u Security and data privacy plans certified to meet certain standards
u No outsourcing of services without explicit customer approval
u Careful vetting of offshore provider
u Encrypted data transmissions and tight access controls on databases to