How do I check how a security firm stores its clients' sensitive test data?

Begin with the map. Ask the owner to show every place client results can sit: file servers, laptops, cloud folders, email, backups and personal devices. Gaps appear fast when the answer is vague. Then ask who has access to each place, how access is granted and removed when someone leaves, and whether the log of that access can be reviewed.

Next, look at protection. Ask whether stored material is encrypted, how keys and passwords are handled, and whether staff use shared accounts. Review the baseline controls a small organization would be expected to follow and compare them to what the firm describes. If the answers sound improvised, treat that as a finding.

Finally, ask about the end of the engagement. Does the firm return or destroy client material, and can it prove it? Request any record of past incidents and how they were handled, and read client contracts for promises about storage. Your lawyer should review those promises, since a buyer may inherit them. Ask the firm how it would find out if something went missing, and who would tell the client. A calm, specific answer suggests the habit exists. A hesitant answer suggests the first real incident would also be the first time anyone tried the process.

Key takeaways

• Map every location where client results can sit, including laptops and backups.
• Ask who can open the data and how access ends when staff leave.
• Check contracts for storage promises your lawyer should read before closing.