How do large companies get a design agency through security review without stalling the redesign?

An insurer picks a 15-person design studio for a claims-app redesign. Kickoff is set for the first Monday. A week before, the vendor portal sends the studio a 300-question security questionnaire written for software vendors. Information security asks for a SOC 2 Type II report the studio doesn’t have. Legal sends a data processing agreement, and nobody has said whether the studio will see customer data. The product lead who sponsors the project learns that the start date has moved six weeks. The insurer, the studio and the delay are invented.

This guide, published by Humbleteam, a digital product design agency, is for the product or design leader who sponsors an agency and has to steer it through procurement, information security, privacy and legal. It shows how to set the depth of the review by what the agency will touch, and how to run the review alongside the first design work. It is not legal or security advice: your security, privacy and legal teams decide what your company requires.

What does a design agency actually touch?

Start with a list that the sponsor and the agency lead write together: everything the team will open, store or create. Typical lines are Figma files, internal documents, a staging environment, analytics dashboards, production access, customer data in research, and recordings of participants.

NIST’s supplier risk guide sorts suppliers by how important the service is to the business, how sensitive the data they handle is, and how much access they get to your systems. It says requirements should match that criticality. For a design agency, most of the answer sits in data and access. A 12-person studio that sees only public screens is a lighter case than a large firm with a login to a production admin console.

If you are still choosing a team, our guide to which enterprise product design agencies work at Fortune 500 scale lists cases to inspect.

Which evidence is proportionate for a small agency?

Four kinds of evidence are common, and each answers a different question.

• SOC 2 report. An independent auditor’s opinion on controls, measured against the AICPA’s Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy. A Type 1 report covers the design of controls at a point in time. A Type 2 report covers a period and includes the auditor’s tests and results. Read the system description, the period, any exceptions, and the controls the customer must run itself.
• ISO/IEC 27001 certificate. ISO says organizations can choose whether to certify at all. A certificate has a scope, and the scope can be limited to certain departments, locations or legal entities. Check that it names the entity on your contract and the people who will do your work.
• Standard questionnaire. Shared Assessments’ SIG has a Lite version for lower-risk vendors and a Core version for those handling sensitive data. Your security team may already use it, so ask whether it will send its copy. The Cloud Security Alliance’s CAIQ documents controls in IaaS, PaaS and SaaS services, so a studio answers many of its questions with “not applicable.”
• Short custom questionnaire. One page on who will access what, which devices and logins the team uses, where files live, which AI tools touch client material, which subprocessors are involved, how fast the agency reports an incident, and how it offboards people. This one is our suggestion, not a standard.

A certificate isn’t the only proof. NIST lists self-attestation, standards conformance, certifications and inspections as ways a supplier can show acceptable practice. So match the evidence to the access, as the table does.

Which review does each kind of access need?

For the last row, first ask whether the work needs that access at all. Test data in staging often does the job.

When do you need a data processing agreement?

When the agency handles personal data on your behalf, GDPR Article 28 requires a written contract. It must set out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of people. It must also require that the agency acts only on your documented instructions, binds the people with access to confidentiality, applies security measures, uses subprocessors only with your authorization, helps with requests from individuals, deletes or returns the data at the end, and allows audits.

For a UK reader, Article 28 of the UK GDPR has the same structure, and the ICO’s guidance lists the same terms. The ICO also says some professional service providers act as controllers in their own right, and marks parts of its guidance as under review after the Data (Use and Access) Act, so your privacy team decides who is the controller. US state and sector privacy rules are outside this guide.

Not every design project involves personal data. If yours does, write down which categories and why before the draft goes out; “all categories” usually means nobody wrote the access list.

How should research participants and recordings be handled?

The Department for Education’s user research manual says to send the consent form before the session where possible, and to get consent before the research starts. The Market Research Society’s data protection guidance says to ask for separate consent for using recordings and photos, and to keep a record of who consented, when, and what they were told.

The ICO adds a limit: consent under the UK GDPR can be withdrawn at any time, and if you couldn’t act on a withdrawal, consent is the wrong basis. Your privacy team picks the lawful basis, so ask them before the consent script is written.

Our suggestions: keep recordings in a workspace the client owns, label notes with participant IDs, and write the retention date into the agreement. A recruiting panel that supplies participants counts as another subprocessor.

How should accounts, access and offboarding work?

SSO sounds like the answer, but in Figma, SAML SSO applies to members only. Agency staff with their own email domain are guests, and guests can sign in with Google or an email and password. To put them behind your SSO, give them accounts on your domain. If you keep them as guests, admins can require approval for new ones (an Enterprise plan feature), invite them to specific files only, and turn off public link sharing.

NIST control AC-6 states the principle: allow only the access needed to accomplish assigned tasks. In practice that means named people, no shared logins, view rights where editing isn’t needed, and staging instead of production.

Put offboarding in the contract at the start. NIST’s supplier category GV.SC-10 calls for provisions for what happens after the agreement ends. Name one client admin who removes accounts on the end date, collects or deletes files and recordings, and confirms in writing.

What about the agency’s AI tools?

Ask in writing which AI tools the team uses and on which plans, whether client files, screenshots or transcripts go into them, whether the provider keeps or trains on inputs, and who at the agency decides.

The UK government’s 2023 guidance to civil servants says never to put sensitive information or personal data into public generative AI tools, because government has no oversight of how entered data is used. Your rule may differ. Put the answer into the contract as a short clause, and list any AI provider that receives client material as a subprocessor.

Which subprocessors and insurance should you ask about?

The agency’s own suppliers can see your material too: recording and transcription tools, file storage, panel recruiters, freelancers. Under Article 28, the agency needs your prior written authorization for them, must tell you about changes, and stays liable for them. Ask for the list at the start.

If your contract template asks for insurance, request the certificate with the rest of the evidence so it doesn’t arrive late. Your risk team sets the terms.

What does a week-by-week plan look like?

The plan runs the review beside the first design work. Nothing confidential opens until its tier is cleared, and the early work uses material that needs no clearance.

An illustrative worked example

Back to the invented insurer and studio. The sponsor, Maya, and the studio lead write the access list. The studio will see unreleased designs, run eight recorded customer interviews, and use a test version of the claims app. It needs no production access.

Security sets three tiers: public audit work is low, designs and the test app are medium, interviews are medium to high. It swaps the 300-question portal form for a one-page questionnaire and a SIG Lite, where the studio marks hosting questions not applicable and says why. Nothing high-risk is in scope, so it skips the SOC 2 request. The studio starts with the public audit while the review runs, the agreement is signed in week 3, and the interviews begin in week 4.

Where does this break?

• Production data in a prototype. A pasted claim or a real customer name turns a medium-tier file into a high-tier one. Agree test data only, and check the first files.
• A questionnaire written for software vendors. It asks about hosting, uptime and product penetration tests that a services firm doesn’t run. Rewrite the scope, or accept “not applicable” answers with reasons.
• Evidence that doesn’t fit. A Type 1 report where you need Type 2, or a certificate that leaves out the people doing your work.
• Guests skipping SSO. The plan says SSO, but the agency’s staff are guests.
• An agreement that doesn’t match reality. Recordings sit in a personal drive, or a freelancer isn’t on the subprocessor list.
• A one-time gate. In month 3 the team asks for analytics access and nobody re-checks. Treat each new access as a short new review.

What can you produce from this?

One page: the access list, a tier for each line, the evidence due, and a named signer per row. Send it to information security before kickoff and ask them to correct it. If you plan to hire several studios, each is its own supplier with its own review, and our guide to lead agency or specialists covers who holds which contract role. Add a date to recheck the tiers, because the access list changes as the project does.