Before hiring a nearshore accounting provider, confirm six things: who can access each system and client file, how remote team members are covered by your Written Information Security Plan (WISP), which device and connection controls apply, when confidentiality agreements are signed, how permissions are reviewed, and what security documentation the provider can share.
Use this checklist during vendor evaluation, while there is still time to resolve unclear answers. For a broader view of the safeguards involved, see how South Offices handles cybersecurity across nearshore engagements.
Will each team member receive access only to the systems and client files their role requires? Confirm who approves that access before work begins.
Does your firm's WISP account for remote and nearshore team members? Confirm how the provider will follow the relevant procedures.
Ask what device requirements, multifactor authentication, and secure connection controls apply before someone can access client data.
Confirm that a confidentiality agreement is signed before the team member begins work or receives access to systems and client information.
Determine when permissions are reviewed, changed, and removed, especially after a role change or departure.
Ask whether the provider can share its written security procedures, incident escalation process, and responsibility framework before access begins.
Security expectations are easier to clarify while comparing providers than after access has been granted. Ask for procedures and supporting documentation, then agree on who owns each step. A verbal assurance cannot tell your firm how access will be approved, reviewed, or revoked.
Tell us about your current process, and we'll walk through the questions to confirm.
