Logout

• Athens/Institution Login |
• Register |
• Forgot Password?

Abstract:

Purpose – Information security is an integral part of all outsourcing activities and it is important for both the outsourcing company and the vendor to reach agreement as regards what type and what level of information security will be provided by the vendor in relation to the outsourced activities. The purpose of this paper is to evaluate the potential risks and information system (IS) security needs when outsourcing takes place and analyse the different security level in outsourcing agreements.

Design/methodology/approach – This paper is primarily based on a review of the literature. International security standards and best security practices are analysed and discussed. A multiple level security framework as an effective approach in outsourcing domain is addressed.

Findings – It is found that IS security risks can be effectively identified, monitored and evaluated by the concept of a layered security model that fits best in the complex outsourcing domain. There are three levels of security, first guidelines of technical security, second risk analysis and, third compliance and evaluation criteria, including managing information security.

Originality/value – The approach could be used to integrate IS security with service level agreements. Outsourcing vendors with security certifications, strong security adherence systems and optimal disaster recover plans will have a competitive edge in the industry.

Keywords:

Data security, Information management, Outsourcing, Risk management

Article Type:

Conceptual paper

Article URL:

http://www.emeraldinsight.com/10.1108/14637150810916026

Top