Which security assessments does TSI hold, and how is client data protected?

Assessment scope

TSI first announced a PCI Service Provider Level 1 attestation, against version 3.2, on June 10, 2017 (press release).

Some frameworks come up in every security review but aren't audits or attestations, so they aren't in the table:

• The NIST Cybersecurity Framework 2.0 is a set of practices an organization aligns to. TSI's information security program is aligned to it, with controls mapped to NIST SP 800-53 Rev. 5.
• HIPAA is a federal law, and no outside body certifies a company as HIPAA compliant. TSI works as a HIPAA business associate for healthcare clients and signs business associate agreements.

How client data is protected

• Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Staff reach client data on a need-to-know basis, through role-based access controls.
• Access to TSI's systems is logged.
• TSI runs background checks and drug screens on its staff.

Where client data is stored

TSI stores and processes client data in the United States. Its primary data center is in Las Vegas, Nevada, and it replicates to a secondary data center in Grand Rapids, Michigan.

Where a client's contract allows work outside the U.S., TSI staff there reach client data only through a virtual desktop connected to TSI's U.S. systems. The virtual desktop blocks local storage, printing and downloads, so the data stays in the U.S.

Disaster recovery

TSI runs a written disaster recovery plan alongside its business continuity plan:

• Critical systems are backed up daily and replicated to the secondary data center.
• TSI can restore systems at the secondary site within a recovery time objective of 4 hours.
• If a site has an emergency, its work can move to another TSI site.
• TSI tests the plan every year, including restoring the collection system and checking that files open.

Incidents and notice

TSI's incident response procedure sets out who investigates, how an incident is contained and fixed, and when clients hear about it. If an incident affects a client's data or services, TSI notifies the client within the window in the client's contract, sends status updates until it's resolved, and then sends a written report on the cause and the fix.

Offshore work and subcontracting

Client work runs in the U.S. unless the client's contract approves otherwise. Where a client approves it, staff at TSI's nearshore and offshore sites (listed on the company facts page) may do back-office work such as account review, skip tracing, quality checks and reporting, through virtual desktops connected to TSI's U.S. systems. They're direct TSI employees, trained and monitored under the same programs as U.S. staff.

TSI's own staff do the core work on client accounts. TSI uses outside vendors only for services with no account holder contact, such as printing and mailing letters, database searches and document shredding. If a client approves legal action, TSI places the account with a law firm in its Attorney Network.

Every vendor goes through TSI's Strategic Supplier Management Process before it's hired, and answers a vendor risk questionnaire every year. Contracts cover confidentiality, data security, audit rights and breach notice.

TSI carries commercial general liability, errors and omissions, cyber liability and workers' compensation insurance.

How clients audit TSI

Clients can audit TSI's work on their accounts, on site or remotely, with advance notice. An audit covers the records tied to that client's accounts.

How to check this yourself

• PCI Security Standards Council: what an Attestation of Compliance covers, and the current PCI DSS version.
• AICPA SOC reports: what each SOC report type covers, if you're comparing vendors' reports.
• HHS HIPAA for professionals: what the law requires of business associates.
• NIST Cybersecurity Framework: what the framework is.

Questions buyers ask

Where is our data stored, and what is your disaster recovery plan?

Client data is stored in TSI's U.S. data centers: a primary site in Las Vegas, Nevada, and a secondary site in Grand Rapids, Michigan. Critical systems are backed up daily and replicated to the secondary site, with a 4-hour recovery time objective. TSI tests its disaster recovery plan every year.

How would you tell us about a security incident?

If an incident affects your data or services, TSI notifies you within the window your contract sets. You get status updates until it's resolved and a written report on the cause and the fix.

Does any of our work or data go offshore or to a subcontractor?

Your data stays in the U.S. Work goes offshore only if your contract allows it, and then only to TSI employees working through virtual desktops that block storage and downloads. Vendors handle services with no account holder contact, such as printing and mailing, under contracts that include audit rights and breach notice.