What to Ask an Agency About Security Before You Sign

By the time a membership organisation or professional firm is choosing a web agency, the shortlist usually looks the same on paper. Similar portfolios, similar prices, similar promises. The thing that separates a safe appointment from a regrettable one is rarely in the proposal. It comes out when you ask about security and watch how they answer.

Here are the twelve questions we think every buyer should ask, what a good answer sounds like, and the answers that should end the conversation. We have put our own answers on our Trust page so that you can hold us to the same standard.

About the agency itself

1. What security certification do you hold, and can we see it?

A good answer names the scheme and shows the certificate. In the UK, Cyber Essentials is the sensible minimum for a small or mid-sized agency; it covers the controls on their own devices, accounts and network, which is where supplier breaches usually begin. Larger agencies may hold ISO 27001. “We take security very seriously” with no certificate is not an answer.

2. Are you registered with the Information Commissioner’s Office?

Any UK organisation processing personal data should be. The answer is a registration number you can look up. If they are not registered, ask why, and expect a weak answer.

3. How do your staff access our systems, and how is that access controlled?

You want to hear: multi-factor authentication on everything, a password manager, encrypted laptops, access granted per person per project and removed when they leave the project or the company. You do not want to hear: a shared login in a spreadsheet.

4. Who are your sub-processors?

Every agency uses other companies: hosting, email delivery, form handling, analytics, backups. Under UK GDPR you are entitled to know who will touch your data and where they are. A good agency has the list ready. One that cannot name its own hosting provider has not thought about it.

About the build

5. How will you handle our member data during the build?

The best answer is that they will not need it. A site can be built and tested with sanitised data or a staging copy of the membership system. If live data is needed for a migration, it should be the minimum necessary, held for the shortest time, encrypted in transit and at rest, and deleted when the job is done, with confirmation in writing.

6. What is your approach to third-party code?

Every plugin, library and theme is code written by someone else that your site now depends on. Ask how they choose them, how many they expect to use, how they keep them patched, and what they do when one is abandoned. On WordPress in particular, the number of plugins is a fair proxy for the attack surface. Ten is a disciplined build. Sixty is a problem waiting to happen.

7. How will authentication work for members and for staff?

For members: ideally single sign-on against the membership system, so the website never stores a password it does not need. For staff: multi-factor authentication on the content management system, individual accounts, and roles that limit what each person can change. “Everyone uses the admin account” is a no.

8. Will the site meet accessibility and security standards, and how will you prove it?

Accessibility and security overlap more than people expect; both are about building carefully and testing before launch. You want a named standard (WCAG 2.2 AA for accessibility), a description of the testing, and a written report at handover. Our note on WCAG 2.2 for membership websites explains what the standard now asks for.

About life after launch

9. Where will the site be hosted, by whom, and where is the data?

Provider, region and who holds the account. For a UK membership body the data should normally stay in the UK or the EU. You should own the hosting account, or at minimum have administrative access, so that you are never locked out of your own site by a dispute with the supplier.

10. What are the backup and recovery arrangements?

How often, where to, how long they are kept, whether they are encrypted, whether they are off-site from the main hosting, and whether a restore has ever been tested. “Daily, off-site, kept for thirty days, tested quarterly” is a good answer. “The host does backups” is not.

11. What happens if the site is attacked or goes down?

Who is monitoring, how they are alerted, what the response target is, who you call, and what the escalation path is. If the agency offers a maintenance plan, these should be written into it, with targets in hours rather than adjectives. Ask what happened the last time one of their sites had an incident; a good agency will tell you honestly.

12. Will you sign a data processing agreement, and can we see your standard one?

If the agency processes personal data on your behalf, which includes hosting or maintaining a site with member accounts, UK GDPR requires a written agreement setting out what they do, where, for how long, with which sub-processors, and how a breach is reported. An agency that has done this before will have a document ready and will not flinch at your procurement team’s version either.

What the answers tell you

An agency that answers all twelve clearly, with documents, is one that has been through supplier due diligence before and has built its practice around it. You can expect the same care in the build.

An agency that answers most of them but stumbles on sub-processors or backups is probably competent but informal. That can be fine for a small brochure site. It is a risk for a site holding member data.

An agency that treats the questions as an imposition, or answers with reassurance instead of facts, is telling you how they will respond when something goes wrong.

Put the questions in the tender. Our guide to writing a website tender brief for a membership organisation has a section for exactly this. Score the answers, and weight them properly; a cheaper proposal from an agency that cannot answer question 10 is not cheaper.

Our own answers, certificates and policies are on the Trust page, and the way an engagement runs from discovery to launch is on How we work. If you want to send us your supplier questionnaire before you decide anything, do; most come back within five working days.