Image by: gustavofrazao, ©2018 Getty Images
Do you outsource a part of your business and then promptly forget about it? Your answer should be, "definitely not."
Outsourced services should be viewed as an extension of your business operations and treated the same as your internal staff. They should operate under your information governance policies, and you should be able to randomly audit them for compliance and risk.
While the service provider may be held accountable by you, your customers and their legal counsel will hold you solely responsible for the proper and secure management of the information you hold about them and ensuring that the privacy of this information is maintained so as not to put their business at risk.
As a case in point, on August 28, 2018, it was reported and confirmed by ABBYY, a leading manufacturer of recognition software and services, that one of their databases had mistakenly been left open for public Internet access, exposing 200,000 scanned documents. These documents included contracts, correspondence, and other sensitive documentation that had been properly captured, recognized, and stored.
As a case in point, on August 28, 2018, it was reported and confirmed by ABBYY, a leading manufacturer of recognition software and services, that one of their databases had mistakenly been left open for public Internet access, exposing 200,000 scanned documents. These documents included contracts, correspondence, and other sensitive documentation that had been properly captured, recognized, and stored.
While this problem was quickly dealt with once they were made aware of the situation, how can you protect yourself or defend your company in a similar situation? My answer is simple:
- Train the service provider on your governance policies and practices, and document this training has been completed
- Audit the service provider to ensure compliance
- Document the audit results along with corrective measures taken, should the service provider be found in non-compliance with your policies
Treat it as an internal resource and provide regular updates and training on your governance policies.
Bob Larrivee is a recognized expert in the application of advanced technologies and process improvement to solve business problems and enhance business operations. He reports on the latest information management technologies for DOCUMENT Strategy. Follow him on Twitter @BobLarrivee or visit boblarriveeconsulting.com.
