Cybersecurity red lock

As data privacy regulations proliferate and more data breaches are announced, companies are placing more pressure on their vendors to secure their data. In turn, more companies are including cybersecurity language in contracts and auditing their vendors—but when a service provider fails to meet those standards, they usually don't immediately pull the plug on the relationship.

If a client isn't based in heavily regulated industries such as finance or health care, or a data breach incident didn't occur, lawyers say companies will give their service providers leeway to quickly correct their security shortcomings. Langley & Banack shareholder and cybersecurity and data privacy attorney Natalie Friend Wilson explained most vendors and clients agree to include cure provisions that allows a vendor to address a client's cybersecurity concerns within 30 to 90 days.

Still, failing a cybersecurity audit or not having required cybersecurity protocols or credentials could breach a contract, lawyers say, and lead to termination. However, companies are hesitant to drop a service provider and restart the vendor selection process.

"The process of vetting a vendor and doing the contract procurement is time-consuming and expensive to the clients," Wilson said. "They don't want to be in a position where they have to terminate for small infractions or breaches and start all over again."

In a effort to address those concerns and not terminate a contract, the vendor's information security professionals will work with the client, usually without the assistance of legal counsel on either side, lawyers note. Instead, attorneys are involved in the drafting of the contracts, terminating the contract and in the worst-case scenario, bringing legal action. 

"A lot of this happens outside of the legal arena," said Goodwin Procter privacy and cybersecurity chair Brenda Sharton. "They aren't coming to lawyers for the most part."

However, Sharton noted most companies are hesitant to sue service providers because it brings more glaring attention to a mishap.

"You don't often see litigation over it even in the event of an accident or data breach, because if you think about it, the customer would be in a situation where they would be making it public and filing a lawsuit. They are drawing attention to a data breach. It's not as ubiquitous as you would think because they don't want to call attention necessarily [to it]," she said.

To be sure, it's not entirely unheard of companies suing their vendor, but attorneys say to mitigate that risk, vendors should carefully assess if they can reach the client's requirements and proactively build cybersecurity controls that match industry-wide standards.

Womble Bond Dickinson privacy and cybersecurity partner Tara Cho noted some industries, such as health care and financial services, have obvious security standards that vendors must comply with and obtain industry-recognized certification.

For vendors operating in less heavily regulated spaces, she recommended understanding the potential data vulnerabilities customers may face and proactively implement multi-factor authentication, encryption, disaster recovery and other protocols as its own cybersecurity standard. Cho said service providers want to avoid creating customized cybersecurity environments to meet each client's requirements because it is impractical and expensive.

Cho also noted companies' appetite to budge on cybersecurity requirements is waning, and lawyers agree cybersecurity's financial risk is only growing as more data privacy laws go into effect and consumers realize the value of their data.

"With the proliferation of and the evolution of laws about personal cause of action that an individual has against a company that they've entrusted their information with, there is less tolerance for companies with regard to vendors that can't rep and warrant a certain level of security," said Nelson Mullins Riley & Scarborough partner Tori Salis.