We are a SOC-2 compliant company. We used to have all full time employees till now, hence we could do our due diligence on all the hired employees e.g. Background checks, reference checks, getting NDA and on boarding documents signed etc. Recently, we started to hire part time consultants from third party agency. We sign the documents with the third party agency (NDA, Engagement agreement covering IP etc). Our SOC-2 team is insisting to follow the same process of signing the documents/background checks etc with the consultants assigned to us by third party. Third party agency has already done this with their consultants as part of on-boarding process and they are very reluctant and uncomfortable in getting these documents signed between their consultants/employees directly with us.

Is it fair for us to ask third party consultants to sign these documents or even its needed at all from SOC-2 perspective? I believe, since third party has taken care of it and we have signed the documents with the third party, we should be good. Any guidance on this will be really helpful.