According to the 2007 State of the Outsourcing Industry Survey by Black Book, 66 percent of the 22,000 respondents ranked security capabilities as the third most important factor they would consider.  However, data security and intellectual property protection are often overlooked.  Some of the reasons that the responsibility for protecting data and assets in outsourcing relationships is overlooked include the following:

• The belief that responsibility for security can be outsourced
• Security has a low profile within the business
• There is an inadequate awareness of security at the senior management level

When security is overlooked in an outsourcing deal, the potential repercussions can be especially damaging for an IT organization.  Not only will the buyer face an increased risk of security incidents, such as virus outbreaks, there is also a risk that controls will no longer be strong enough to meet compliance within the industry.  Employees of the outsourcing provider may steal data and intellectual property if the appropriate security measures are not put in place.

Data security is a crucial element that needs to be addressed in the outsourcing contract.  It is more of a challenge to add security into the outsourcing agreement at a later time and it can be expensive to revise the contract, which is why it should be an initial part of the outsourcing deal.  IT executives should prepare the outsourcing deal in such a way that it is clear how security will be maintained during and after the outsourcing relationship.

By addressing security issues upfront, IT companies have a better chance of protecting data and intellectual property.  If your company is considering IT outsourcing, contact the global sourcing strategists at A&E Consulting at 661-200-3612.  We can help you choose the right outsourcing location and partner.  It is our goal to provide each client with a personalized solution that minimizes the time of implementation and maximizes the return on investment.

Social Bookmarks

When searching for a vendor, there are certain criteria that are considered when choosing a company.  One of the main factors that should be included in the decision process is the vendor’s data security policies.  There should be clear, enforceable policies in place and the access controls should be identified.  Many of the larger vendors will have certifications showing that information security practices are upheld.   Some firms will have obtained the ISO 27001 certification, which means the company documents and follows information security practices and controls.

It is important to find out how the vendor enforces access controls and how these controls are updated when employees change jobs or leave the company.  Some vendors will offer to provide development on a dedicated data server, which will include audit control access. Once a vendor is chosen, IT managers must make sure the company follows the outsourcer’s industry best practices and compliance guidelines of the home country.

Whatever policies and access controls that are discussed should be outlined in detail in the contract.  A signed non-disclosure agreement, non-compete agreement and no solicitation agreement can provide additional protection for the outsourcing company.  If a vendor refuses to include data protection information in the contract, it would be wise to consider a different global sourcing provider.  Even after the initial terms are agreed upon and the contracts are signed, an outsourcing company should perform regular audits to ensure that data privacy policies are being followed and enforced.

Only the information that is crucial to the project should be shared with the global sourcing provider.  The outsourcing company will have to carefully evaluate the propriety data and technology that are needed to successfully develop the outsourced projects.  In-house employees should be aware of what information is acceptable to share when talking with the global sourcing provider.

By being aware of the potential challenges associated with data protection and taking preventative steps, an outsourcing company can reduce the associated risks.  A&E Consulting can help you evaluate data protection issues when global sourcing and will oversee the first outsourced project. 

Social Bookmarks