As organizations shift their business models to take advantage of technology advances like mobile computing and cloud storage, they become more susceptible to the growing spectre of cyber-attacks. The Office of the Privacy Commissioner stated that privacy protection increasingly relies on cyber security implementation. This paper provides a framework to aid the process of identifying and working with competent IT service providers through explaining the fundamentals of developing an effective IT services agreement. The author focuses on three key aspects: understanding the client’s cyber-risk profile, due diligence of the service provider, and effective use of contractual provisions.

This paper is part of a collection presented at LESA’s 2016 Privacy Update program.