IT Service Providers and Customers Battle Over Data Breaches | Features | ChannelWorld.in

PARTNER HOTLINES

IT Service Providers and Customers Battle Over Data Breaches

By Stephanie Overby

There is no shortage of contentious contractual issues when inking an IT outsourcing deal, but one in particular has both providers and customers taking a hard line today: liability for data breaches. At one time, data security liability was a relatively straightforward issue.

Generally speaking, an outsourcing customer always had the responsibility to secure its own data, but provisions were inserted into contracts allocating responsibility for the confidential information to which a service provider had access.At that time, outsourcers were willing to take on unlimited financial liability for a breach of confidential data.

"The service provider was on the hook," says Chris Ford, chair of the global sourcing group at the law firm Morrison & Foerster. For other data breaches, there may have been a limitation of liability, typically set at a year's worth of service provider revenue associated with the contract. There were few, if any, special terms or requirements around data security processes.

Then along came federal regulations like Gramm-Leach-Bliley and the Health Insurance Portability and Accountability Act (HIPAA) along with a swarm of state laws creating new requirements for companies suffering a data breach, including customer notification and damage mitigation provisions, such as mandatory credit monitoring and fraud protection for affected customers.
IT service providers saw the price tag on unlimited liability skyrocket. Potential damages from a data breach vary widely by industry and scope. Forrester estimated that the cost ranged from $90 to $305 per data record in 2007, while last year the Ponemon Institute tagged it at $214 per compromised record. "If you have a large customer base," Ford explained, "the price to comply could be very large."

IBM Reshapes the Liability Paradigm

And so the lawyers got to work. The big U.S. providers like IBM Global Services, HP and Accenture began reexamining their risk profiles and moving aggressively to limit liability. "Providers, led by IBM, pushed back hard," said Shawn Helms, partner in the outsourcing practice of law firm K&L Gates. They began creating secondary caps for certain breach of confidentiality or data protection measures. Those with clients with gigantic customer bases in sectors such as retail, energy or financial services were the most concerned.

"Companies like IBM took a very aggressive approach," said Ford. "The usual limitation on liability -- an amount equal to 12 months of revenue -- was a standard you never had to negotiate. They all became fairly aggressive about limited liability. It was a paradigm shift."

It became common to encounter outsourcing providers capping liability at two or three months of fees, said Robert Finkel, a partner in the corporate practice of the law firm Dewey & LeBoeuf. Meanwhile, most offshore vendors were willing to take on unlimited data security liability to get new business, and many still are, according to Finkel.

But among IBM and others that took a hard line on limited liability, negotiators would sometimes leave the table if the limits on data breach liability were financially unfeasible. "IBM took the corporate position that they were unwilling to assume that level of liability and even walked away from huge deals. Customers were frankly a little stunned," Ford said.

Outsourcing Customers Push Back on Liability

In recent years, however, outsourcing customers have begun to fight back. "Four or five years ago, they were okay with just getting some data breach liability," said Ford. "Now they're saying, 'We need a multiple of [the standard 12 months of fees] limitation.' I've seen a number of deals where it's three or four times that."

Outsourcing customers started demanding that new data security processes be written into their contracts, as well. "Customers understood the risks and started requiring more protection," said Helms. They began "demanding specific data security requirements, such as specific firewall policies, encryption or limited network access to [provider employees]," he said.

IT service buyers are also coming to the table with detailed risk profile assessments that put a real dollar figure on potential data breaches. "Customers are looking at this issue as hard as the service providers and saying, 'I'm handing my data over to you. You're in control of my data. If something goes wrong you need to take responsibility,'" Ford said.

In response, the outsourcing providers began adding very detailed exhibits to their agreements outlining their security obligations.

"In order for the customer to recover under one of these contracts, they have to prove a clear breach of these exhibits. If it's not listed, it's not [the provider's] obligation," Ford said. "It makes the likelihood of the customer recovering much lower."

It doesn't matter that no outsourcing providers or customers have encountered the kind of multi-million dollar data breach they most fear. "There hasn't been any big private case or the government leveraging any huge fines," said Finkel. "But it's inevitable. It will happen. And that's changed things on both sides."

Today, data breach liability "is the most contested provision in outsourcing contracts today," according to Ford. And it's only poised to become more contentious as customers consider cloud computing services.
"Today, this issue is a mess. Customers and providers are not getting closer on this issue, but further apart," Helms said. "As more data moves to the cloud, the allocation of risk is becoming more and more important."

Ford advises outsourcing buyers to push hard for data breach liability in contracts when it makes sense. If a service provider will not have access to confidential customer information, for example, it would be a waste of negotiating power to take a hard line on data security liability. But for those situations where a data breach is a bigger risk, it's important to understand where a provider's limits, and your own, might lie.

"You have to do due diligence and conduct a significant risk assessment as to the real potential liability," Ford said. "There will be a breaking point, but you have to figure that out through hard negotiation, and you have to figure out if that's something you can live with."


