A security questionnaire gets awkward at the rows about contractors and outsourced engineers, because that's where a small team's real practice (a shared admin login, a laptop nobody manages) meets a form that assumes you have policies. Put the controls in place first, then answer each row with evidence you can attach. What follows is engineering practice, not legal or audit advice: your auditor decides scope, and your counsel decides what's lawful in each country.
Why questionnaires ask about contractors
A customer's security team is trying to find out who can touch their data, and a contractor with production access is a person who can. The first questionnaire is also usually a CTO problem. AWS's startup blog says the first procurement questionnaire "usually lands on the CTO's desk", and in the same post FundApps' CTO says questionnaires that took weeks were often finished in about half a day after a 2020 SOC 2 audit. That's one company's account, but it shows what the work buys you.
The contractor rows are rarely labelled as such. The Cloud Security Alliance's list of ten questions to add to a security questionnaire includes the security of third-party vendors and subcontractors and endpoint and device security. Vanta's sample vendor risk questionnaire asks about security awareness training for "employees and contractors". Expect your contractors to turn up inside access, vendor, device and training questions.
Are your contractors in scope for SOC 2?
If you're answering a questionnaire without a SOC 2 report, scope still matters, because the same test tells you which contractors the customer's questions are really about.
Drata's help-centre guidance on contractors in audit scope gives the test: a contractor is in scope if they affect the audited system, your business objectives or your customer commitments. The practical screening question is whether they interact with customer data. Drata's examples: a DevOps contractor is in scope, a logo designer probably isn't. It's vendor guidance, and the auditor has the final say.
An answer in the Vanta community, on whether a SOC 2 audit must include contractors, adds detail. Contractors who reach environments with real customer data, or have any connection to production, likely need some personnel controls, such as policy acknowledgment and a confidentiality agreement. Sandbox-only contractors can be scoped out if you document it, though auditors may still expect baseline onboarding. That's an informal answer, so confirm it with your auditor.
Then place each contractor on the system boundary. An individual freelancer is a person with an account. A staffing vendor is a company whose people hold accounts. An agency that processes personal data for you is a processor under GDPR, and any subcontractors it brings in are sub-processors. Each changes what you can evidence yourself and what you must ask someone else for. Write down the reasoning for every contractor you scope out; a dated note is something an auditor can review, "we decided" isn't.
How to prepare contractor evidence before a security review
Seven pieces of groundwork cover most contractor rows. The controls are our judgment about what customers ask for, not a standard.
1. Give every contractor a named account with least privilege
No shared credentials, no personal email logins, and everything through your identity provider with multi-factor authentication on. Split access by environment so a contractor on the staging service can't read production data. We cover the tiers, and GDPR Article 25(2) on default access limitation, in our guide to access tiers and sub-processors for outside engineers, so we won't repeat the table. The evidence to attach is an export of accounts with their roles, dated.
2. Make offboarding the same day, and keep the list
Keep one list of every system each contractor can reach. When the engagement ends, that list is what you revoke against, and you rotate any secret they could read. Same-day revocation is a common aim in practice, but we haven't found a sourced standard for it, so state your own number and then meet it. The evidence is a ticket per departure with the date access ended and the date of the last login in the audit logs.
3. Decide what screening you can lawfully do
Background checks are one place where European law can differ from US-shaped forms. What an employer or client may check about an individual varies by country, and we haven't sourced per-country limits, so take that question to counsel before promising a standard check across a European team. What you can do everywhere is ask your vendor how its engineers are screened and record the answer. Verification of background and experience is the first stage of HighCircl's four-stage vetting, and it's the sort of thing to ask any vendor to describe.
4. Set a device rule
State whether contractors use company-managed laptops or their own, and what you require either way: disk encryption, a screen lock, and some way to check it. If you run device management, enrolling their machines is the cleanest answer. If you don't, say "own devices with encryption confirmed in writing" and mean it. "We have no rule" is the answer most likely to be marked down.
5. Sign NDAs and IP terms before access
The confidentiality agreement should cover the named individual, not only their company, and it should be signed before the first login. This is also the cheapest piece of evidence you'll ever collect: a filed, dated document per person.
6. Keep a sub-processor and vendor list
If a staffing vendor or agency processes personal data for you, they're a processor under GDPR Article 28, and their own subcontractors are sub-processors you need to authorise. The EDPB's Opinion 22/2024 on reliance on processors and sub-processors says the controller should have the identity of all processors and sub-processors available. One maintained list, with the vendor, what it touches and where, answers that and the questionnaire row in one go.
