Your company's security practices depend on the people who implement them, including contractors and service providers.

• Before you outsource any of your business functions-payroll, web hosting, customer call center operations,data processing, or the like—investigate the company's data security practices and compare their standards to yours. If possible, visit their facilities.
• Address security issues for the type of data your service providers handle in your contract with them.
• Insist that your service providers notify you of any security incidents they experience, even if the incidents may not have led to an actual compromise of your data.