When a company brings in remote assistants through a provider, its security and procurement teams need to understand the risks. Remote staffing is different from buying software: the provider supplies people who will work inside your systems, often from another country. The questions are less about application security and more about people, access, devices, data handling and accountability.
This guide offers a structured approach to reviewing a remote staffing provider. It complements our existing article on vendor security questions for offshore staffing with a review process suited to larger organizations. For how ExecWing supports reviews, see security and procurement.
Start with a risk-tiering decision
Not every engagement needs the same depth of review. Tier the engagement by:
- Data sensitivity: will assistants access regulated data, such as health, financial, children's or government information, or only internal business data?
- System access: will they use email and calendars only, or core systems such as ERP, CRM, payments or production environments?
- Authority: can they move money, change records, or communicate externally on your behalf?
- Scale: how many assistants, across how many teams?
Higher tiers warrant deeper review, stronger contractual terms and more technical controls on your side.
Area 1: people and screening
Ask how the provider recruits, screens and onboards assistants:
- What background checks are performed, where permitted by local law, and how are results handled?
- How are identity and work history verified?
- What confidentiality and acceptable-use agreements do assistants sign?
- What security and privacy training do assistants receive, and how often?
- How are assistants supervised, and who do they report to on the provider side?
Look for clear, documented answers rather than general assurances.
Area 2: employment model and accountability
Understand the legal relationship between the provider and the assistants. Are assistants employees of the provider, of a local employer of record, or independent contractors? Who is responsible for local employment compliance? How does the provider enforce its policies? Benefits and employer-of-record arrangements may be optional add-ons in some models; ask how the arrangement works for your engagement.
Area 3: access control
Access is where most risk lives. Ask:
- Will assistants use accounts you provision through your identity system, or accounts the provider controls?
- Can every assistant have a named account with multi-factor authentication?
- How are shared credentials avoided or managed?
- How quickly can access be revoked, and who triggers it?
The strongest model is usually one where you provision and control accounts through your own identity provider, with single sign-on and multi-factor authentication, so you can see and revoke access directly. Our SSO and access provisioning guide explains the setup.
Area 4: devices and work environment
Ask what devices assistants use and how they are secured:
- Company-managed devices you ship, provider-managed devices, personal devices with a virtual desktop, or another model?
- What endpoint protections, disk encryption and update policies apply?
- What are the expectations for the physical workspace, such as privacy and no shared screens?
Our guide to managed devices versus BYOD with virtual desktops compares the options.
Area 5: data handling
Ask how the provider ensures data stays in your systems:
- Are assistants prohibited from downloading or storing your data outside your systems?
- What tools does the provider itself use that might touch your data, such as time tracking, screenshots or communication tools?
- How are data subject requests and privacy obligations supported?
- What data processing terms does the provider offer?
Be especially careful with monitoring tools that capture screenshots, since they may capture your data in the provider's systems.
Area 6: incident response
Ask how the provider handles security incidents:
- How are assistants trained to recognize and report incidents, including phishing?
- How quickly will the provider notify you, and through what channel?
- Who coordinates with your security team?
- What happens to an assistant's access during an investigation?
Agree notification expectations in writing. See our incident response guide for remote assistants.
Area 7: subcontractors and locations
Ask whether the provider uses subcontractors or local partners, in which countries assistants are located and whether locations can change without notice. Location matters for data protection laws, export controls and some contractual commitments you may have to your own customers.
Area 8: continuity and replacement
Ask how the provider handles absences, resignations and performance issues. What is the process for coverage during planned leave? How are replacements recruited and onboarded? How is knowledge preserved, for example through documented procedures in your systems?
Area 9: certifications and evidence
Ask what independent evidence exists. Some providers have SOC 2 reports or ISO 27001 certification; many smaller providers do not. Absence of a certification is not automatically disqualifying for lower-tier engagements, but it means you rely more on documentation, contractual commitments and your own controls. Be wary of vague claims; ask for the actual report or certificate and its scope. ExecWing does not currently hold a SOC 2 report or ISO certification. We say so plainly and support reviews with documentation.
Running the review efficiently
Reviews stall when questions go back and forth by email for weeks. A more efficient approach:
- Share your tiering decision and questionnaire early, along with the specific systems and data involved, so the provider can answer precisely.
- Hold a working session with the provider's security contact, your security reviewer and the business owner to walk through answers and clarify gaps.
- Agree a controls matrix like the one below, assigning each control to an owner.
- Document exceptions with the business owner's acceptance, rather than leaving them unresolved.
- Set a review date for the next reassessment.
The business owner should attend the working session. Many risk decisions depend on how the assistants will actually work, and the business owner is best placed to explain or adjust the scope.
Questions that reveal maturity
Some questions are especially useful for distinguishing a mature provider from one offering general assurances:
- "Walk us through what happens on the day an assistant resigns."
- "Show us the security training content an assistant completes."
- "Describe the last security incident or near miss you handled and what changed afterward."
- "Which of your internal tools could ever contain our data?"
- "Who on your side would we call at night if we suspected a compromised account?"
Specific, candid answers are a better signal than polished documents.
Turning answers into controls
A review should end with a clear set of controls, split between what the provider commits to and what you implement:
| Control | Typically owned by |
|---|---|
| Screening and agreements | Provider |
| Security training | Provider, supplemented by your training |
| Named accounts, SSO, MFA | You |
| Least-privilege access | You |
| Device management | You or provider, per agreed model |
| Data handling rules | Both, documented |
| Incident notification | Provider, with your process |
| Offboarding and access revocation | You, triggered by either party |
| Periodic access reviews | You, with provider input |
Ongoing assurance after onboarding
A vendor review is a snapshot. Ongoing assurance keeps it accurate:
- Quarterly access reviews of every assistant account, confirming each still matches the role.
- Annual reassessment of the provider, or sooner if scope, locations or data sensitivity change.
- Change notifications from the provider about subcontractors, locations or material control changes.
- Incident and near-miss reporting reviewed together in regular account meetings.
Build these into the operating rhythm with the provider's account lead so they happen routinely. See reporting and QBRs for how reviews fit into regular governance.
Common review mistakes
Treating it like a software review. Focus on people, access and devices.
Relying on provider-controlled accounts. You lose visibility and control.
Ignoring monitoring tools. They can move your data into third-party systems.
One-time review only. Revisit annually and when scope changes.
Frequently asked questions
Will ExecWing complete our security questionnaire?
Yes. We complete questionnaires accurately and join review calls. See vendor onboarding.
Does ExecWing have a SOC 2 report?
Not currently. SOC 2 is on our roadmap. We describe our current controls honestly.
Can we require assistants to use our devices?
Yes. Many enterprise clients provide managed devices or virtual desktops.
Can we review contracts before a pilot?
Yes. Our MSA and data processing terms are available on request.
Want a dedicated assistant who already knows this playbook?
ExecWing places dedicated, managed assistants from the Philippines, Mexico and Colombia with US leaders, on a schedule customized to your needs and budget. Month-to-month, quoted per role. See pricing or how it works.
Book a 20-minute fit call