7. Review contractor changes before they merge
Require a second person's approval on every merge to the main branch, contractor or not, and protect the branch so it can't be bypassed. The evidence is the branch protection settings plus a sample of reviewed pull requests.
How to answer the contractor rows honestly
Answer each row in four parts: the policy, the evidence you can attach, who owns it, and how often it's checked. If one of the four is missing, say so and give a date for closing it. A plain "not yet, due in March" beats a claim that collapses when the reviewer asks for the export. Overpromising can turn a small gap into a failed review.
The wording in the table is illustrative. Adapt it to what's true for you.
| Question topic | Honest answer pattern | Evidence to attach |
|---|---|---|
| Who has production access? | "Named accounts only, through our identity provider, with MFA. Contractors get staging by default and production only on request." | Dated account and role export |
| How is access removed? | "On the day the engagement ends, using the access list for that person. Secrets they could read are rotated." | Offboarding ticket with dates |
| Are contractors screened? | "Individuals are checked as far as local law allows. For vendor staff we ask the vendor to describe its screening." | Vendor's written screening description |
| Devices | "Contractors use [managed / own] laptops with disk encryption confirmed." | Device policy or signed confirmation |
| Confidentiality | "Each contractor signs an NDA and IP terms before access." | Signed documents on file |
| Third parties | "We keep a list of processors and sub-processors." | The list, with the date last reviewed |
What to require from a staffing vendor
If a vendor supplies your engineers, half of your answers depend on its practice. Put these in the contract or an onboarding questionnaire of your own:
- The names of the individuals who will work on your systems, and notice before anyone is swapped in.
- A disclosure of any subcontractors, and your approval right over them.
- A description of how engineers are screened.
- Their device and access policy, or acceptance of yours.
- Notice when an engineer leaves their staff, so you can revoke access that day.
- A commitment to tell you about a security incident that touches your systems, with a time limit you pick.
- A right to see an audit report or have your questions answered. If they hold a SOC 2 or ISO 27001 report, ask for it; many small vendors won't have one, so decide in advance what you'll accept instead.
- A data processing agreement with the sub-processor list attached, and your confidentiality terms flowed down to their people.
If you're also regulated under NIS2, the same list feeds your own obligations to the suppliers you pick. Our guide to NIS2 supplier clauses for dev vendors covers that direction, which is the reverse of this article: there you're vetting a supplier, here you're being vetted.
What this means for your next enterprise deal
The decision in front of you is whether your contractors keep production access while you answer the first enterprise questionnaire. Keep it only where you can show named access and same-day revocation. Where you can't, remove it from anyone who doesn't need it this quarter. In our judgment, retrofitting evidence under a sales deadline is the expensive path, and it pulls an engineer off the roadmap at the worst time.
For any staffing vendor you already use, send the ask list above this month. The replies tell you whether the form gets a "yes" or an "in progress". For the mechanics of the access list and exit, use the contractor onboarding and offboarding checklist. The EU legal context is in the legal requirements for hiring developers in Europe, and related guides sit under EU engineering hiring compliance: contracts, IP and GDPR.
Hiring engineers through HighCircl
HighCircl's hiring service places senior engineers in seven countries (Poland, Hungary, Slovakia, Serbia, Slovenia, Romania and Spain), and every candidate goes through four vetting stages that begin with background and experience verification.
FAQ
Do contractors need to be in scope for SOC 2?
If they affect the audited system, your objectives or your customer commitments, usually yes, and the screening question is whether they touch customer data. Your auditor makes the call. Document the reasoning for anyone you scope out.
How fast should contractor access be removed?
We haven't found a sourced standard, so choose a target you can meet, with same-day revocation as the aim, and keep the ticket that proves each removal. The number matters less than being able to show it was met.
Should contractors use their own laptops?
Either can be defensible. Managed devices are easier to evidence. If contractors use their own, require disk encryption and a screen lock, get that confirmed in writing, and keep production access off those machines where you can.
Do I need a SOC 2 report from my staffing agency?
Not necessarily. A report helps if they have one, but a small vendor can still answer your ask list in writing: screening, subcontractors, devices, offboarding notice and incident notice. What you can't accept is no answer.
Can I answer a questionnaire without SOC 2 yet?
Yes, in most cases; whether a given customer accepts it is their call. Answer with the policy, evidence, owner and frequency for each control, and mark honestly what isn't in place and when it will be. A dated plan reads better than an overstated claim.