Why outside IT staff should be background-checked and sign an NDA

Outside IT staff working in a bank, an insurer, or a hospital spend their time close to your systems, your data, and your people. They work in server rooms, behind service counters, and in branches where customer information is all around them. Procurement and security teams approving that access need a few answers first.

Why on-site work needs screening

An engineer replacing a part or fixing a fault often works at a computer that’s still logged in, walks through a server room, or stands in a branch full of customers and paperwork. That’s simply what on-site work looks like, even for a small job like swapping one laptop battery.

Risk doesn’t only come from bad intent. Someone can see data on a screen by accident, or overhear a conversation. A careful organisation wants to know who is coming in, and what confirms that person can be trusted. An NDA and a background check are the two main tools for that.

What an NDA covers

An NDA is an agreement not to disclose information. The person signing it agrees not to pass on or use anything they see or learn while working for you.

It typically covers customer data visible on screen, the structure of your systems and network, internal documents left out on site, and the terms of your contract with the vendor. An NDA can’t remove the risk. It makes clear who is accountable if information leaks, and it usually continues after the work ends, because what someone saw on the job still matters afterwards.

What a background check covers

A background check generally confirms a person’s identity and looks at their criminal record, so an organisation can be confident that someone near its systems and data doesn’t carry a known risk.

Banks require outside providers to background-check the staff they send on site. Hospitals and insurers hold equally sensitive personal data, so they have the same reason to ask.

Source System does both, for everyone, on every job

Our engagement has five steps. The fourth is contract and team: the contract and an NDA are signed, and everyone on the team is background-checked before work starts.

We do this on every job, for banks and every other client, whether we’re sending an engineer for a one-off fault or placing staff with a client long term. Banks set the clearest requirement, so every client gets the standard banks ask for.

Questions worth asking any vendor

Before signing with any vendor, procurement or security teams can reasonably ask:

• Who gets checked: everyone who comes on site, or only some roles?
• When: once at the start of the contract, or before every job?
• What does the NDA cover, and for how long after the work ends?
• Who do we contact if something urgent happens outside the working day, and how?

The first two show whether screening really applies to everyone. The third shows where accountability sits. The last is often overlooked, yet it matters to organisations whose systems run outside office time, like banks and hospitals. Source System’s contract clients can report urgent problems by phone, email, or LINE, through the channels set out in their contract.

See IT Manpower Outsourcing or get in touch to ask how we’d prepare a team for your organisation.