A software provider has your client files. Your IT provider has administrator access. A billing vendor stores sensitive records. A former contractor still has a login.
Different companies. Same problem: each connection can become a path into your business.
For law firms, medical offices, accounting firms, and firms covered by the FTC Safeguards Rule, third-party risk is part of cybersecurity, not an administrative task to check off at renewal. A vendor can help you serve clients efficiently. But if it handles sensitive data or connects to your systems, its security practices can affect your confidentiality, operations, and compliance obligations.
The good news? You don’t have to avoid vendors. You need a disciplined process to select, contract with, and monitor them.
Your vendor’s security can become your business risk
One weak password. One compromised mailbox. One unpatched system. A trusted vendor can become the foothold an attacker uses to reach your organization.
That risk is easy to overlook because vendor relationships often start with a practical need: “We need a portal for clients,” or “The software company handles our backups.” Over time, access grows. A provider gets an account in Microsoft 365. A billing application stores client data. A support technician connects remotely to troubleshoot a workstation.
The vendor may be outside your office. The access is not outside your risk.
For a law firm, a breach involving an outside provider can put confidential client information at risk. A medical practice may have to respond if a vendor handling protected health information is compromised. An accounting firm may depend on third-party tools to access tax or financial records. If your firm is covered by the FTC Safeguards Rule, the Rule specifically addresses service providers: covered financial institutions must take reasonable steps to select and retain providers capable of safeguarding customer information, require safeguards by contract, and periodically assess them.
Your IT provider deserves particular scrutiny. It may have broad access to devices, email, identity systems, and backups. That access can strengthen your defenses, or magnify the impact of a security failure. If you’re evaluating managed IT for law firms or other regulated businesses, include the provider in your vendor risk process. Don’t assume that because it sells cybersecurity, its own controls require no review.
Start with what the vendor can access
“Which vendors do we use?” is a useful first question. It’s not the important one.
Ask what each provider can reach, what information it handles, and how essential it is to daily operations. A vendor that processes public website analytics doesn’t carry the same risk as one with administrator credentials or access to medical records.
Build a simple inventory with the vendor’s business owner, service, data involved, access level, subcontractors, contract renewal date, and most recent review. Then group vendors by risk. Prioritize those that handle sensitive information, connect to key systems, or would seriously disrupt the firm if unavailable.
A practical IT assessment can help uncover less obvious access, including old accounts and remote-support tools. It can also show whether endpoint security, email security, backups, and identity controls are managed consistently. Learn how an IT assessment can help identify technology gaps.
A practical vendor screening checklist
Before granting a provider access to sensitive data or systems, ask questions that match the risk. A small vendor may not have a polished compliance department. It should still be able to explain its safeguards clearly and provide reasonable evidence.
- What information do you collect, store, or access, and why? Ask where it is stored, how long it is retained, and how it is securely deleted when the service ends.
- How is access controlled? Ask whether MFA is required for all accounts, especially administrators and remote access; whether access is limited to what each person needs; and how access is removed when staff leave.
- How is data protected? Confirm encryption in transit and at rest, along with protections for laptops, servers, and other endpoints that may handle your information.
- How do you identify and respond to incidents? Ask about monitoring, incident response, backup and recovery, and how quickly the vendor will notify your firm if your data or access may be affected.
- Who else can access the data? Ask about subcontractors, where they operate, and whether they must meet equivalent security and confidentiality requirements.
- What can you show us? Depending on the vendor and risk, request relevant independent assessment reports, security certifications, insurance information, or a summary of recent testing and remediation. A report is evidence to review, not a substitute for considering whether the controls fit your needs.
A capable IT provider should be willing to discuss how it manages privileged access, monitoring, patching, endpoint security, and incident escalation in plain language. If answers are vague, or the provider treats basic security questions as an insult, pause before granting access.
Put security expectations in the contract
A handshake and a vendor’s website promise won’t spell out what happens when something goes wrong. Contracts should define what the vendor may do with your information, what safeguards it must maintain, and what it must do if there’s an incident.
