The Vendor You Trust With Your Data Is Half Your Risk

“Half your risk” is a reminder, not a mathematical split. Your business may depend on outside companies to store information, manage accounts, process payments, or keep essential systems running. If one of those vendors has a security incident, the impact can reach your customers and operations even if your own network was not breached.

So, are you responsible if a vendor you pay is breached? You cannot assume that responsibility transfers just because your data is stored somewhere else. Depending on the information, applicable rules, and your contracts, your business may still need to assess the incident, respond to customers, and meet notification obligations. The vendor may also have duties. The practical point is to know what the vendor can access and what happens if something goes wrong.

For small and mid-sized businesses in Berks County, Reading, Wyomissing, Lancaster, and surrounding PA communities, vendor risk management does not need to become a lengthy procurement exercise. A clear inventory, a few direct questions, and regular follow-up are a useful starting point.

Identify: Who can reach your systems or data?

Start by listing outside organizations that store information, access your systems, or support important business processes. Include more than the obvious technology providers. Your list might include:

• Payroll, bookkeeping, accounting, and benefits providers
• Your managed IT or cybersecurity provider
• Cloud platforms, software vendors, and data-hosting companies
• Payment processors, banks, and financial services
• Industry suppliers, consultants, and other partners with account access

For each one, record what service it provides, what data it handles, who in your business owns the relationship, and what access it has. Note whether it can log in to your network or administer accounts, too. A vendor that only receives a monthly invoice has a different risk profile from one that can reset employee passwords or access customer records.

This inventory gives you a practical view of where your information goes and which vendors could interrupt operations. It also helps reveal overlooked dependencies, such as a supplier’s online ordering portal or a small software tool connected to shared files.

Quantify: Understand the potential impact

The risk is not just theoretical. In its 2026 Data Breach Investigations Report, published May 19, 2026, Verizon reported that breaches involving a third party accounted for 48% of all breaches, a 60% increase year over year.

Coalition’s 2026 Cyber Claims Report, published March 5, 2026, highlights a financial risk that can involve both vendors and everyday business processes. Business email compromise (BEC) and funds transfer fraud together accounted for 58% of cyber incidents in the report. The average BEC loss was $27,000. Among funds transfer fraud claims, 52% originated as BEC, and those claims averaged $112,000 in losses. The overall average claim loss was $116,000.

These are national and industry-wide figures, not measurements of Reading, Wyomissing, Lancaster, or any individual PA business. They are useful indicators of the kinds of losses businesses are seeing, not a forecast of what a particular company will lose.

They also show why vendor risk is a business issue, not just an IT concern. A compromised email account or fraudulent payment request can affect cash flow, disrupt work, and require time and resources to investigate. The possible consequences vary, but an incident can lead to recovery costs, customer concerns, delayed operations, and difficult decisions under pressure.

Mitigate: Ask a short list of direct questions

You do not need to audit every vendor like a large enterprise. Start with the providers that handle sensitive information, have access to important systems, or would be difficult to replace. Ask:

1. Who holds our data, and what kind do you hold? Ask whether information is stored by the vendor or its subcontractors, and whether it includes customer, employee, financial, or confidential business data.
2. What access do you have? Find out whether the vendor can log in to your systems, administer accounts, or access shared files. Confirm that access is limited to what the service requires.
3. Is multifactor authentication enabled? Ask whether MFA is required for vendor accounts, especially accounts with administrative privileges.
4. What happens if you suspect a breach? Check the contract for breach notification terms, including how quickly the vendor must contact you and how it will support your response.
5. Who do we call? Keep a current contact for urgent security matters, not only a general support address or account representative.

Keep the answers with the vendor record. If a provider cannot answer a basic question, that does not automatically mean you must end the relationship. It does mean you should understand the gap and decide whether to limit access, request improvements, or consider alternatives.

Use a verify-then-act habit when someone claiming to be a vendor or IT provider asks for access, a password reset, or a payment change. Attackers impersonate support staff and service providers. End the conversation, then call back using a number you already know or have independently verified. Do not rely on a number, link, or contact detail supplied in an unexpected message.

Monitor: Revisit the relationship, not just the paperwork

Vendor risk changes. A provider may add subcontractors, change its service, or experience a breach. Your own business may also give the vendor new access or begin sharing more sensitive data.

Review your vendor list at least annually. For critical providers, check in sooner when there is a security notice, a major service change, or a change in the information or access involved. Keep vendor breach notices and contact details somewhere your response team can find them quickly. If a vendor reports an incident, ask what happened, what information or systems may be affected, what has been contained, and what steps it recommends for your business.

Also plan for the possibility that you need to leave. Ask how you would retrieve your data, how long an export would take, what format it would be in, and whether the vendor will confirm deletion after the relationship ends. A workable exit plan reduces the chance that a vendor problem becomes a prolonged business interruption.

B&R Computers approaches cyber risk by helping businesses identify exposure, quantify potential impact, mitigate practical weaknesses, and monitor changes over time. For more guidance, visit the B&R Computers Resources hub or join the General Cyber Briefing.

Your business may not control a vendor’s entire security program, but you can make informed choices about the access and information you share. If you want help reviewing your vendor exposure and deciding what to address first, schedule a Business Review or Strategy Session with B&R Computers.