The Short Answer
Before you send unreleased footage to a post house, VFX shop or agency, ask where it will live, who can reach it, how it moves, how long it stays and what happens if something goes wrong. A vendor that has thought about these questions answers in plain sentences and can show a document. A vendor that has not will give you reassurance and no detail. This post gives you the list and what each good answer sounds like, so you do not need to be a security specialist.
Start With Their TPN Status
TPN, the Trusted Partner Network, is the MPA-run program where vendors publish a standardized security assessment. If your client or distributor has told you to use TPN vendors, this is the first question. Ask for three details.
- Which Shield, and for which scope? TPN has four: Blue (self-attested), Silver (assessed by a TPN-accredited assessor with a remediation plan submitted), Gold (Best Practice fixes completed and reviewed by TPN) and Gold Star (Gold plus the Additional Recommendations). Statuses are per site and application, so ask whether the Shield covers the facility or service that will touch your footage.
- When does it expire? Blue is valid for one year from submission. Silver, Gold and Gold Star are valid for two years from the publication of the assessment report.
- Are there open findings? Silver means findings exist and a plan has been submitted. That is normal, and TPN reports that 96 percent of its assessments find gaps. Ask where the vendor is in closing them.
One point to keep in mind: TPN says its Shields are not an approval, certification or pass or fail. Each content owner makes its own risk-based decision. A Shield is a useful signal. It does not replace your own questions. Our older posts on TPN use the previous two-tier names, so use TPN's site for the current tiers.
If a vendor has no TPN status, that is not a disqualifier unless your client requires one. TPN is voluntary. It only means you ask the questions below with more care.
The Questions
People and access
- Who will touch my footage, including freelancers and subcontractors? Good answer: a named team, with contractors covered by the same NDA and training as staff.
- How do you control access? Good answer: individual accounts, multi-factor authentication, and access limited to the project. Shared logins are a warning sign.
- How do you onboard and offboard people? Good answer: sign-off on policies at hire, annual training and access removed on the last day.
- Do you have a work-from-home policy? If editors work remotely, ask how footage is protected. See our post on TPN for freelancers and remote editors.
Storage and movement
- Where will my media be stored, and how many copies exist? Good answer: a named system, a backup arrangement and a location.
- Is it encrypted? The Best Practices set AES-256 for content at rest and TLS 1.2 or better in transit. You do not need the details. You need a yes and a method.
- How does footage get to you, and how does it go back? Good answer: a transfer method your client has approved, with links that expire and no passwords in the same message as the link.
- Is the work network separated from the office network and guest Wi-Fi? A yes with a diagram is better than a yes.
- Do editors keep local copies on laptops or external drives? Ask what happens to those at the end.
Review and sharing
- How do you send me cuts? Look for per-person links, expiry, a passphrase and watermarking if you require it. Our post on watermarking, screeners and review links explains the options.
- Who else can see my project in the review tool?
Lifecycle
- How long do you keep my media and how do I request deletion? Good answer: a stated retention period and a written confirmation of deletion.
- How are drives and paper destroyed?
If something goes wrong
- Do you have an incident response plan, and when would you tell me? Good answer: a written plan, a named lead and a commitment to timely notice. The Best Practices call for timely notification of affected clients. See what such a plan contains in our incident response outline.
- Have you practiced it? An annual tabletop exercise is a good sign.
Verification
- Can you show me your security policies or a summary of your last assessment? Vendors vary in what they can share, so ask what they can show. A willing answer is a good sign.
- How often do you scan for vulnerabilities and patch? The Best Practices set monthly external scans, quarterly internal scans, and annual penetration testing.
How to Read the Answers
You are not grading with a pass mark. You are looking for three things.
- Specifics. Names, systems, time periods and documents.
- Consistency. The sales answer and the technical answer agree.
- Willingness to put it in writing. A confidentiality agreement, a data handling clause or a short security addendum.
If the answers are vague, slow down. You can send a small amount of non-sensitive material first, or require a specific transfer and review setup before the real footage moves.
Put It in the Contract
Ask that the agreement name where media is stored, who may access it, the retention and deletion period, how incidents are reported and what happens to subcontractors. For legal wording, ask your counsel. This post is not legal advice.
For more background on why studios worry about the same things, see cybersecurity for post-production studios.
Want a person to help?
If you are the client, a real person on our team can help you turn this list into a one-page vendor questionnaire and read the answers with you. If you are the vendor, we help studios get ready for these questions, including TPN preparation. The assessment itself is done by an independent, TPN-accredited assessor, and we do not certify anyone or guarantee outcomes. See our TPN certification consulting, or contact us.
Questions people ask
Should I only work with TPN vendors?
Only if your client or distributor requires it. TPN is voluntary. A vendor without a Shield can still handle footage carefully, so ask the questions above and decide based on the answers.
What does a TPN Silver Shield tell me?
It means a TPN-accredited assessor reviewed the vendor against the Best Practices and the vendor submitted a remediation plan for the findings. It does not mean every control is in place. Gold means the Best Practice items were completed and reviewed by TPN.
Can I see a vendor’s assessment report?
TPN+ lets content owners who participate in the program see a vendor’s questionnaire answers and shared evidence. Outside the program, ask the vendor what it can share, such as a summary or its policies.
What if the vendor uses freelancers?
Ask whether the same NDA, training and access rules apply to them. The MPA Best Practices name freelancers and temporary workers in onboarding, offboarding, training and authentication controls.
Written by the team at Clouds Agency, a Los Angeles creative and production consulting agency.