party
Processing and
Risk Under the
GDPR
• Controller, individually or with other controllers (jointly
and severally), is responsible to the data subjects. Art. 26
• Processor only process on controller’s instructions. Art. 29
• Using a risk assessment, the controller must implement
appropriate technical and organizational safeguards (incl.
P&P) to ensure personal data is processed lawfully.
Reassessment and maturation is required. Art. 24(1)
• Controller shall use only processors providing sufficient
guarantees to implement appropriate technical and
organizational measures to satisfy GDPR. Art. 28
• Processor must have controller’s written authorization to
engage another sub-processor;
• Processor must have binding contract with controller
specifying particulars of processing;
• Processor must be bound to confidentiality;
• Processor must demonstrate compliance and agree to
audits and inspections;
• Nth processors liable to upstream processor, which is liable
to the controller, which is ultimately liable.
• Non-regulated controllers and processors can contractually
agree to be bound. Art. 42
EUROPEAN UNION
GENERAL DATA PROTECTION REGS.

18. Example Scenarios

19. “It’s not our fault!”
• Private security firm’s job applicants’ personal data (including
identification of those with Top Secret security clearances) is exposed
on an unsecured Amazon server.
• Firm says it wasn’t its fault, it was fault of its third-party vendor that
we hired to process new job applications that left the data exposed.
• Former CIA, NSA, Secret Service
• Names, home addresses, telephone numbers, email addresses
• Applicant transported nuclear activation codes
• Applicant was “warden advisor” at Abu Ghraib black site
• Who do you think is responsible?
• Do you think a better contract would have helped?
• What would have helped prevent this?

20. “We can’t afford it”
• MegaCorp is a global leader in biotechnology and one of the world’s
wealthiest companies. MegaCorp developed new highly confidential and
proprietary bio-authentication technology that could solve the world’s
cybersecurity problem by setting access rights to data based on users’
unique DNA.
• MegaCorp recognizes the cyber threat and has state-of-the-art
cybersecurity for its network, having a larger cybersecurity budget than the
revenue of many biotech companies.
• For testing to prove the technology works, MegaCorp turns to the 4 best
biotech research facilities, known for the quality and integrity of their
research, not their profitability.
• MegaCorp’s contracts with the facilities requires they maintain security and
confidentiality of its intellectual property (IP).

21. “We can’t afford it” (cont.)
• During testing for MegaCorp, Research1 discovers an intrusion in its
network. Due to budget limitations, its “IT guy” calls his buddy to do
“forensics” and discover Research1’s network was being used to mine
Bitcoin. They block the hacker and conclude “no problem.”
• Two weeks later Research1 gets hit with ransomware and a demand
for $100,000 paid in Bitcoin. IT guy was able to restore the network
from backups so he sent a taunting email to the hacker, just for fun.
He also ignored that lawyer who warns of possible persistent attack
and said it may be a legal breach.
• One week later the hacker emails Research1’s Board of Directors
saying they have MegaCorp’s data, demand $1million which it can’t
afford to pay.

22. Lessons from “We can’t afford it!”
• Larger enterprises have a better appreciation of cyber risk and spend more
resources on it. SMBs are not there … yet … still thinking, “we can’t afford
it,” is justifiable.
• Does the harm to MegaCorp’s IP change depending on whether taken from
it or Research1?
• MegaCorp would crush Research1 in a lawsuit … so what?
• MegaCorp would have gladly paid the $1million ransom to try and protect
its IP, even with no guarantee.
• What contractual terms would have helped MegaCorp?
• What practical discussions would have helped MegaCorp?
• What risk transfer devices would have helped?
• What technology would have helped?

23. Key Takeaways

24. Focus on basic principles
• Two primary reasons for cybersecurity in contracting are to:
• Minimize risk, including third-party risk; and
• Determine the process and responsibility for incidents.
• Risk can be reduced to two basic things: protecting –
wherever and however – and responding to incidents
concerning:
• Networks
• Data

25. Checklist: Using contracts to manage third-party risk
Focus on objectives: protecting, responding, responsibility of data/network
Staff appropriately
Understand facts of relationship/transaction
Understand risks by thinking worst case scenario from outset
Minimalize risks: do not risk it if you do not have to
Discuss objectives, facts, risks, protection with those responsible
Assess third-party’s sophistication and commitment
Agree upon appropriate protections
Investigate ability to comply
Obligate compliance, notification (to you), responsibility
Include in incident response planning
Cyber Insurance: transfer risk where possible

26. • Board of Directors & GeneralCounsel, Cyber Future Foundation
• Board of Advisors, NorthTexas Cyber Forensics Lab
• Policy Council, NationalTechnology Security Coalition
• CybersecurityTask Force, IntelligentTransportation Society of America
• Cybersecurity & Data Privacy LawTrailblazers, National Law Journal (2016)
• SuperLawyersTop 100 Lawyers in Dallas (2016)
• SuperLawyers 2015-16 (IP Litigation)
• Best Lawyers in Dallas 2014-16, D Magazine (Digital Information Law)
• Council, Computer &Technology Section, State Bar ofTexas
• Privacy and Data Security Committee of the State Bar ofTexas
• College of the State Bar ofTexas
• Board of Directors, CollinCounty Bench Bar Conference
• Past Chair,Civil Litigation &Appellate Section, CollinCounty Bar
Association
• Information Security Committee of the Section on Science &Technology
Committee of the American BarAssociation
• NorthTexas Crime Commission, Cybercrime Committee & Infragard (FBI)
• InternationalAssociation of Privacy Professionals (IAPP)
• Board of Advisors Office of CISO, Optiv Security
Shawn Tuma
Cybersecurity Partner
Scheef & Stone, L.L.P.
214.472.2135
shawn.tuma@solidcounsel.com
@shawnetuma
blog: www.shawnetuma.com
web: www.solidcounsel.com