Giving people outside your building access to source code is a fair thing to worry about. The risks are specific, though, and most of the controls are the ones you should already apply to any remote employee.
Before the first engineer gets access, ask the provider these seven questions. Vague answers are worth following up in writing.
- Who employs the engineers? Do they sign individual NDAs and IP assignment terms that name your company?
- Are devices company-owned and managed? Can they show that encryption and remote wipe are enforced?
- Can your identity provider control all access? You should be able to revoke it without asking them.
- Certified or aligned? ISO 27001 certification comes from an accredited body, and a SOC 2 report comes from a CPA firm. "Aligned" means neither has happened. Ask for the certificate, the report or the control list.
- What happens to code and data when the engagement ends? How is deletion confirmed?
- Who do you call during a suspected incident? How quickly will they respond?
- How is the office secured? Ask about physical access and visitors on the delivery floor.
What to configure on your side
- Protect main branches and require at least one approval.
- Scan every pull request for vulnerable dependencies and leaked secrets.
- Keep credentials in a secrets manager, and rotate any secret that reaches a commit.
- Remove standing production access. Changes go through the pipeline, and break-glass access is time-bound and logged.
- Use synthetic or masked data in development.
Our own position, for comparison: controls aligned with ISO 27001 and SOC 2, not certified.
The full checklist covers contracts, monitoring, the DPDP Act and EU data transfers: https://offshore1st.com/blog/ip-protection-data-security-offshore-teams-checklist
Disclosure: I'm the founder of Offshore1st, which places dedicated staff in India. This post was prepared with AI assistance and is condensed from our checklist.
Top comments (0)