Third party consultants background checks, NDA signing etc for SOC-2

Question

We are a SOC-2 compliant company. We used to have all full time employees till now, hence we could do our due diligence on all the hired employees e.g. Background checks, reference checks, getting NDA and on boarding documents signed etc. Recently, we started to hire part time consultants from third party agency. We sign the documents with the third party agency (NDA, Engagement agreement covering IP etc). Our SOC-2 team is insisting to follow the same process of signing the documents/background checks etc with the consultants assigned to us by third party. Third party agency has already done this with their consultants as part of on-boarding process and they are very reluctant and uncomfortable in getting these documents signed between their consultants/employees directly with us.

Is it fair for us to ask third party consultants to sign these documents or even its needed at all from SOC-2 perspective? I believe, since third party has taken care of it and we have signed the documents with the third party, we should be good. Any guidance on this will be really helpful.

Answer 1

It doesn't seem right to me that you would sign a document with the consultant regarding background checks, reference checks, and an NDA unless you were performing those background checks, reference checks, and creating an NDA with the individual. Based on the description, you are deferring the background check and reference check to the consulting agency and have an NDA in place between your business and the consulting agency.

My recommendation would be that you have a vendor management process in place that would include staffing vendors, such as consulting agencies and external recruiters, that outlines how you assess their ability to serve your needs. It would be reasonable for you to either receive third-party audits or perform your own audit of the consultancy in order to assert that they are performing the background and reference checks as necessary. The NDA in place between the two businesses may also be sufficient to ensure that the consultants are appropriately covered, but a legal review can confirm that.

If you have questions, a SOC2 assessor would be able to point out potential problems. However, it seems like signing documents for the sake of signing documents without executing the associated processes would raise more questions. If you duplicated the processes, then that would seem to be an unnecessary cost burden on the business.