Several businesses need different degrees of users in their systems. employee, for example, may only be able to access information, whereas an executive may be able to alter and remove data. Similarly, secret data belonging to one department may be accessed exclusively by individuals who have logins for that department. Make sure the system tracks data changes so you can figure out who made a modification and when it happened. Furthermore, a system with strong password management, such as regular updates and character requirements, is required.

Imagine your contract expires and you choose not to renew your engagement with the vendor. Will the data be provided to you, erased, or retained by the vendor? This is a critical problem that should be addressed in your contract.

Once you delete a file, you must be certain that it has been completely removed. In other systems, erasing an item is more of a “archive” function – it is removed from view but still searchable, comparable to a document in your desktop’s Trash. This could be a good or a negative thing depending on the circumstances, so be sure you understand how the system works.

It’s not a good sign if the vendor hasn’t put together a comprehensive data recovery plan. It’s unlikely they’ll be able to recover your data if they don’t know how to recover their own.

You might be outsourcing data processing to a client, but they might have their own sourcing agreements. You can potentially open up your data to multiple agencies by getting into an arrangement with one provider. Verify that you have all relevant data and that no additional risks are posed by third parties. What amount of exposure will these organizations have, and how will the vendor select and manage them in order to maintain safety?