Data risk in the third-party ecosystem: second annual study

Larry Ponemon

We are pleased to present the findings of Data Risk in the Third-Party Ecosystem: Second Annual Study, sponsored by Opus, to understand trends in the challenges companies face in protecting sensitive and confidential information shared with third parties and their third parties (Nth party risk). While the findings of this study reveal that the risk of sharing sensitive and confidential information with third parties is increasing, there are governance and IT security practices that can be implemented to significantly reduce the likelihood of a third-party data breach.

Since the study was first conducted last year, companies have made little progress in improving the overall effectiveness of their third-party risk management programs. This includes understanding how many of their third and Nth parties have access to sensitive and confidential data, confirming the existence of adequate safeguards and security policies in third parties and reviewing third-party management policies and programs to ensure risks are addressed. A serious barrier to achieving these objectives is the lack of adequate resources to manage third-party risk, according to 60 percent of participants in this research.

We define the third-party ecosystem as the many direct and indirect relationships companies have with third parties and Nth parties. These relationships are important to fulfilling business functions or operations. However, the research underscores the difficulty companies have in detecting, mitigating and minimizing risks associated with third parties that have access to their sensitive or confidential information.

The study found strong correlations between certain best practices and a reduction in the likelihood of third-party data breaches. The two most effective practices that when deployed reduce the likelihood of a breach are the evaluation of the security and privacy practices of third parties (46 percent likelihood of a data breach vs. 66 percent likelihood) and an inventory of all third parties with whom the organization shares information (46 percent likelihood of a data breach vs. 65 percent likelihood).

Key Report Findings:

  • Data breaches caused by third parties are on the rise

Fifty-six percent of respondents confirm that their organizations experienced a data breach caused by one of their vendors, an increase of 7 percent over the last year.

Cyber attacks against third parties that resulted in the misuse of their company’s sensitive or confidential information also increased significantly from 34 percent to 42 percent of respondents.

  • The effectiveness of third party governance programs remains low

 Less than half of all respondents say managing outsourced relationship risks is a priority in their organization.

Only 17 percent of respondents rate their companies’ effectiveness in mitigating third party risk as highly effective.

Sixty percent of respondents feel unprepared to check or verify their third parties, down from 66 percent in 2016.

  • Accountability and board level involvement increased slightly

Accountability for the third-party risk management program is dispersed throughout the organization. However, 5 percent more respondents now have an owner of the third-party program compared to last year.

Forty-two percent of respondents strongly agree or agree that their companies’ board of directors requires assurances that third-party risk is being assessed, managed and monitored.

However, only one-third of all respondents say their companies regularly report to the boards of directors on the effectiveness of the third-party management program and potential risks to the organization.

  • Companies lack visibility into third party and Nth party relationships

 The average number of third parties with access to confidential or sensitive information has increased by 25 percent over last year from 378 to 471 third parties.

More than half of all respondents do not keep a comprehensive inventory of all third parties with whom they share sensitive information.

Visibility gets worse with Nth party relationships, only 18 percent of respondents say their companies know how their information is being accessed or processed by Nth parties with whom they have no direct relationship.

Thirteen percent of all respondents could not determine if they had experienced a third-party data breach.

  • Today’s programs are insufficient to manage third party risks

 Fifty-seven percent of respondents say they are not able to determine if vendors’ safeguards and security policies are sufficient to prevent a data breach

Less than half of all respondents say that their company evaluates the security and privacy practices of all vendors before starting a business relationship that requires the sharing of sensitive or confidential information.

If they do conduct an evaluation, it is mostly to acquire signatures on contracts that legally obligate the third party to adhere to security and privacy practices.


  1. Evaluation of the security and privacy practices of all third parties. In addition to contractual agreements, conduct audits and assessments to evaluate the security and privacy practices of third parties.
  1. Inventory of all third parties with whom you share information. Create an inventory of third parties who have access to confidential information and how many of these third parties are sharing this data with one or more of their contractors
  1. Frequent review of third-party management policies and programs. The third-party risk management committee should create a formal process for and regularly review the security and privacy practices of their third and Nth parties to ensure they address new and emerging threats, such as unsecured Internet of Things devices.
  1. Formation of a third-party risk management committee. Create a cross-functional team to regularly review and update third-party management policies and programs.
  1. Visibility into third or Nth parties with whom you do not have a direct relationship. Increase visibility into the security practices of all parties with access to company sensitive information – even subcontractors
  1. Accountability for proper handling of third-party risk management program. Centralize and assign accountability for the correct handling of your company’s third-party risk management program and ensure that appropriate privacy and security language is included in all vendor contracts. 
  1. Third party notification when data is shared with Nth parties. Companies should include in their vendor contract requirements that third parties provide information about possible third-party relationships with whom they will be sharing sensitive information.
  1. Oversight by the board of directors. Involve senior leadership and boards of directors in third-party risk management programs. This includes regular reports on the effectiveness of these programs based on the assessment, management and monitoring of third-party security practices and policies. Such high-level attention to third-party risk may increase the budget available to address these threats to sensitive and confidential information.

To read the entire study, click here.

Leave a Reply

Your email address will not be published. Required fields are marked *