Offshore vendors pose a different risk than those who reside within your home country. The majority of the time, the term offshore refers to those who are located in countries where business process outsourcing is typical; for example, India, the Philippines, Vietnam, South America, and others outside the United States, Canada, Europe, and other countries where costs can be higher than for the same processes outsourced to a lower‐cost location. Challenges exist in performing both due diligence and due care for the location, and differences in standards, practices, regulations, culture, and other risks offshore exist in comparison to a supplier local to your shores.

Distance can present challenges for several reasons. Vendors and their subject‐matter experts (SMEs) who participate in the conversations for due diligence are remote, and can be located in different time zones, making scheduling a challenge. Typically, this can be overcome by including a local representative from the offshore vendor, and/or when the remote staff is on your local time or have an agreed schedule that overlaps with the home country's time zones. There can also be issues with holiday coverage and notification risks. Secondly, the third‐party's distance makes performing on‐site due diligence costly in terms of time and travel. Some countries might require a visa for entry and can take a day of travel, depending on locations and connecting flights.

Local regulations for data privacy and data security are a risk as they can differ greatly from your country or region. It is not hard to see how a U.S.‐based company could outsource to Argentina (for Spanish‐speaking expertise and a lower‐cost support model) where the Ibero‐American Data Protection Network (RIPD is the acronym in Spanish) covers that country. Further, in 2000 the Argentina National Constitution executed the Personal Data Protection Act 25.326 (PDPA) to help protect data privacy. PDPA aligns with the EU data privacy model, and Argentina was the first Latin American country to be able to perform data transfers to the EU with the “adequacy” qualification. How does a firm deal with any differences in how data privacy is treated? It can be said that the data is coming from the United States and only concerns U.S. citizens and residents. However, there could easily be a U.S. resident who is an Argentine citizen, who is also your customer, who could be protected by the PDPA and the RIPD that allows them access to their data. A bigger company could have up to hundreds or more examples of cross‐border regulations, which presents risks for how data is handled and stored and needs to be addressed by offshore vendors.

Other risks are as follows: The countries themselves and how work is performed, internet traffic that might be monitored or blocked, areas of the world where internet hackers and criminals operate out of, and regions with potentially armed conflict (including cyber conflict). The following presents a company with an option to determine boundaries where the risk to business, and cyber risk in particular, should be avoided: Some countries are known to block or monitor web traffic, which can present risk for offshore data protection. If the region has a high cybercrime rate, malware/ransomware attacks, and is not prepared to deal with them, it's of particular concern when drawing boundaries on where offshore vendors can and cannot be located. The home government will publish an ever‐evolving list of forbidden countries for business. But this list is about the legality of working, not the advisability. When drawing red lines around countries or regions for your business to avoid, it should not be confined to what the regulations are, but to avoid unnecessary risk by performing business in a country or region when less risky options are available.

The lifecycle of an offshore vendor is not different than a local one, but different risk considerations must be addressed at each phase. To make the process more descriptive, we will explore how KC Enterprises performs the lifecycle of a remote or offshore vendor.

Onboarding Offshore Vendors

Onboarding a vendor who is offshore requires that many of the same questions are asked, but the focus on some areas is more pronounced or incorporates different questions due to the different risks. KC Enterprises' IRQ includes questions to ensure that these risks are caught early. The review includes extra risk questions and can trigger other third‐party risk domains to become more engaged. If you recall, in Chapter 5, KC's intake questions about potential offshore work included two separate questions about fourth‐party risk:

• Will the vendor require other third parties to provide service to KC Enterprises?
• Will any of the vendors or its third parties (i.e., KC's fourth parties) perform work or support services outside the United States?

These two questions are direct and designed to get these vendors the appropriate questionnaires, additional contract language, and other due diligence processes focused on remote suppliers. When they are answered in the affirmative, the next set of formal due diligence questions on the intake assessment includes language and reviews tailored for them. At KC, the same team that performs local vendor due diligence also performs these reviews, as they are trained or already have the experience necessary to perform them. On‐site assessment team employees are required to have valid passports, so they can perform these activities in whatever country is required.

The questions for a Request for Proposal (RFP) do not change as there is also a question about the potential for offshore risk: Does the product have any development or support outside the United States?

And as the RFP process uses a grading system, this risk can be graded as the answers are evaluated. Depending on the project, this grading will hinge on the project's scope (e.g., is it designed to be done offshore or is it preferred onshore?), but the risk is then weighed into those results. When the selected vendor is known to be remote, this data is added to the next step (in the IRQ).

This next step is to ensure that the vendor and internal business sponsor are aware of the KC Enterprise non‐negotiable where no KC customer or employee data may be stored or processed outside the United States. This means all work must be performed via remote access from the offshore vendor's location to a virtual environment at a KC data center or a U.S.‐based co‐location or Cloud Service Provider (CSP). Given how solutions could be moved to the cloud and there were existing due diligence workstreams to deal with that risk, this was viewed as providing choices to the business while maintaining a low‐risk profile when it comes to entanglements in external data privacy laws such as General Data Protection Regulation (GDPR).

