The true cost of an offshore accountant, line by line
Headline rates are not costs. Here is every line that belongs in the comparison, including the four that proposals usually leave out.
A certification report tells you that controls were tested. It does not tell you which controls, over which systems, or whether your data sits inside the scope. Start there.
On scope and evidence
Ask for the report itself, not the badge. Check the scope section covers the delivery location your work will sit in. Check the exceptions section, because every real report has some. A report with no exceptions deserves more scrutiny, not less.
On the physical environment
Is the delivery floor access controlled and segregated by client? Are personal devices permitted on the floor? Is there camera coverage with a documented retention period? Can your team visit unannounced?
On the technical environment
Is local storage disabled? Are removable media and printing blocked? Is clipboard transfer out of the virtual desktop disabled? Are sessions logged, and can your own IT team access those logs directly?
On people
What background checks are run, and how often are they refreshed? What happens to access, and within what window, after someone resigns? Is security training annual, and can you see completion records for the specific people on your account?
On accountability
What liability cover is carried, and what is the per incident limit? What is the contractual breach notification window? Will the provider accept your own audit, and is that right written into the agreement?
A provider that answers all of these without hedging is rare. A provider that gets defensive early has told you what you needed to know.
G
All insights
Globex
Globex · Security