Outsourcing/Offshoring: An IT Security Expert's View
As organizations pursue cost savings and operational efficiencies with their existing business processes, they often turn to service providers either in their home countries or abroad to reap additional cost savings associated with factors such as lower wages, lower operating costs and workers with experience that may not be available in-house. Alternatively, some organizations choose to move their operations to off-shore locations but retain control over their infrastructure, staff and processes. In either case, organizations need to manage the risks associated with safeguarding their assets and their information while complying with the various regulations and laws that govern their industry.
All business initiatives have an associated degree of risk. The risk associated with safeguarding the confidentiality, integrity and availability of information assets is a component of the overall business risk picture for all organizations worldwide. Ensuring that people, processes and technology are properly managed to address this risk is a challenge faced by information security professionals. There are, however, some unique risks associated with outsourcing that need to be addressed by various organizational stakeholders to avoid pitfalls. These risks include:
Political and country risk: if the outsourcing is going to be done in a country other than the country in which the sourcing organization is located, it may be necessary to examine the political environment of the service provider's country.
Cultural risk is introduced with language differences, varying communication protocols, differing work ethics and cultural norms. Organizations may be vulnerable to different types of ethics associated with information sharing.
Contractual risk: if contracts are not specific or flexible enough to accommodate changes in the business environment, the organization may face risks. In addition, the viability of enforcing the contracts if the service provider is in a location other than their home country may be difficult.
Operations risk: organizations face the risk of sub-par level service quality, cost overruns or business interruptions. Information security risk and compliance risks are often subsumed under operational risk.
Compliance risk: the sanctions and/or material loss of any kind that any organization may experience if it fails to comply with the set of laws, industry standards and internal requirements that govern its environment/sector. For the purpose of this definition, reputational risk is considered part of material risk. (Source: Basel Committee on Banking Supervision - April 2005)
Business Continuity Risk: the risk associated with an organization's ability to recover and/or restore partially or completely interrupted critical function(s) within a predetermined time after a disaster or extended disruption.
Organizations need to develop a strategy for understanding and managing these risks, which are dynamic and fluid. There is an inverse relationship between the degree of control and ownership and the amount of risk; the risk associated with outsourcing increases as the degree of ownership and control over business processes is diminished. That said, risks can be effectively managed with governance programs and with program management offices that provide oversight and management of all elements of the outsourcing initiative. Whether outsourcing a specific function or a range of operations, attention must be paid to ensure that all aspects of the decision are analyzed and documented. Various outsourcing lifecycles to manage outsourcing initiatives have emerged as organizations increasingly participate in outsourcing activities. N early all of them share a common theme: information security controls need to be part of any and all outsourcing activities.
Information security professionals often speak of an "information security outsourcing lifecycle." This approach to outsourcing, that is, examining the lifecycle from an information security practitioner's perspective, typically is not adopted by most organizations, as the decision to outsource is a business decision driven by a focus on cost savings not necessarily risk management. Instead a more effective approach to ensure that information security risk is addressed is one where information security practitioners integrate their requirements and recommendations into the "business" outsourcing life cycle process.
The likelihood of an organization following a methodical and logical process to manage its outsourcing/off-shoring efforts depends on the organization's maturity in this space. Most organizations do not have a formal, documented process for managing outsourcing/ off-shoring. And generally, information security professionals are not engaged, if they are engaged at all, until well into the process.