A security checklist for choosing an internet hosting service provider for a virtual private server?

Question

I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of evaluation by means of a checklist where I can be assured that my source code and database for the website will be secure from those with direct access to the server itself?

Edit: I take it that there is no 100% guarantee that my source code and database will be safe as long as it is hosted by another party. What I am more interested to find out is the process of conducting due diligence such that at the very least, I know that I have done my part in managing the security risk.

Answer 1

These checklists are usually not very realistic and depend on honesty of the responding vendor. You can try looking for providers that have various industry certifications, e.g. SEC 2, ISO 27001, PCI (as a provider, not as a merchant), HIPAA etc.

Check some of the Amazon's https://aws.amazon.com/security/#certifications and look for similar ones.

Answer 2

Unless you run background checks on ISP's personnel, you're implicitly trusting them. If the value of data on your site to outsiders is big enough to tempt underpaid admins, you may want to host the site on your own servers. The assessment should include the cost of finding out the value for rogue admins.

EDIT: After clarification of the question, am only able to point at NIST SP 800-123, Guide to General Server Security, and NIST SP 800-44 v.2, Guidelines on securing public Web servers. It also helps to have legal counsel before signing the contract; being a valuable customer and having big legal guns to punish an offender mitigates the risk somewhat - to do that you have to know the legal whereabouts of the ISP - where it is registered.

Another thing: if you have doubts or gut feelings now, don't make due diligence a CYA process.

EDIT #2: Think that answer by @Vitaly Osipov is quite to the point, and is worth accepting (you can ask the ISP about adherence to PCI Security standards)