Assessing suppliers and cloud services

Module 7: Access, suppliers and cloud · Reading time: 11 minutes

Learning goal: After this lesson you can assess a supplier or cloud service for security, privacy and exit, explain what a processing agreement must cover under the GDPR, and keep a supplier inventory.
Key concepts: shared responsibility, processor, processing agreement, sub-processor, data location, certification (for example ISO 27001), exit strategy, supplier inventory

Your security is only as strong as your suppliers

A small business rarely runs its own servers. Email runs with a provider, the bookkeeping sits in an online package, the web shop runs on a platform, the laptops are managed by an IT company, and payroll goes through an accounting firm. That's sensible: those parties can often arrange security better than you could yourself. But it also means that a large part of your security is in other people's hands.

Try drawing it out for yourself. Put your business in the middle and draw a line to every party that stores data for you or has access to your systems. For each line, ask two questions:

1. What if that party disappears? An outage, a bankruptcy, a price increase that makes you want to leave.
2. What if that party leaks data? A break-in at the supplier, an employee who can see too much, an IT company's account being taken over.

Shared responsibility

In lesson 6.1 you already saw the shared responsibility model: the provider of a cloud service looks after the data centre, the servers and the running of the software; you remain responsible for your data, your accounts and your settings. Microsoft states literally in its documentation that this remains the case for every type of cloud service, even ready-made software.

What that means in practice:

A common mistake is assuming the provider arranges something you've never actually asked about. So ask.

Processor and processing agreement

As soon as a supplier processes personal data on your behalf, the rules of the GDPR apply. Think of customer data in your web shop, emails with names and addresses, payroll data, or cloud storage with applicants' CVs.

• You are the controller: you determine why and how the data is used.
• The supplier is a processor: it processes the data on your instructions, for your purposes.

Article 28 of the GDPR states that you may only use processors that offer sufficient guarantees for appropriate technical and organisational measures. You record the agreements in a processing agreement, in writing (electronic is fine). According to Article 28(3), that agreement must at least cover the subject matter, duration, nature and purpose of the processing, the types of personal data and data subjects involved, and that the processor:

1. only acts on your written instructions;
2. ensures its staff observe confidentiality;
3. takes the security measures required by Article 32;
4. only engages a sub-processor with your consent, under the same obligations;
5. helps you when people exercise their privacy rights (access, correction, deletion);
6. helps with security, data breaches and any DPIA (Articles 32 to 36);
7. at the end, deletes or returns the data and removes copies, at your choice;
8. gives you the information needed to check it complies with the agreements, and allows audits.

A sub-processor is a party that your processor engages in turn, for example the data centre of your hosting provider or the mail service used by your bookkeeping package. The GDPR states that the processor remains fully liable to you if a sub-processor fails to meet its obligations. Ask for the list of sub-processors.

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) recommends making the agreements concrete rather than simply repeating the legal text, and recording how quickly and with what information the supplier will inform you about a data breach. That last point matters: in lesson 8.2 you'll see that you must report within 72 hours, and that clock only starts once you know.

Many providers have a standard processing agreement. Read it, and check whether it genuinely needs to be signed or accepted: with some providers it isn't automatically in force.

This lesson gives general explanation and is not legal advice. The full text is in the GDPR at eur-lex.europa.eu.

Questions to ask a supplier

An assessment doesn't need to be a forty-page audit report. For a small business, a fixed set of questions works well. The answers are often already on the supplier's website, on a security page or in a frequently asked questions list.

About certification: ISO/IEC 27001 is an international standard with requirements for an information security management system. ISO doesn't certify organisations itself; that's done by an independent certification body. A certificate shows that an organisation arranges its security systematically, but it doesn't guarantee that nothing will ever go wrong. Pay particular attention to the scope stated on the certificate: does it cover the service you use, or only one office or department?

Exit: being able to leave is also security

An exit strategy is your plan for leaving a supplier, whether forced or voluntary. It sounds like something for later, but it needs to be part of your choice from the start: if you only discover you can't export your customer database when a supplier goes bankrupt, it's too late.

So check in advance:

• whether you can export all your data, and in what format (an open format such as CSV, standard email or ordinary files is better than a proprietary format);
• how long your data remains available after cancellation;
• whether your domain name is registered in your own name and whether you can change the nameservers yourself (lesson 4.3);
• whether you keep a recent export yourself, as part of your backup (lesson 6.1).

The supplier inventory

Record everything in a supplier inventory: a single table listing, for each supplier, the service, what data it holds, whether personal data is involved, whether there's a processing agreement, who owns the relationship on your side, the key answers from the questionnaire, and the exit option. Review it once a year, and whenever a new service is added.

If one of your customers falls under the Cyberbeveiligingswet (lesson 9.1), you can expect that customer to start asking you, as their supplier, these kinds of questions. With your own inventory, you'll have the answers ready.

In practice: what it looks like

Many providers put the answers to these questions on a security page. In the WebOké example environment, for instance, the Nextcloud guide describes what the provider arranges and what the user does themselves: where the data is stored, encryption in transit and at rest, mandatory two-factor authentication, updates and backups, and that you need a processing agreement for business use involving personal data. That structure (what the supplier arranges, what I do myself) is exactly what you should look for with every supplier. With other providers it's often found in a trust centre, a security page or the terms; if it isn't there, ask.

Summary

• Draw out your suppliers and ask for each line: what if it disappears, what if it leaks?
• Shared responsibility: the provider arranges the infrastructure, you arrange your data, accounts and settings.
• If a supplier processes personal data for you, it's a processor, and you sign a processing agreement under GDPR Article 28.
• Use a fixed set of questions: location, access, backup, encryption, data breach, sub-processors, certification, exit.
• A certificate tells you something, but check the scope; arrange your exit before you need it.

Quiz

Exercise

Exercise D7.2: Your supplier inventory. Create a table of your five most important suppliers and cloud services. For each supplier, note what data it holds, whether personal data is involved, whether there's a processing agreement, and look up the answers to the questionnaire from this lesson (location, two-factor authentication, backup, data breach, sub-processors, certification, exit). Try to actually create an export for at least one service.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers it may work similarly or differently.

• Nextcloud manual 3.1: How does WebOké secure your Nextcloud?
• Nextcloud manual 15.13: Frequently asked questions about security and privacy
• GDPR (Regulation (EU) 2016/679), Article 28: https://eur-lex.europa.eu/eli/reg/2016/679/oj
• Microsoft, Shared responsibility in the cloud: https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility