Cybercrime and data security incidents are on the rise. Publicized cyber incidents have become so prevalent that it would be difficult to find someone who has not received at least one breach notification letter in the mail. While most companies are devoting increased efforts and resources to manage this risk, cyber criminals are constantly devising new and more creative means of attack, including targeting larger companies via their smaller and often less technologically sophisticated third-party service providers.

Data security breaches are nearly inescapable in the current environment, and the ensuing investigation and remediation process can be quite costly and complex, requiring access to and interpretation of a morass of highly technical data. The process is further complicated if (as is frequently the case) the breach implicates a company’s third-party service provider or the services provided by the third party. This is an even greater concern when the service provider relationship is extensive or the services are strategic or essential to a company’s ongoing operations, such as IT infrastructure services and certain cloud-based service offerings. In these circumstances, the company has the customer relationships and (in most cases) the compliance and notification responsibility, but has to rely on the cooperation and assistance of its service provider in order to obtain the information necessary to meet its compliance obligations and to otherwise mitigate the effects of the breach and preserve its customer relationships. If the service provider is the one that experienced the breach or was responsible for the security activities that gave rise to the breach, the incident response process may be further complicated because the service provider’s objectives in this circumstance may be in conflict with the needs of its client.