In 2009, there were 498 reported breaches involving over 222 million records.   And, of these 498 incidents, only six firms reported that they had deployed encryption or another strong security to  protect the exposed data.   This is not surprising given that most notification laws provide a safe harbor for encrypted data.  In other words, there would not have been a need to report. 

As well, of the reported records impacted by the breaches, 59% could be attributed to the conduct of independent contractors.  Last year, over 45% of all breached records – 16 million – were compromised by the actions of independent contractors. In fact, the Ponemon Institute reports that 29% of all breaches are caused by third-party negligence.   As the year progresses and budgets continue to be squeezed, the due diligence that was once used to vet vendors will unfortunately slip a bit. And, when vendor engagements start favoring pricing over controls, the resulting increase in vendor data loss may prove staggering.

Improving independent contractor due diligence by employing only those small business vendors with sound data protection practices in place will go a long way in improving your risk profile.  Moreover,  in addition to being a sound way to better protect sensitive data, encryption deployment has the added benefit of protecting you from notification laws and resulting lawsuits.  The public notices speak for themselves.