Multi-Level Information System Security in Outsourcing Domain

Purpose -

Information security is an integral part of all outsourcing activities and it is important for both the outsourcing company and the vendor to reach agreement as regards what type and what level of information security will be provided by the vendor in relation to the outsourced activities. The aim of this paper is to evaluate the potential risks and information system (IS) security needs when outsourcing takes place and analyse the different security level in outsourcing agreements.

Methodology /Approach -

This paper is primarily based on a review of the literature. International security standards and best security practices are analysed and discussed. A multiple level security framework as an effective approach in outsourcing domain is addressed.

Findings

Information system security risks can be effectively identified, monitored and evaluated by the concept of a layered security model that fits best in the complex outsourcing domain. There are three levels of security, first guidelines of technical security, second risk analysis and, third compliance and evaluation criteria, including managing information security.Originality/ValueThe approach could be used to integrate IS Security with Service Level Agreements. Outsourcing vendors with security certifications, strong security adherence systems and optimal disaster recover plans will have a competitive edge in the industry. Keywords: Information security, outsourcing, risk, compliance, outsourcing agreement.

Paper type: Conceptual

R.Doomun “Multi-level Information System Security in Outsourcing Domain”, 2nd International Business Process Outsourcing and Modelling (BPOM 2006) Conference, 28-30 June 2006, University of Technology, Mauritius. (To be published in Emerald Journal)