I was scoping a third party when I asked the business owner whether there was any integration or connectivity with the vendor.
The answer was no.
The service was used to help create business documents, and the explanation was that files were shared with the vendor as needed.
There wasn’t anything inconsistent about that. No integration and file sharing can both be true.
But I wanted to know what was actually being shared.
So I asked how the vendor received the content it needed to perform the service. The files were provided through a secure upload.
That answered how the information got there. I still needed to know what was inside the files.
I asked to see examples because I didn’t want sensitive information being shared with the vendor without showing up in the assessment scope.
The samples included business information that required protection.
The original answer was still accurate. There was no system-to-system integration.
There was still a data flow.
Information was leaving the organization and reaching the third party because a person was moving it there.
That changed what I needed to assess. Once I knew protected information was being shared, I needed to understand how the vendor protected that information while receiving, using, and storing it.
The fact that there was no API, direct connection, or access into the customer’s environment didn’t change that.
I think integration questions can sometimes sound broader than they really are.
“Is there an integration?” tells me something about how the systems connect. It doesn’t necessarily tell me how information reaches the vendor.
A user might upload a file, send an export, enter information into a vendor application, or use another approved method. None of those necessarily looks like the technical connection people picture when they hear the word integration.
The path still matters.
In this assessment, I couldn’t see the customer’s connection records or systems myself. I had to work through the business owner and follow how the service was actually being used.
That’s why I look at the business workflow separately from whether the systems are technically connected.
If the third party needs information to provide the service, I want to know who sends it, how it gets there, and what is actually being shared.
Sometimes that confirms that no sensitive information leaves the organization. Other times, like it did here, following the workflow shows that protected information reaches the vendor even though no technical integration exists.
The secure upload itself wasn’t the issue.
What changed the assessment was understanding what was inside the files.
That’s also why I think it helps to record these as two different things. Whether systems are connected and whether information is being transferred to the vendor are related, but one doesn’t answer the other.
What would you need to establish before treating “no integration” as “no sensitive data in scope”?