This article was prompted by a recent phone conversation I had with an executive at a large chain of medical facilities, as well as the recent data breach at MyDr.

Our discussion touched upon, among other things, the security of systems and data. At one point, the other party presented an argument—paraphrased—that since the facilities use a solution provided by an external company, the responsibility for security lies primarily with that provider, and the facility itself is no longer liable for the data entrusted to them. This is a convenient assumption, yet it is both highly dangerous and fundamentally flawed.

This is one of the most dangerous myths about SaaS, cloud computing, and hosting.

Following the security incident that has recently garnered so much attention, everyone is asking, "How could this have happened?" In my view, we should also be asking whether organizations that entrust data to external providers truly know who they are dealing with, what risks are involved, and what security measures—both technological and organizational—their provider has in place.

Keep in mind that if your company utilizes IT services from third parties, YOU—as the owner—remain the data controller. The providers or service vendors you engage are merely entities to whom you have entrusted the processing of that data.

Under the law - including the GDPR - a data controller is required to use processors that provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures. Simply signing a data processing agreement is not enough; it does not absolve you of your responsibility toward the supervisory authority. A company should conduct a risk analysis and assess its impact on the organization's operations and data security.

If an organization does not know:
- where its data is actually located,
- who has access to it,
- which subcontractors the provider uses,
- what authentication and access control mechanisms are in place within the system,
- how data encryption is implemented,
- how quickly security patches are applied,
- how event monitoring and incident response are handled,
- how long backups are retained,
- when and how data is deleted,
- where the data will go upon the termination of the contract,
- whether the provider is subject to regular audits,
then it is difficult to speak of informed risk management.

When selecting a provider, the primary question companies ask is, "How much will it cost?"

However, questions are rarely asked about:
- the solution's architecture,
- the access model,
- vulnerability management,
- backups,
- business continuity,
- incident handling,
- subcontractors,
- data location,
- transfers outside the EEA,
- the ability to conduct inspections and audits.

Another common mistake—even when a company does take an interest in risk analysis—is that it is performed only once, saved in a DOCX or XLSX file, and then set aside and forgotten by everyone. It’s as if it didn’t exist at all!

The world is changing; cyber threats are evolving, new ones emerge daily, and the methods used by hackers are constantly shifting. Furthermore, staff turnover occurs, and IT systems undergo changes. Beyond the requirements mandated by specific laws and standards, this necessitates—among other things—conducting regular training (at least once a year) to raise awareness about cyber threats.

Additionally, regulations such as the NIS2 Directive (which covers sectors including healthcare), the GDPR, and the ISO 27001 standard require organizations not only to have certain procedures and registers in place but also to keep them updated and analyze them.

These include:
- Register of processing activities
- Register of suppliers and processors
- Risk analysis
- Data protection impact assessments (DPIA)
- Incident register
- Register of GDPR-related requests
- Register of access rights and regular access reviews
- Data retention and deletion policy
- Backup, recovery, and business continuity procedures
- Vulnerability and patch management procedures

Above all, these documents must be "living" and accurately reflect the actual state of affairs. They cannot simply be generic document packages or templates purchased from an online store!

It should also be noted that the NIS2 Directive imposes personal liability on members of the management board or company owners (depending on the business structure). This means that, as CEO/Owner, you are personally liable—with all your assets—for any consequences resulting from a failure to meet the applicable legal, organizational, and technical requirements.

Therefore, conduct an assessment of your company’s cybersecurity posture today.

In collaboration with the law firm of attorney Anna Tumas, we provide internal audit and consulting services regarding cybersecurity, as well as compliance with GDPR and the NIS2 Directive/the Polish National Cybersecurity System Act (KSC).

We combine technical, organizational, and legal perspectives—covering everything from risk analysis and vendor vetting to architecture and security reviews, documentation, procedures, contracts, regulatory obligations, and preparing your organization for an audit or inspection.

The goal of such an audit is not simply to produce another binder full of documents. Rather, it is to tangibly enhance the security of processed data and mitigate the risks associated with non-compliance with legal requirements and current IT best practices.

After all, you cannot outsource responsibility for security with just a single signature on a SaaS agreement!