Talk to them about what theyre doing on an ongoing basis. If you do actually go forward and engage with them, you do want to be able to have transparency into what's happening on a day-to-day basis. If they're doing, for example, security monitoring of your infrastructure, you'll probably want to see daily reports of what they're viewing, see if there are false positives, false negatives coming out, possibly even have remote admin access to get into the systems if you need to change something or assess something that's going on.

If you're doing an outsource of software development, for example, which is very popular, then what you'd probably want to do is have access into wherever they're checking the code in and out, so you could have one of your own external auditors do source code reviews on that code as it's being written so that you have an idea of what that code looks like and how the development process is moving forward. So it will depend, based on what you specifically outsource, the kind of monitoring you want to do, but definitely transparency and monitoring on an ongoing basis and keeping that communication open with the outsourcer so that you have an idea. Because it's your data, you do want to keep transparency and monitor it.

CSOonline.com: What about the importance of checking the background of the outsourcing vendor's personnel?

Kelley: Understanding what kind of background checks the personnel at your vendor go through is critical. You want to know, for example, if they check to see if there's any criminal background. If they're going to have any data about your company that's sensitive, you want to have an idea if this person has been put in jail for stealing data before or for selling credit card information, for example.

So what do they do about that background check, and how do they make sure? And how do they monitor those employees every day to make sure that they're not necessarily walking off with a good portion of your business on a USB stick?

CSOonline.com: Any thoughts on that particularly, the day-to-day sort of monitoring, because it isn't right in sight, you dont necessarily know whats going on?

Kelley: Yes, and again, that transparency into the audit, that control layer for monitoring. Some things specifically to check on: How are they keeping data away from people that shouldn't have access to it? What kind of access control, authorization and authentication are they using to make sure that only the eyes that are supposed to see data or are supposed to transact particular processes are actually able to do that?