The seven questions your security reviewer will ask about an offshore vendor

If you are evaluating an offshore engineering vendor and your own organisation carries a SOC 2 or ISO 27001 obligation, the security review is not a formality that happens after the commercial decision. It is the decision. We have watched engagements die at this stage that were agreed on price, scope and people, and the usual cause is a vendor who treated the questionnaire as an obstacle rather than as the actual product.

Your reviewer is also right to be difficult, which is worth saying plainly from the vendor side. Verizon's 2025 Data Breach Investigations Report, built on more than 22,000 incidents and 12,195 confirmed breaches, found third-party involvement in 30% of breaches — double the previous year. An earlier wave of Vanta's State of Trust survey found half of organisations had ended a vendor relationship over a security concern.

And the review is expensive for you before it is expensive for us. Vanta's 2025 survey of 3,500 leaders across five countries put the burden at nine working weeks a year on vendor security reviews alone, up from seven, with 61% saying they spend more time proving security than improving it. A vendor who makes that cheaper is doing something more valuable than a vendor who sends a logo.

The objection nobody writes down

Before the questions, the thing underneath them. The most honest statement of the case against offshore infrastructure work we have read came from a practitioner, not a vendor, and it runs roughly: legislation on data breaches and software security is killing our outsourcing contracts, operational work continues but production access no longer happens, and — the sharp end — consider what it means to give production access to someone earning a fraction of a local salary in a jurisdiction with different liability law.

That is not a quality objection and it cannot be answered with a testimonial. It is about incentive, jurisdiction and recourse, and any offshore vendor who pretends otherwise is not worth the review. The answer is not to argue with it. The answer is to make the access model so constrained that the question stops mattering, and to be the kind of counterparty that can be verified rather than trusted.

The seven questions

1. Does your certification scope cover the people who will touch my systems?

The most important question on the list and the one asked least often. ISO 27001 and SOC 2 are scoped, and a scope can be drawn narrowly enough to cover a corporate head office and exclude the delivery centre where the engineers actually sit. The badge is identical either way.

Ask for the scope statement, not the certificate. Read which entities, locations and functions are named in it. Then ask whether the engineers assigned to you fall inside it. A vendor who has nothing to hide will send the document; a vendor who sends the logo again has answered you.

2. What exactly can your engineers do in production?

A good answer is specific and boring: named individual accounts under your identity provider, not shared credentials; least privilege scoped to the systems in the agreement; multi-factor authentication; an audit trail you own; and, for most work, read-only access plus a change pipeline rather than a standing write credential.

A bad answer is an adjective. 'Secure access', 'strict controls', 'our engineers are trained' — none of these is a control. Shared credentials in particular should end the conversation: they make the audit trail worthless, which means nothing else in the review can be verified.

3. Will you sign as a subprocessor, and will my auditor accept you?

If the vendor sits inside your own SOC 2 or ISO scope, they become part of your attestation. Ask whether they will sign as a subprocessor, whether they will provide a bridge letter covering the gap between their audit period and yours, and who their auditor is. The auditor's name matters: your reviewer may have opinions about it, and a certificate from a firm nobody has heard of invites the question of how hard it was to obtain.

4. Where does my data physically sit, and what is the liability cap?

Two separate questions that get collapsed into one. Residency is factual: which country, which region, which provider account, and does anything leave it — including backups, logs and screenshots in a ticketing system. Liability is commercial: what the cap actually is in the contract if the vendor causes the breach, and whether it bears any relationship to what a breach would cost you.

Most liability caps in this market are set at some multiple of fees paid. It is worth knowing that number before you need it, because it is usually smaller than the incident it is meant to cover.

5. How fast are credentials revoked when one of your engineers leaves?

Offshore vendors carry higher attrition than in-house teams — that is a structural fact of the market, not a slur — which makes the offboarding clock more important here than almost anywhere else. Ask for the stated interval, ask who verifies it, and ask what evidence you get that it happened. 'Immediately' is not a process. 'Within four hours, verified against your IdP, with the revocation logged' is.

6. What background checks were done, and by whom?

Standard enough that the absence of a clear answer is the signal. Identity verification, employment history, criminal record check where the jurisdiction allows it, and whether checks are repeated or done once at hire.

7. If you disappear tomorrow, what does my team have?

The question with the worst industry answer, and it is really about lock-in rather than security. Who owns the infrastructure code, and is it in your repository and your state backend from day one rather than the vendor's? Are the runbooks and architecture diagrams current, or months out of date and quietly wrong? How many days of handover are included at no charge, and what is in them?

Ask this at the start of the engagement, not the end. Every answer is easy to arrange on day one and expensive to retrofit on the last day.

How to read the answers

Three patterns are worth more than the content of any individual response:

• Documents beat assertions. A scope statement, a bridge letter, a signed DPA and an access matrix are verifiable. A paragraph about taking security seriously is not.
• Specific beats reassuring. A vendor who tells you the liability cap is modest and the offboarding interval is four hours has told you something you can act on. A vendor who is comfortable everywhere has not been asked anything hard yet.
• Speed is itself evidence. A firm that can answer a questionnaire in days has done this before and has the artefacts ready. A firm that takes six weeks is writing them for the first time, on your engagement.

Our answers, and the honest limits

We hold ISO 27001 and SOC 2 Type II, access is granted under your identity provider with named individuals, multi-factor authentication and an audit trail, and most engagements run read-only plus a change pipeline rather than standing production write access. The security page sets out the controls and the documents we hand your reviewer by market, and it also publishes the registry facts for the contracting entity — company number, incorporation date, registered office — because a reviewer should be able to confirm the counterparty exists before spending a week on its controls.

The limits, stated rather than discovered later. We are an Indian company and your data processing happens under Indian law unless the engagement is structured otherwise; if your obligations forbid that, no control we describe fixes it and you should rule us out early. Our liability cap is a contractual number, not an insurance policy against your worst day. And if what your estate needs is a single accountable person who holds root and answers to your board, that is an in-house hire, not a vendor — we have said so on the build-versus-buy comparison and we will say it again on a call.

If you are mid-review and want the documents now rather than after a discovery call, send the questionnaire with the role brief. We would rather answer it in week one than in week six, and the answers do not change depending on how large the engagement is.

Sahil Dubey

Group Managing Director

Runs engineering and compliance across the group. Twenty years in infrastructure, most of it on the operations side of systems that were already in production when he inherited them.

• CISA
• AWS Solutions Architect – Professional
• Microsoft Certified: Azure Administrator Associate