FIELD

The field relates generally to information processing.

BACKGROUND

Questionnaires are often used by companies to assess the risk posed by third-party vendors and partners. In some cases, responses from third parties may contain highly sensitive information, particularly as the responses pertain to questions about sensitive topics, such as information security practices and/or financial information. In such cases, companies and third parties often enter into non-disclosure agreements (NDAs) to ensure that the third-party data is handled in prescribed ways by the company receiving the data. There is not a clear way, however, to translate the requirements of an NDA, including access control requirements, into requirements that are technically enforceable, verifiable, and auditable. NDAs may also be vague and leave certain requirements open to interpretation.

A need exists for a mechanism for specifying access control requirements for questionnaires and/or associated responses in such a way that an intermediate platform can interpret and enforce those requirements.

SUMMARY

In one embodiment, a method comprises obtaining a security policy for at least one question obtained from a user; monitoring one or more responses to the at least one question; and enforcing, by a third-party portal processing system, one or more access controls within the security policy for data associated with one or more of the at least one question and the one or more responses to the at least one question, wherein the one or more access controls comprise one or more restrictions with respect to one or more of a time duration to access the data and a number of people that may access the data.

In some embodiment, the exemplary method further comprises evaluating whether the time duration to access the data has expired before providing access to the data and/or whether the number of people that may access the data has been exceeded before providing access to the data.

In at least one embodiment, a client-side encryption of the data is performed by a provider of the data using a symmetric key pair to generate an encrypted version of the data. The third-party portal processing system stores the encrypted version of the data comprising an encrypted payload and an encrypted symmetric key.

Other illustrative embodiments include, without limitation, apparatus, systems, methods and computer program products comprising processor-readable storage media.

