Onboarding a field engineering partner onto a vendor panel runs in five stages: commercial and legal due diligence, a UK GDPR processor contract, engineer vetting and site access, operational integration into your ticketing and escalation, and a scoped pilot before any panel-wide rollout. Skipping the pilot is the usual mistake.
What follows is the checklist in order, with the questions that actually separate a partner who will hold up from one who will not.
Need engineers on site in the UK, Europe or further afield?
Throne Solutions provides on-site IT field engineers across 60+ countries. Tell us your sites and the kind of cover you need, and we will come back with options and a quote.
Why onboarding decides this, not the sales process
Vendor selection is the easy half. Every field services provider will say yes to coverage, yes to response tiers and yes to reporting. The difference shows up in week three of live work, when a ticket lands at a site nobody surveyed, an engineer arrives without the right site induction, and the escalation path turns out to be an email address nobody reads at 18:00.
Each stage below exists to surface one of those failures before it costs you a client.
Stage 1 — Commercial and legal due diligence
Standard supplier checks, but with two items that are specific to field work.
- Legal entity and registration. Confirm the company you are contracting with
is the company that will invoice you and employ or engage the engineers. Ask directly whether
delivery is through employed engineers, contracted engineers, or a subcontracted network — all
three are workable, but the answer changes your vetting and liability questions. - Insurance. Ask for certificates, not assurances: employers’ liability,
public liability, and professional indemnity. Employers’ liability insurance is compulsory for
UK employers under the Employers’ Liability (Compulsory Insurance) Act 1969, with a statutory
minimum indemnity limit of £5 million, though most insurers write at least £10 million
(BPCA). Check the cover extends to the territories you need, not just the UK. - Certifications. ISO 9001 for quality management and ISO/IEC 27001 for
information security are the two most panels ask for. Ask for the certificate and check the
scope statement on it — a certificate scoped to a head office function does not cover
field delivery. - References from comparable work. Not any three clients. Ask for a reference
from an estate of similar size, in the same territories, on the same response tiers. - Financial standing. Routine, but worth doing where the partner will hold
spare parts stock that your service depends on.
Stage 2 — The data protection contract
Field engineers touch end-user devices, so personal data is in scope more often than vendor managers expect. Where you are the controller and the partner processes personal data on your behalf, UK GDPR requires a written contract, and the ICO is specific about what it must contain.
The ICO’s guidance sets out the minimum terms: the processor acts “only on the documented instructions of the controller”; it must impose confidentiality obligations on anyone authorised to process; it must “take all security measures necessary to meet the requirements of Article 32”; it needs the controller’s “prior specific or general written authorisation” before engaging a sub-processor, which must then be held to equivalent obligations; it must assist with data subject rights, breach notification and DPIAs; it must “allow for, and contribute to, audits and inspections carried out by the controller”; and at the end of the contract it must “delete or return to the controller all the personal data it has been processing for it” (ICO).
The sub-processor clause is the one to read twice on a field services contract, because subcontracted engineer networks are common and entirely legitimate — but they have to be authorised, and they have to be bound to the same terms. Ask the question before signing rather than discovering the answer during an audit.
If the partner is engineering across borders, agree the transfer mechanism at the same time rather than as an afterthought.
Stage 3 — Vetting, site access and safety
This is the stage that most often delays a first ticket, because it depends on paperwork that takes time to produce.
- Engineer vetting. Ask what level is held as standard and what can be
arranged on request — criminal record checks, employment history verification, and any
sector-specific clearance your sites or your clients require. - Site induction and access. Agree how engineers are added to access lists,
who issues passes, and what happens for out-of-hours attendance. For data centre work, confirm
the partner can meet the facility’s own access process, which is usually stricter than yours. - Health and safety documentation. Risk assessments and method statements,
PPE, and a named safety contact. Ask for a sample RAMS for the type of work you are buying. - Equipment and tooling. Confirm who supplies tools, lifting equipment and
test gear, and who is responsible for calibration records.
Stage 4 — Operational integration
The partner has to fit your process, not the reverse. Settle these before go-live, in writing.
