Outsourcing means sharing access to systems and data, so security deserves real questions, not a reassuring sentence on a website. A good partner welcomes the scrutiny and has clear answers ready, because they have been asked before. A partner who bristles, or answers every question with the name of a certificate, is telling you something too.
This is the checklist we would want a buyer to bring to us. It is organised by topic, with what to ask, what a good answer sounds like, and what should worry you. It describes controls, not credentials: the point is to confirm how the work is actually protected, not which logos appear on the proposal.
Access and permissions
Ask how access to your systems is granted, reviewed and revoked. The good answer describes role-based permissions: each agent gets the access their role needs and nothing more, with the principle of least privilege applied when the account is created rather than after something goes wrong. It describes a periodic review, where someone checks that the people with access still need it. And it describes offboarding: when an agent leaves the programme or the company, their access is removed the same day, and someone confirms it.
Ask who on the provider's side can see your customer data, and whether administrative access to your systems ever sits with the provider. It usually should not. You own the systems; the provider's agents work inside them with the permissions you set.
Ask about shared accounts. The answer should be that there are none. A shared login means no audit trail, and no audit trail means no way to answer the incident question further down this list.
Ask what is logged. Every login, every record viewed, every export. The provider should be able to tell you who looked at a given customer record and when, and so should you, because most of the logging lives in your systems rather than theirs. If neither side can answer that, the access controls are a promise rather than a mechanism.
Devices and the working environment
Ask where the work is done and on what. The good answer is managed machines with disk encryption, endpoint protection, automatic updates, and a policy on what can be installed. Ask whether agents can copy data off the system: USB ports, personal email, screenshots, printing. Each of those is a channel, and each should be either blocked or logged.
Ask how remote agents are handled if the provider uses them. The controls should be the same as in the centre: managed device, secured connection, no local storage of customer data. A provider that has a clear answer for the office and a vague one for home working has a gap.
Ask about clean desk and screen rules on the floor. For payment card work, for example, agents should not have paper or personal phones at the workstation. The rule sounds small. It is the kind of detail that shows whether the security programme reaches the desk or stops at the policy document.
People
Ask what screening is done before an agent is placed on your programme, and confirm it is appropriate to the data they will handle. Ask about confidentiality agreements: every agent should have signed one, and the provider should be able to show you the template. Ask about security training: what is covered, how often it is repeated, and how the provider knows it landed.
Ask what happens when an agent breaks a rule. The answer should be a defined process, not a shrug. Security is a habit before it is a technology, and habits are set by consequences.
Ask how the team on your programme is supervised day to day. A team leader on the floor who knows the agents, sees the screens and hears the calls is a control in their own right. So is a stable team: agents who have worked on your programme for a long time know your customers and your rules, and the provider should be able to tell you how they keep the team together.
How your data moves and where it lives
Ask what data the provider needs to do the work, and push back on anything beyond that. Minimum necessary is a good principle in every industry, not only the ones where a regulator requires it. Ask how data is transmitted between your systems and theirs, and confirm it is encrypted in transit. Ask whether any of your data is stored on the provider's side at all, and if so, where, for how long, and how it is deleted at the end of the engagement.
Ask about subcontractors. If any part of the work is passed to a third party, you need to know, and the same controls need to apply. Ask about the location of the work and whether your data crosses a border, because that determines which rules apply to it.
Ask about call recordings and chat transcripts specifically. They contain everything a customer said, including things they should not have said. Retention, access and redaction of recordings deserve their own answer.
Incidents: the answer that tells you the most
Ask what happens in the first hour if your data is exposed. A clear, practised answer tells you more than any certificate on a page. You are listening for how the incident is detected, who is told and in what order, how quickly you are notified, what containment looks like, and who is accountable for the communication.
Ask whether the provider has had an incident before and how it was handled. A provider that says never has either been fortunate or is not counting. One that describes an incident, what was learned and what changed is a provider you can trust with the next one.
Ask to see the incident response plan. It does not need to be long. It needs to have names in it.
Security is not a feature you buy once. It is a habit you verify.
Compliance where it applies
If you operate under a specific framework, the provider needs to support your obligations, and you need to be specific about what that means. Three come up most often.
If the work involves protected health information, the provider handling it signs a Business Associate Agreement and applies the minimum necessary standard. Ask for the agreement, ask how patient data is limited to what the task requires, and read how HIPAA applies to outsourced patient calls before the conversation.
If agents take card payments, PCI DSS governs how cardholder data is handled. Ask how card data is kept out of recordings, out of chat logs and off the agent's screen where possible, and how scope is limited so that your whole operation is not pulled into it. Taking payments over the phone under PCI explains what to look for.
If you serve EU residents, GDPR applies to their personal data, and the specifics belong with your counsel. Ask the provider what role they take in your data processing arrangements and what documentation they can provide. GDPR and outsourced customer support covers the questions in more depth.
In every case, the framework should map to your requirements. A provider who offers the same generic checklist to a clinic and a clothing retailer has not thought carefully about either.
How to read the answers
Three patterns are worth watching for.
Answers that name a certificate instead of describing a control. A certificate is evidence that a control existed at the point of audit. It is not a substitute for the provider being able to explain the control to you today.
Answers that describe policy but not practice. Ask for the example: the last access review, the last offboarding, the last training session. A provider who lives the policy will have the example to hand.
Answers that are all the same. If every question gets the same reassuring paragraph, the person answering does not know, and you should ask to speak to someone who does.
The right partner will have answers, and will have questions of their own about how you manage access on your side. Security is shared. The controls you set on your systems, the permissions you grant, and the way you act on the provider's reports are half of the picture. Our own approach is built on controlled access, confidentiality practices and role-based workflows agreed with each client, and we would rather have this conversation before launch than after.
A short list to bring to the call
Take the list, take notes, and compare providers on the substance of the answers rather than the confidence of the delivery.
- How access is granted, reviewed and revoked, and how fast offboarding happens
- Whether any accounts are shared
- What devices are used and what can be copied off them
- What screening, agreements and training every agent completes
- What data is held on the provider's side, where, and for how long
- Whether subcontractors are used and where the work is done
- What happens in the first hour of an incident, with names
- Which framework-specific documents they can provide for your industry