20 Must-Have Security Controls When Outsourcing Sensitive Workloads

gettyAs companies rely more heavily on third-party providers for infrastructure and computing capacity, they’re increasingly placing sensitive applications and data in environments outside their direct control. When workloads involve confidential information or critical business operations, relying on outside providers creates additional security and oversight challenges. A provider’s security assurances alone aren’t enough to guarantee that company data and systems remain protected.

Before moving these workloads outside their own environments, organizations need to consider which safeguards will help them maintain visibility and control while protecting sensitive information. Below, members of Forbes Technology Council share the controls companies should insist on before entrusting sensitive workloads to third-party providers.

Companies should work to ensure they are clear on the contractual terms associated with the use of these external computing environments, especially as they relate to access to environments and data, usage terms remaining exclusive to the owner/operator, and provisions about backups and other redundancy practices and methods. These practices have a history but require some modernization to ensure risk is managed in the current era of external reliance. - Charlie Sanchez, Black & Veatch

Insist on verifiable control over where data and models run and who can touch them. Before moving sensitive workloads, require customer-managed encryption keys, no training on your data, and audit logs you can inspect. In healthcare, that means a HIPAA-compliant BAA and proof that PHI never leaves your approved environment. Trust, but verify continuously. - David Talby, John Snow Labs

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

Ensure that there is a tested ability to revoke third-party access, rather than just a contractual obligation. Implement a gate for QE acceptance by ensuring that revocation denies access to sensitive information by active sessions and automated processes, even when the support team of the provider cannot be reached. - Kavitha Thiyagarajan, Newrez LLC

Always insist on holding your own encryption keys outside the provider’s environment. Contracts and certifications describe what a provider promises, but key custody is something you can verify and enforce yourself. If you control the keys, a provider breach, a legal demand or a change of jurisdiction is far less likely to expose your data without you. This is especially important in a sovereign compliance context. - Paul Speciale, Scality

Organizations must insist on absolute data sovereignty and immutable auditability, not just basic access controls. With AI-driven processing, companies need explicit zero-data-retention guarantees, customer-controlled encryption keys, and complete traceability over how data is processed. Sensitive workloads must never be used for background model training or vendor analytics, with real-time audit logs and instant access revocation built in by default. - Chris Brown, Sngular

Insist on a way to run without the vendor. The system should run inside your own cloud or an isolated environment so that personal identifiers arrive scrambled and the vendor never holds the key. Then, add source code in escrow with an independent agent and a license that keeps you running if the vendor fails. If the vendor can switch you off or read your data, the workload is not really yours. - Vivek Thomas, AISensum

Before moving sensitive workloads, require proof that the provider can isolate your data and limit privileged access. Review independent testing, access logs and remediation practices—not just policy documents. If the provider cannot demonstrate that those controls operate effectively and are retested after material changes, the workload should not move. - Brian Harmison, Corsica Technologies

Insist on an architecture that minimizes data movement. Sensitive data should stay in the company’s environment whenever possible, with only the metadata or security findings needed by the provider shared externally. Every additional copy creates another retention, residency and access problem that has to be secured. - Asaf Kochan, Sentra

Before moving sensitive workloads to a third party, companies should insist on continuous visibility and policy enforcement. It’s not enough to trust security certifications. Organizations need real-time insight into where data resides, who accesses it, how it’s used and whether it meets compliance requirements. Strong controls, auditability and zero-trust principles ensure risks are detected and managed before they become business or regulatory issues. - Hemant Soni, CAPGEMINI AMERICA INC.

Demand a clear “kill switch.” If a vendor is hosting sensitive workloads, your company should be able to quickly cut off access, revoke credentials, and move or isolate data if something goes wrong. Trust is useful, but control over your own exit is what really protects you. - Margarita Simonova, ILoveMyQA

I’d want a very clear understanding of access. Who can reach the workload, what can they do, and how quickly can that access be removed? As systems become more connected, small gaps in permissions can create much larger risks. Clear ownership and tightly managed access are worth establishing before sensitive workloads move anywhere. - Deniz Gezgin, Eightpoint

Security and assurance mean knowing a provider won’t misuse your data or intellectual property to build a competing product. This was a major concern when AWS, Azure and Google entered the cloud market. Companies feared providers would learn from what they built and compete with them. The cloud companies were careful not to cross that line. With AI, we’re seeing the same concern return, and some frontier AI companies are crossing it. - Srinivas Mukkamala, Securin Inc.

Strong vendor management is essential, but if I could only ask for one thing, it would be a SOC 2 report. It’s not a complete security assessment, but it provides some of the best security and control visibility available from a single document—provided you actually review it. - Shane O’Donnell, Centric Consulting

Companies should insist on legally binding agreements requiring third-party providers to comply with their data processing governance framework. These agreements must define data ownership, permitted processing activities, security standards, access controls, audit rights and accountability for breaches. Outsourcing infrastructure should not mean surrendering control over sensitive data or responsibility for its governance. - Eranda Maldeniya, Enterprise Analytics

Insist on the right to audit and the right to get your data back, in usable form, on exit. Performance SLAs are table stakes; the real control is what happens when the relationship ends or the provider is breached. In regulated work, you answer to the regulator for data you don’t hold. If you can’t inspect it and can’t leave with it, you don’t control it. - Mayur Khandelwal, EXL

Ask for the list of non-human identities on their side that can touch your workload. Every provider talks about which humans have admin access. Nobody volunteers the service accounts, monitoring agents and automation inside their environment that read your data as part of normal operations. If they can’t produce that list, the control conversation hasn’t started yet. - Nidhi Jain, CloudEagle.ai

Make remote attestation a go-live requirement for sensitive workloads. Before deployment, teams should verify that the workload is running in an approved environment, with the expected code and access controls intact. If that proof cannot be produced, the workload should not move outside the enterprise. - Dr. Chiranjiv Roy, C5i.ai

Know exactly what happens to your data once it leaves your environment. Before adopting a third-party service, require clear documentation on where data is processed, how long it is retained, who can access it, and whether it can be used for secondary purposes, including AI model training. Make these requirements enforceable through contractual terms. - Anastasia Georgievskaya, Haut.AI

Insist on a joint incident drill before anything moves. The contract and the SOC 2 report tell you what is supposed to happen. A tabletop with the provider’s on-call team shows you who actually picks up, how fast you get logs, and who can isolate your workload. If a provider won’t rehearse with you, find out why before you sign. - Ganesh Ariyur, Transform Smarter

Insist on a specific incident notification timeline written into the contract before any sensitive workload moves. Most third-party agreements include breach notification language that is vague on timing and structured to protect the vendor. A contractual obligation to notify within a defined window, regardless of whether the provider has finished its own investigation, determines whether you can respond or can only react. - Dan Haiem, AppMakers USA