Your agreement or security addendum should address:
- Permitted data use: Limit use of your information to providing the contracted service. Set clear confidentiality, retention, and deletion expectations.
- Required safeguards: Document expectations for MFA, encryption, access control, staff confidentiality, patching, and other controls appropriate to the vendor’s access.
- Incident notification: Require prompt notice, cooperation with your investigation, preservation of relevant evidence, and clear communication about the incident. Agree on a defined notification timeframe; don’t rely on informal assurances.
- Subcontractors: Require the vendor to identify relevant subcontractors and make sure appropriate security and confidentiality obligations flow down to them.
- Review and exit: Set expectations for providing security information, addressing material gaps, returning or deleting data, and supporting an orderly transition when the relationship ends.
If your firm is covered by the FTC Safeguards Rule, the written contract requirement for service providers is part of the Rule’s safeguards framework. Review the FTC’s Safeguards Rule guidance and the Rule’s text. Applicability depends on the firm and its activities; the Rule does not automatically apply to every law firm, medical practice, or accounting firm. Consult qualified counsel about your obligations.
Medical practices: confirm the BAA
If a vendor creates, receives, maintains, or transmits protected health information on behalf of a HIPAA covered entity, the practice generally needs a business associate agreement (BAA) before sharing that information. A BAA is not just a vendor’s general privacy policy. It documents permitted uses and required protections for PHI, including applicable safeguards, incident reporting, and obligations involving subcontractors.
Ask whether the vendor will sign a BAA and whether its actual service, and any subcontractors involved, can meet the agreement’s requirements. A signed document matters, but it does not replace checking that the vendor’s practices align with the risk. See HHS guidance on business associates. For legal questions about HIPAA compliance, consult qualified counsel.
Law firms and accounting firms: protect trust and confidentiality
For lawyers, using an outside service doesn’t make client confidentiality someone else’s responsibility. Consider what information a provider can access, how it stores and secures that information, and whether its service is appropriate for the sensitivity of the work. The American Bar Association’s discussion of securing client communications is a useful reminder that vendor choices belong in the broader conversation about protecting client information.
Accounting firms should likewise assess vendors that touch client financial or tax information. If your firm is covered by the FTC Safeguards Rule, make sure your vendor oversight supports your written security program and the Rule’s provider requirements. See the FTC’s Safeguards Rule guidance.
“Hey, Margaret! I’m sure the old file-sharing company is fine. We’ve used it for years.” Years of familiarity aren’t a security review. Put a named owner and review date next to every vendor that handles sensitive data.
Monitor vendors, and know when to move on
Security changes. Vendors change. A provider can be acceptable at onboarding and become a poor fit after a merger, major product change, new subcontractor, incident, or unexplained shift in service.
Set a review schedule based on risk, then revisit vendors when something material changes. Check whether access is still necessary, whether promised safeguards remain in place, and whether the provider is resolving issues. Your business IT support team can help coordinate that review across accounts, systems, and business owners.
Consider replacing a vendor when it repeatedly fails to meet agreed security terms, cannot explain how your data is protected, will not notify you promptly about incidents, or retains access and information after the relationship ends. Make the transition deliberate: revoke accounts and tokens, rotate shared credentials, retrieve your data, confirm deletion where appropriate, and identify a replacement before a critical service is cut off.
Final Word
Your vendors are part of your attack surface because their systems, people, and access can affect your firm. Screening them once and filing away a questionnaire is not enough. You need to know what they can reach, set clear expectations in writing, and revisit the relationship as your business and the vendor change.
Start with an inventory. Prioritize providers with sensitive data or elevated access. Then review their controls, contracts, and offboarding process, especially for your IT provider. An IT audit or IT assessment can help you identify gaps and establish a practical review plan.
That’s how you make vendor relationships a managed business decision, not an avoidable blind spot.