- How tickets arrive. Portal, email, API or integration between your service
desk and theirs. Agree the mandatory fields — a ticket without a site contact and an access
window is a wasted visit. - Escalation. Named contacts with a path to a duty manager, covering the hours
you have bought. Test it during onboarding, out of hours, before you need it. - Response tiers per site. Confirm which tier applies at which address, in
writing. Availability varies by location for every provider, so a single contract-level figure is
not an answer. Our guide to
SLA-based IT support sets out what
each tier commits to. - Parts. Who owns the spares, where they are held, and who replenishes them.
This is the operational detail behind any short response tier — see
hardware maintenance. - Reporting. Agree the format and cadence up front: tickets, attendance
against tier, first-time fix rate, and parts consumption. - Remote first. Agree when a fault should be attempted remotely before anyone
travels. Good remote IT
support removes a meaningful share of visits, and the contract should encourage that rather
than reward attendance.
Stage 5 — Pilot, then panel
Run a scoped pilot before the partner carries anything that matters. A sensible pilot is one territory or one cluster of sites, one or two service types, four to six weeks, with the review criteria written down before it starts.
Watch three things: whether tickets were attended within the agreed tier, whether the first escalation was handled by a person who could act, and whether the reporting arrived without being chased. A partner who passes those three in a pilot will usually scale. One who fails any of them in a pilot will fail them louder at volume.
Where sites are unfamiliar or the work is physical, a
site survey before the pilot pays for itself.
The checklist, condensed
- Legal entity confirmed; delivery model stated (employed, contracted or subcontracted)
- Insurance certificates held, with territorial scope checked
- ISO certificates held, with the scope statement read
- Reference taken from comparable estate, territory and tier
- UK GDPR Article 28 processor contract signed, sub-processor clause agreed
- International transfer mechanism agreed where relevant
- Engineer vetting level confirmed in writing
- Site access and induction process agreed; out-of-hours covered
- RAMS sample reviewed; named safety contact
- Ticket intake route live, mandatory fields agreed
- Escalation path named and tested out of hours
- Response tier confirmed per site address, not per contract
- Parts ownership, location and replenishment agreed
- Reporting format and cadence agreed
- Pilot scoped, with written review criteria
Planning cover for a new contract or region?
Send us the countries, sites and service level you need. It takes two minutes, and there is no obligation.
Frequently asked questions
How long does it take to onboard a field engineering partner?
The variable is paperwork, not willingness. Insurance and ISO certificates can be produced immediately; the processor contract, engineer vetting and site access lists are what set the pace. Starting vetting and access in parallel with the contract, rather than after it, is the single biggest saving available.
What documents should you ask a field services partner for?
Certificates of employers’ liability, public liability and professional indemnity insurance with territorial scope shown; ISO 9001 and ISO/IEC 27001 certificates with their scope statements; a sample risk assessment and method statement; the vetting standard applied to engineers; and a reference from an estate of comparable size and territory.
Do you need a data processing agreement with a field services provider?
Where the provider processes personal data on your behalf — which field engineers working on end-user devices routinely do — UK GDPR requires a written contract containing the terms the ICO sets out, including security obligations, authorisation of sub-processors, audit rights, and deletion or return of data at the end of the contract.
Should you run a pilot before adding a partner to the panel?
Yes. Scope it to one territory and one or two service types, set the review criteria in writing before it starts, and judge it on attendance against tier, escalation handled by someone who could act, and reporting delivered without chasing.
What is the most common onboarding mistake?
Agreeing a response tier at contract level rather than per site address. Short response tiers depend on an engineer and the right parts being within travel distance, so availability varies by location. Confirming it per address during onboarding prevents the discovery arriving as a breach.
Working with Throne Solutions
Throne Solutions provides
IT consulting and field engineering for multi-site estates, delivered through
global field services with
SLA-based IT support and
help desk support behind it. Offices are in the United Kingdom, the United States, Denmark, Canada, Saudi Arabia and Pakistan; territory detail is on Our Presence.
If you are running a vendor onboarding now, send the estate, the territories and the response tiers you need, and you will get the documentation pack and a quote against the actual sites.
Email: info@thronesolutions.com
Phone: +45 71 44 47 20
Start a conversation ·
Site surveys and installations ·
Rollouts and migrations
