Due Diligence and Ongoing Monitoring

Hello! Wondering if anyone has ever run into a "vendor" they provide information to that is compiled as well from other companies, anonymized and then shared with all those companies in return, for a fee. Sort of like an industry case study or industry research and knowledge share.  We will be providing confidential company strategy information, no PII or customer data just company strategic plan/internal use only information, that the vendor will then compile, anonymize and provide to us along with other similar industry companies that shared the same information. How or what sort of due diligence would you complete in this situation? Our typical information security and operational risk questions don't necessarily seem to fit this scenario. How have or how would you do due diligence review for this type of engagement? 

Hi,

When faced with unique situations like this, it's best to rely on your standardized inherent risk assessment. By methodically answering the questions in your inherent risk assessment, you should be able to determine the specific types and amounts of risks present. This information will help you determine the scope of your due diligence.

I would also advise caution even if these folks promise anonymization of your organization. If the study involves direct competitors, there is a good chance that you - or they - may be able to identify each other due to employees who have left for or come from other organizations, industry gossip, or other identifiers. Additionally, if your organization is not comparable in size to the other participants in the study, it might be fairly easy to identify each other. Even if those risks are minimal, I would still strongly recommend ironclad non-disclosure agreements that have been reviewed by your legal team. Also, ensure that there is a demonstrable benefit for your organization before sharing any information; while benchmarking is great, you may not want to risk revealing your organization's strategic plans.  I hope that helps, and I would love to hear other members weigh in.

Hello! Wondering if anyone has ever run into a "vendor" they provide information to that is compiled as well from other companies, anonymized and then shared with all those companies in return, for a fee. Sort of like an industry case study or industry research and knowledge share.  We will be providing confidential company strategy information, no PII or customer data just company strategic plan/internal use only information, that the vendor will then compile, anonymize and provide to us along with other similar industry companies that shared the same information. How or what sort of due diligence would you complete in this situation? Our typical information security and operational risk questions don't necessarily seem to fit this scenario. How have or how would you do due diligence review for this type of engagement? 

Hi,

When faced with unique situations like this, it's best to rely on your standardized inherent risk assessment. By methodically answering the questions in your inherent risk assessment, you should be able to determine the specific types and amounts of risks present. This information will help you determine the scope of your due diligence.

I would also advise caution even if these folks promise anonymization of your organization. If the study involves direct competitors, there is a good chance that you - or they - may be able to identify each other due to employees who have left for or come from other organizations, industry gossip, or other identifiers. Additionally, if your organization is not comparable in size to the other participants in the study, it might be fairly easy to identify each other. Even if those risks are minimal, I would still strongly recommend ironclad non-disclosure agreements that have been reviewed by your legal team. Also, ensure that there is a demonstrable benefit for your organization before sharing any information; while benchmarking is great, you may not want to risk revealing your organization's strategic plans.  I hope that helps, and I would love to hear other members weigh in.

Hello! Wondering if anyone has ever run into a "vendor" they provide information to that is compiled as well from other companies, anonymized and then shared with all those companies in return, for a fee. Sort of like an industry case study or industry research and knowledge share.  We will be providing confidential company strategy information, no PII or customer data just company strategic plan/internal use only information, that the vendor will then compile, anonymize and provide to us along with other similar industry companies that shared the same information. How or what sort of due diligence would you complete in this situation? Our typical information security and operational risk questions don't necessarily seem to fit this scenario. How have or how would you do due diligence review for this type of engagement?