Cyber Health Check: Outsourced Services

Posted on July 30, 2021March 22, 2023

If you outsource services such as payroll processing, loan servicing, data center/co-location/IT Managed Services, Software as a Service (SaaS), or medical claims processing, you rely on the service provider to keep your data secure, maintain confidentiality, integrity of processing, availability of services or systems, and/or privacy. However, AAFCPAs reminds clients that outsourcing may expose your organization to risk and underscores the need for effective vendor due diligence.

This quiz is now closed. AAFCPAs’ IT Security Specialists can assist clients in assessing the security of the services that you outsource. Learn More >>

About the Authors

James Jumes, MBA, M.Ed.

James joined AAFCPAs in 2013 to lead the Business Consulting Services practice. He has more than 25 years of experience working with information technology systems and diverse business operational processes. James is highly experienced in IT controls and assurance, SOX 404, and Service Organization Control (SOC) reports: SOC 1 (SSAE 18), SOC 2, SOC 2+ and 3 attestation reporting. James developed a unique methodology to delivering SOC reporting services, and he is an AICPA-approved Peer Review SOC Specialist, assisting peer review teams to review SOC 1, 2, 2+ and 3 engagements. He is a HITRUST Certified Common Security Framework (CSF) Practitioner, providing HITRUST CSF self-assessment consulting, or SOC 2 + HITRUST for assessing against the evolving compliance landscape shaped by HITECH, HIPAA, CMS and various other federal, state and business requirements.

Vassilis Kontoglis

Vassilis is a senior member of AAFCPAs' Business Process & IT Advisory practice with proven expertise in cyber security and IT risk assessments, data analytics and data visualization, and robotic process automation. He also has extensive expertise assessing IT general controls, and conducting System and Organization Control (SOC) attestations. He helps clients increase business process efficiency, effectiveness, and risk management.