Multi‐level information system security in outsourcing domain

Abstract

Purpose

Information security is an integral part of all outsourcing activities and it is important for both the outsourcing company and the vendor to reach agreement as regards what type and what level of information security will be provided by the vendor in relation to the outsourced activities. The purpose of this paper is to evaluate the potential risks and information system (IS) security needs when outsourcing takes place and analyse the different security level in outsourcing agreements.

Design/methodology/approach

This paper is primarily based on a review of the literature. International security standards and best security practices are analysed and discussed. A multiple level security framework as an effective approach in outsourcing domain is addressed.

Findings

It is found that IS security risks can be effectively identified, monitored and evaluated by the concept of a layered security model that fits best in the complex outsourcing domain. There are three levels of security, first guidelines of technical security, second risk analysis and, third compliance and evaluation criteria, including managing information security.

Originality/value

The approach could be used to integrate IS security with service level agreements. Outsourcing vendors with security certifications, strong security adherence systems and optimal disaster recover plans will have a competitive edge in the industry.

Citation

Razvi Doomun, M. (2008), "Multi‐level information system security in outsourcing domain", Business Process Management Journal, Vol. 14 No. 6, pp. 849-857. https://doi.org/10.1108/14637150810916026