In an outsourcing arrangement, many of the risks to personally identifiable information (PII) are the same as for internally processed information. Controlling the spread of PII within the outsourcer's IT environment is key, as is ensuring that access controls are effectively used, the outsourcers networks are secure, and encryption is used in association with organizational sensitive data and PII. Even administrative controls, such as employee background checks, have applicability in an outsourcing arrangement.