You'd want to also check on what they're doing in terms of control within their data center itself from either a physical or a logical perspective. Very often it's cheaper to have multiple instantiations of a server on one box, for example, so you might do it in a virtualized environment or something like that. But what if they're housing your competitors' information on the same server where your information is being housed? You'd want to make sure that they've got data separation, not just to make sure their employees are authorized, only the right ones, to see it, but also that anybody else who may have access to that data center, such as another remote client, is also going to be separated from your data and you've got them zoned properly with correct data control.

Encryption is another big piece that can be helpful here. You'd want to ask them what their data protection and lifecycle management is for the data when it's transmitted, when its at rest and when it's stored long-term.

CSOonline.com: Any thoughts on negotiating a service level agreement? What sorts of things should be in there?

Kelley: Definitely think about it up front, because it's very hard to go back in and negotiate after the fact if it's something that the provider doesn't necessarily want to give you. Sometimes technical people may think they don't want to bring the lawyers in because its going to slow things down, they always find weird problems with the wording. But this is actually a very, very good thing, because before you go into this long-term contract with an outsourcer, you do want to make sure that you've explicitly spelled out what is and isn't acceptable.

And one thing to look for very specifically is the right to audit clause. So if you want to be able to go in, if you want to have your own team of auditors go in for a FAS 70 or you want to have a pen testand of course you'll have to pay for thator you want to perform a pen test or even a physical audit on site, you have to make sure that you've cleared that with that outsourcer up front. If you don't, there's every chance that they could say, "We never told you you could come. Our systems are private; you might expose information from other clients." So be specific with them about what kind of audit control you want to have.