You can use ThirdParty Security Risk Management module for storing the name of the company who is outsourced. Now they have feature to map the control objective (which is asking about the physical security guard at office) so that you have the both the data of the third party security company and the respective controls also stored.
You can have a customized attestation template which is asking about the questions about the implementation of security guards that can be attested once a year (or the frequency you need to validate), This way you can have the responses also gathered
