We are a SOC-2 compliant company. We used to have all full time employees till now, hence we could do our due diligence on all the hired employees e.g. Background checks, reference checks, getting NDA and on boarding documents signed etc. Recently, we started to hire part time consultants from third party agency. We sign the documents with the third party agency (NDA, Engagement agreement covering IP etc). Our SOC-2 team is insisting to follow the same process of signing the documents/background checks etc with the consultants assigned to us by third party. Third party agency has already done this with their consultants as part of on-boarding process and they are very reluctant and uncomfortable in getting these documents signed between their consultants/employees directly with us.

Is it fair for us to ask third party consultants to sign these documents or even its needed at all from SOC-2 perspective? I believe, since third party has taken care of it and we have signed the documents with the third party, we should be good. Any guidance on this will be really helpful.

  • You need to ask this of your SOC2 assessor. SOC2 itself does not delve into this type of detail. You need to review the contents of the agreements and determine if they meet the needs and requirements.
    – schroeder
    Aug 2, 2021 at 7:11

1 Answer 1


It doesn't seem right to me that you would sign a document with the consultant regarding background checks, reference checks, and an NDA unless you were performing those background checks, reference checks, and creating an NDA with the individual. Based on the description, you are deferring the background check and reference check to the consulting agency and have an NDA in place between your business and the consulting agency.

My recommendation would be that you have a vendor management process in place that would include staffing vendors, such as consulting agencies and external recruiters, that outlines how you assess their ability to serve your needs. It would be reasonable for you to either receive third-party audits or perform your own audit of the consultancy in order to assert that they are performing the background and reference checks as necessary. The NDA in place between the two businesses may also be sufficient to ensure that the consultants are appropriately covered, but a legal review can confirm that.

If you have questions, a SOC2 assessor would be able to point out potential problems. However, it seems like signing documents for the sake of signing documents without executing the associated processes would raise more questions. If you duplicated the processes, then that would seem to be an unnecessary cost burden on the business.

  • Thanks Thomas. This is certainly helpful. Aug 3, 2021 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.