Latest Features

  • Security threats, hackers and shadow IT still plague health IT

    Security threats, hackers and shadow IT still plague health IT

    Security has long been a primary challenge in the health IT market, and two new reports help illustrate the vulnerabilities surrounding some of the most sensitive consumer data.
  • Why integrated social suites are failing marketers

    Why integrated social suites are failing marketers

    Most enterprise technology eventually converges into a suite, as it did with ERP. Integration hassles, management headaches and training challenges arising from a mishmash of best-of-breed solutions drive frustrated enterprise software buyers to the suite life -- but not in marketing tech, at least not yet.
  • 3 steps to digitizing your work for maximum productivity

    3 steps to digitizing your work for maximum productivity

    From the earliest days as a marketing slogan, the elusive concept of the so-called paperless office may finally be taking shape, if anecdotal evidence is anything to go by. A growing number of small businesses and startups, unencumbered by legacy processes, are quietly ditching printouts for an all-digital ecosystem, buoyed by soaring BYOD ownership and growing familiarity with a plethora of cloud services.
  • Attracting millennials starts with digital tech

    Attracting millennials starts with digital tech

    The ways millennials use technology are changing how companies brand themselves to attract young talent. However, according to a new study from the CMO Council and Executive Networks, most marketing and HR leaders don't have brand strategies that align with millennial preferences.
Latest Videos

Vishal Dhupar: NVIDIA is taking Graphics Virtualization to the next level

Vishal Dhupar, MD - South Asia, NVIDIA, talks cloud GPU, the power of graphics virtualization and how NVIDIA is going to be one of the cornerstones of the smart city pie.

Revisiting Customer Strategy Pays: Ram Kumar R, Gemini Communication

R Ram Kumar, Director of Chennai’s Gemini Communication (GCL), explains at length why an overhaul of GCL’s customer strategy and re-establishing connect were vital in helping the company bounce back.

Praveen Sahai: EMC has Consolidated its Channel Partner Strategy

Praveen Sahai, VP Channels, India & SAARC is upbeat about EMC's 3 P channel strategy

EDITOR'S PICK

Why Flash Storage Will Rule: Analysts

Analysts say flash storage’s enviable speed and performance are stirring up a revolution in the Indian storage market, opening new opportunities for organizations. 

3 steps to digitizing your work for maximum productivity

From the earliest days as a marketing slogan, the elusive concept of the so-called paperless office may finally be taking shape, if anecdotal evidence is anything to go by. A growing number of small businesses and startups, unencumbered by legacy processes, are quietly ditching printouts for an all-digital ecosystem, buoyed by soaring BYOD ownership and growing familiarity with a plethora of cloud services.

Is the information security industry having a midlife crisis?

The information security industry is hot right now, but it's hot because it's failing. The daily announcements about breaches and lost data confirm that criminals are winning the security battle, but how can InfoSec reposition itself in order to win the war?

SLIDESHOWS

The State of the Internet

Akamai's Q1 2015 state of the internet report provides insights into key global statistics including connection speeds, broadband adoption (fixed and mobile networks), and IPv4 exhaustion and IPv6 implementation.

India Software Market on an Upswing

According to IDC, the Indian software market has witnessed consistent growth of 10 percent since the second half of 2014, showing signs of growth and revival. 

7 Jobs Technology Has Replaced

Albert Einstein said once that it has become appallingly obvious that our technology has exceeded our humanity. With every invention of technology some poor soul becomes vulnerable to losing his or her job in some corner of the world. Here are few jobs that will cease to exist soon.

Changing Fortunes of Top Tech Companies

The tech sector has been led by these companies for a long time. But how have they fared over the quarters?

India's Leading VADs

Why Channels Want to Partner With Inflow Technologies

Inflow Technologies’ tie up with 39 vendor companies, an extensive tech portfolio, and a services play, are great value propositions for enterprise channels, says its President and CEO, Byju Pillai.

iValue Creates Real Value for Channels in India

Focused on niche vendor alliances around data, network and app management backed by a robust channel ecosystem marked iValue's success in 2014. What clicked for the seven-year-old VAD?

RAH Infotech Shows Channels the Way Ahead

Mutual trust and long lasting bond with vendor companies and channel partners helps VADs to evolve and succeed in today’s aggressively competitive market. Leveraging competent channel partners and forge niche vendor alliances marks RAH Infotech’s success in 2014.

How Satcom Infotech is Adapting to New Security Landscape

As a leading value added distributor, Satcom Infotech is emerging as an end-to-end security player, helping both customers and partners grow.

How ComGuard Shields Channel Partners

As emerging technologies introduce new threats to the enterprise landscape, they are making channel partners anxious. But VADs like ComGuard are putting their worries to rest. Here's how.

Tech Chat

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa, Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

FAST TRACK

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.