12 Security Questions to Ask an Offshore Staffing Provider

Part of our guide: How do you keep data secure with offshore staff?

Before you give an offshore provider's staff access to your systems, ask these questions and get written answers. They're part of our guide to data security with offshore staff.

Access and accounts

1. Will each assistant use a named account in our systems, with MFA? The answer should be yes, with no shared logins.
2. Do you ever ask for our admin or banking passwords? It should be no.
3. How do you track which assistant has access to what? Look for an access register per client.

People

1. What background checks do you run? In the Philippines, the NBI clearance is common; ask what else is checked and with what consent.
2. Do staff sign confidentiality agreements that cover our data?
3. What security training do staff complete, and how often?

Devices and work setup

1. What are the minimum device requirements (supported OS, updates, encryption, screen lock)?
2. How do you handle internet and power outages? Ask about backup connections and power.

Law and compliance

1. Which privacy laws apply to you? Philippine providers fall under the Data Privacy Act of 2012 (RA 10173), overseen by the National Privacy Commission. See our guide to the Philippine Data Privacy Act.
2. For health data: will you sign a Business Associate Agreement? Required before any access to protected health information.

Incidents and exit

1. How quickly will you tell us about an incident, and who tells us?
2. What happens on the last day? Look for a written offboarding checklist and same-day access removal.

Our own answers are on our security page and trust center.