The intake assessment process is designed to provide both a vetting process for vendors that could pose a risk to the company unnecessarily (will not encrypt data or in a country that poses unneeded risk), and to perform due diligence on those that can proceed. For offshore business, the IRG and intake questions focus on the key areas of risk for performing business outside the country. Because these locations are remote, performing the physical security validation with an on‐site assessment becomes important and leads into the ongoing due diligence efforts.

Country Risk

Part of the risk of a country or region stems from cybersecurity risks. Performing work outside the home country of the company, as described, entails risk due to the distance and differing regulations. It is prudent for a company to examine the risk of working remotely with vendors and establish some guidance for the business to use in making less risky decisions on which nations or regions are considered more acceptable and those that pose undue risk. The way this can be accomplished varies by industry, regulatory guidance, and business operational decisions; cybersecurity risks also must be considered. Does the area or country have an elevated danger of open conflict or is it already at cyberwar with another? For example, the conflict between the Ukraine and Russia has produced some negative impact on business and life in the Ukraine. In some countries, the free flow of data across the internet is not the same as others. If there is known monitoring or the blocking of traffic, it could pose an unnecessary risk to work being performed in those countries.

KC's Country Risk

There were times at KC where the process worked correctly for an offshore vendor. However, along the way, it somehow was “discovered” that they were, in fact, in a county of “concern.” These countries were not ones that the U.S. government said that if we did business with them, we could go to jail. These were countries that the cybersecurity teams knew had higher risk than others. When these late discoveries were made, it often led to uncomfortable discussions with the internal business sponsors and the vendor. KC decided that the firm needed a unified explainable definition of which countries weren't acceptable to perform business in and which ones were preferred, and that it was necessary to explain why these decisions were made so they could be shared internally and externally.

The team based these definitions on a list that provided options for business but also set boundaries with some explanations. First, there was the easy list of sanctioned countries, including Cuba, Iran, North Korea, and Syria, resulting in no ambiguity about their exclusion. The policy was listed in several different standards as such:

No KC Enterprise employee, contractor, agent, or representative will engage in any discussions or business operations with a country currently listed by the U.S. Department of Commerce (DoC). In instances where a country is added to this list that already has a vendor(s) performing services for KC Enterprises, all activity must stop effective the date required by the U.S. Government and regulatory guidance.

The next part of the list contained the preferred countries. The word preference meant that if these countries were selected as one of the offshore countries, then standard due diligence would take place. If another country was chosen, then due diligence could require additional questions and did not guarantee approval. Preferred locations were determined to be, in this case, where the company already had an offshore footprint and where other countries were seen as favorable for business operations. Favorable for business operations meant the government had long been friendly to western business operations, did not restrict or were known to monitor internet traffic, and contained capable infrastructure (e.g., technology, air travel, road travel).

The decision on these definitions produced a list for internal business that was easily explained:

• Countries not permitted due to law or regulation: Cuba, North Korea, Syria, and Iran. Consult the latest U.S. DoC website for any updates. This can be driven by regulatory or legal limitations.
• Countries KC Enterprises considers unfavorable for business: Afghanistan, Somalia, Yemen, Pakistan, Libya, Myanmar, Nigeria, Chad, Ethiopia, and Venezuela.
• Preferred countries (current operations): Philippines, India, and Ireland.
• Other countries: On a case‐by‐case basis.

For intake, it not only clarified preference, but stated that additional countries could be considered with the understanding that there would be more due diligence and no guarantee of approval. This had the effect of pointing most options to the three countries currently performing offshore work for the company. The process for the case‐by‐case basis was established for those times when it was required for a new country to be added to a restricted list or the preferred countries.

Countries not on the preferred list had to be reviewed by Cybersecurity Third‐Party Risk with the following criteria:

• Is there a similar provider in an existing “preferred” country?
• What is the state of cybercrime in the country?
• Does the country monitor or block internet traffic?
• Does the country pose an elevated risk to KC's data or network connectivity?

These security assessments for countries not already reviewed and having business operations enabled an open dialogue to occur between business leadership, KC's upper management, and the cybersecurity team about the risks observed and guidance provided. Their process is not designed to be a checklist, but more of a discussion of the findings and risks the Cybersecurity Third‐Party Risk team found in relation to the business's operation and benefits the offshore vendor provided. The first question of “Is there a similar provider in a country already on a preferred list?” was one that required the internal business leadership to come ready with an answer. If they were unsure or had not done the required work to find one, then that must be completed to provide a complete picture of a way to avoid the risk.

Conclusion

Performing work offshore to save a company money is not new, but a business can often underappreciate the cybersecurity risks with them. Setting clear boundaries of acceptable and non‐acceptable nations or regions in policy or standards provides early guidance to follow. If work is to be done offshore, then the on‐site physical validation assessment becomes a key security control itself for due diligence efforts.

Ensure that data controls are in place to address any data exfiltration from the offshore vendors' premises, especially with the pandemic and remote access from homes in those countries that typically would have worked from a controlled corporate location pre‐pandemic. The security of offshore—meaning not in your primary company location and market—requires more work and controls because by definition they are very remote. This remoteness means performing regular on‐site due diligence, and other validations require an extra level of trust that can be achieved with tighter control language in contracts and due diligence.