Cyber Security

Cloud software now runs accounting, payroll, document storage, customer management, and communication for businesses of every size. That convenience moves your data onto someone else’s systems, but it does not move your responsibility for it. Regulators in the US, EU, and UK expect organisations to oversee their vendors, and clients expect the same. A provider’s breach can trigger notification duties, fines, and lost trust even if the attack never touched your own network. This guide breaks down the exact steps to assess your cloud providers so you can protect your data and scale your success without the stress. Key Takeaways Here is a quick look at the main things you will learn in this guide: Why you stay accountable for data held by cloud vendors, and which US, EU, and UK expectations apply How to sort vendors by risk so your effort goes where it matters most How to read SOC 2, ISO 27001, and other assurance reports beyond the headline Which security questions, contract terms, and red flags to look for before you sign How to keep monitoring vendors after onboarding Table of Contents Why Cloud Vendor Security Is Your Security Know the Regulatory Expectations Classify Vendors by Risk Review Independent Assurance Reports Ask the Right Security Questions Verify Claims, Do Not Just Trust Them Build Security Into the Contract Monitor Vendors Continuously Red Flags to Watch For Your Vendor Assessment Checklist Conclusion FAQs Why Cloud Vendor Security Is Your Security Cloud security works on a shared responsibility model. The provider secures its infrastructure and application, while you control who accesses your account, how it is configured, and what data you put in it. If a vendor is compromised, though, it is usually your clients, employees, and customers whose information is exposed, and it is you who must explain what happened. That is why regulators and auditors focus on vendor oversight. Being the data owner or controller means you remain accountable for the choices you make about who processes your data. Weak vendor checks are also one of the easiest gaps for an attacker to exploit, because a single provider can give access to hundreds of customers at once. A structured assessment process reduces that risk and gives you evidence that you exercised reasonable care. Know the Regulatory Expectations Requirements depend on where you operate and what data you hold. Confirm the current position with the relevant authority or a qualified adviser before relying on any point below. United States Tax and accounting professionals are treated as financial institutions under the FTC Safeguards Rule, which requires them to select capable service providers, require safeguards by contract, and periodically assess them. IRS guidance, such as Publication 4557 on safeguarding taxpayer data and the written information security plan template in Publication 5708, points in the same direction. Public companies must describe how they manage material cyber risks, including risks from third-party service providers, in their SEC filings. State law adds another layer. All 50 states have data breach notification laws, and some go further. California’s privacy law requires specific contract terms with service providers, Massachusetts requires reasonable steps to select and retain capable service providers, and New York’s financial services cybersecurity regulation requires a third-party service provider security policy for covered entities. Sector rules such as HIPAA business associate agreements and PCI DSS can also apply. European Union Under the GDPR, controllers must use processors that provide sufficient guarantees (Article 28), apply appropriate security (Article 32), and notify the supervisory authority of breaches within 72 hours of becoming aware (Article 33). Processors must tell you about a breach without undue delay. Fines can reach EUR 10 million or 2% of worldwide turnover for security and processor failures, and EUR 20 million or 4% for the most serious violations, such as unlawful data transfers. Two more EU rules matter for many organisations. The NIS2 Directive requires in-scope entities to manage supply chain security, though national implementation varies. The Digital Operational Resilience Act (DORA), which has applied since January 2025, sets detailed ICT third-party risk and contract requirements for financial entities. If your vendor is based in the US, check the transfer mechanism. The EU-US Data Privacy Framework is currently valid, but an appeal is pending at the EU Court of Justice, so confirm that your vendor also offers Standard Contractual Clauses as a fallback. United Kingdom UK GDPR and the Data Protection Act 2018 mirror the EU’s supplier and security duties, with fines of up to GBP 8.7 million or 2% of turnover for security failures, and GBP 17.5 million or 4% for the most serious breaches. The National Cyber Security Centre publishes 14 Cloud Security Principles that many organisations use as an assessment framework, and Cyber Essentials certification is a useful baseline signal. Software that connects to HMRC’s systems must also meet HMRC’s requirements, such as fraud prevention headers. Classify Vendors by Risk You cannot review every vendor in depth, so tier them by the damage a failure would cause. Consider five factors: the sensitivity of the data, the level of access or integration, how critical the service is to daily operations, your regulatory exposure, and how hard the vendor would be to replace. Then apply proportionate effort: Tier 1, critical: Vendors that hold client, payroll, tax, financial, or health data, or whose outage would stop core operations. Examples include accounting, payroll, tax, and document management platforms. These get full due diligence and annual reviews. Tier 2, moderate: Vendors that hold limited business data or connect to your systems in a restricted way. These get a shorter questionnaire and a review of their assurance report. Tier 3, low: Vendors with no sensitive data and easy replacement, such as a scheduling app. These get a basic check of security settings and terms. Keep a central register of all vendors with their tier, data types, owners, and renewal dates. It is the foundation for every later step. Review Independent Assurance Reports Independent reports show what a vendor has actually been tested against. […]