The Security Questionnaire Is Standing Between You and the Contract

You hold complete identity kits for people you never hired. Every candidate who applied. Most agencies have no retention schedule, so the exposure compounds every quarter.

Recruiter turnover is your access control problem. High internal churn produces shared logins, credentials that outlive employment, and candidate data living in spreadsheets and email threads outside the applicant tracking system.

The loss event is payroll redirect, not ransomware. A compromised recruiter mailbox is used to change direct deposit details or to invoice a client. It is quiet, it is fast, and email security plus verification procedure is what stops it - not another endpoint tool.

Your client's vendor management system is your auditor. Beeline, SAP Fieldglass, and similar platforms gate onboarding on a security review. A SIG Lite questionnaire or a SOC 2 report is frequently the requirement, and a smaller agency that cannot respond simply does not get onboarded.

Placements in other states import other states' laws. Biometric timeclocks in Illinois placements are the clearest example, and the question of who is legally responsible when the agency does not own the device is actively litigated.

• A recruiter mailbox is compromised and a direct deposit change goes through on a real thread with a real signature block.
• Candidate spreadsheets live in email. Names, Social Security numbers, and dates of birth, exported for a client submission two years ago and never deleted.
• Departed recruiters keep access to the applicant tracking system and to the shared drives.
• The agency loses a contract on the questionnaire. Not on price. On the inability to evidence multi-factor authentication, retention, and breach notification commitments.
• Email security is under-built while endpoint tools are over-bought, which inverts the actual risk.
• Biometric timeclocks at client sites are treated as the client's problem with nothing in the contract allocating it.
• There is no retention schedule, so every candidate record ever collected is still there.
• Florida's employment eligibility verification rules are applied by rumor rather than by reading the statute.

Do staffing agencies need SOC 2?

No law requires it. Enterprise vendor management programs increasingly do, as a condition of onboarding. Treat it as a sales requirement and evaluate it against the contracts it would unlock rather than as a compliance cost.

What is required to satisfy a client's VMS security requirements?

Usually a completed questionnaire - SIG Lite, CAIQ, or the client's own - covering multi-factor authentication, encryption, access management and offboarding, data retention, subprocessor lists, breach notification timelines, training, and insurance. Some programs accept a documented program in place of an audit report; some do not.

Is our payroll data PCI compliant?

PCI DSS governs payment card data. Payroll information - Social Security numbers, bank account and routing numbers - is sensitive personal information governed by state breach law and contract, not by PCI. Applying the wrong framework here leaves the real exposure unaddressed.

Is biometric timeclock data protected under state law?

In several states, yes. Illinois' BIPA is the most consequential, with notice, written consent, and retention schedule requirements. Where the agency does not own the timeclock, who bears responsibility has been the subject of recent Illinois appellate litigation and remains an area to check with current counsel before relying on any summary.

Does BIPA apply outside Illinois?

BIPA is an Illinois statute, and its reach in cases involving out-of-state entities and Illinois residents has been litigated repeatedly. A Florida agency placing workers in Illinois should not assume distance provides protection. The statute text is at ilga.gov.

Do I need to run E-Verify for my staffing agency in Florida?

Florida's employment eligibility verification requirement at Fla. Stat. §448.095 distinguishes between public employers, contractors and subcontractors, and private employers, with different obligations and thresholds. Read the statute at flsenate.gov and confirm with employment counsel - this is the requirement most commonly described incorrectly in both directions.

What happens if a candidate's Social Security number leaks from our ATS?

A Social Security number is personal information under Fla. Stat. §501.171, so a breach triggers notice to affected individuals within 30 days of determination and, above the statutory threshold, notice to the Department of Legal Affairs. Your client contracts may impose additional and faster notification duties.

Do I need a data processing agreement with my ATS vendor?

Your enterprise clients will expect their data flow to be governed by contract, including subprocessors and breach notification. Whether it is called a DPA or a security addendum, the substance is what gets audited.

Is my staffing agency a financial institution under GLBA?

Generally no for ordinary staffing services. The analysis changes for payroll and professional employer arrangements handling banking data at scale, and it is genuinely contested. Get a written determination from counsel rather than adopting a position from a vendor.

Do we have to notify candidates of a breach?

If their personal information was involved, yes - candidates are individuals under state breach notification law regardless of whether they were ever placed or paid.