CSO —

Today, mitigating outsourcing security risks is more important than ever. In an interview with Associate Online Editor Diann Daniel, Burton Group Analyst Diana Kelley offers tips on determining risk levels, monitoring your vendor and negotiating service level agreements.

CSOonline.com: How would you describe the security landscape surrounding outsourcing today?

Kelley: I would say that it's a landscape that is becoming more defined and is gaining awareness overall. Companies have learned that they need to be security-aware with outsourcing. And, ultimately, one of the most important lessons is that you can't transfer your reputational risk. If something goes wrong, it's going to come back to you, not necessarily to your outsourcer. So that fantasy of, "I'm not going to have to worry about it anymore, I just give this problem over to somebody else and they'll take care of it," is just not true.

CSOonline.com: Can you give some recommended practices to ensure the highest degree of outsourcing security?

Kelley: The number-one important thing you can do is to understand what it is you're outsourcing. And that sounds kind of simple, right? It's like, well, I'm outsourcing my call center; I'm outsourcing the management of my security. But it goes much deeper than that. It's actually understanding what's implicated in the outsourcing structure from a risk management perspective. So if you're outsourcing datalet's say it is a call centerwell, does that have insurance patient data, personal health data in there? Is it some other personally identifiable information that needs to be protected? You're not just outsourcing a call center, it's the data and the controls around that data that you're also outsourcing.

A call center's also a great example where a company's being represented by the vendor. If the person who's answering that call is not helpful or doesn't have the right information, you associate that with the organization you were trying to reach.

So youre outsourcing a lot of thingsyour reputation, the protection of the data, the risks associated with it, the regulatory compliance requirements around the data or even the business processes that are involved. So number one, you really have just got to get a handle on what it is you're outsourcing and what you need to do to protect that.

CSOonline.com: Which country you're outsourcing to and the particular risk levels of each country, that's important as well?

Kelley: Yes, absolutely, because we have different legal jurisdictions in different countries, even different areas in the same country. We have a number of different requirements here in the U.S., but also around the world there are requirements. So in the U.S., we're used to hearing about the old standards by nowHIPAA and SOX and the privacy disclosure laws that are known under the umbrella of SB 1386. We also have the SEC 17a-4 Rule for brokers and traders. In Canada, for example, they have PIPEDA for privacy; in Japan they're looking at implementing something that's being called JSOX; in the European Union there's the Data Directive. And these different regulations around the world impact what can and can't be done with data and the storage of that data and the processing of that data.

Continue Reading