So you need to be aware of what kind of requirements are extant in the jurisdictions that you're outsourcing to, as well as what kind of legal recourse you may have. It could be that if someone loses your data in the country you're used to doing business in, you're used to the legal system and the kind of recourse that you have within your own legal system. But other legal systems around the world may operate differently, so you want to understand that as well, because you don't want to be in a situation where they lose your data but you don't have any legal recourse to either get your data back or have some sort of remuneration for the damage that was potentially done.

Another thing that's important about different countries in the world is that we have different levels of geographic stability. For example, there are flood zones in certain areas of certain countries or tornado areas. There are different levels where the power grids are more stable or less stable, so you also want to assess those kinds of things.

CSOonline.com: That said, work is being outsourced to China, for example, where intellectual property theft is an issue, and there are issues with each country. How is it that you would protect yourself if you can't fall back on the legal system in that country?

Kelley: Well, you could, one, just not do business with that country if you don't feel comfortable with their legal regulations or your recourse there.

You could work off of an SLA, or service level agreement, that specifies explicit constraints. Even if you do that SLA, it really does bear considering. I would also have the lawyer review the SLA, and find out what your true recourse is. If you're doing business with a country where you don't like the controls or the legal process, then you might really want to think twice about that, especially if it's highly sensitive data.

CSOonline.com: With what actions can companies combat the out-of-sight, out-of-mind mentality that outsourcing enables?

Kelley: You really do need to have that transparency into outsourcing, no matter who or where you're outsourcing to (even in your own country).  Some of the things you can do up front is to get an idea of how this business actually approaches risk. Do they go through regular audits such as a FAS 70 type 2 audit? Do they use a particular risk assessment methodology, and are they certified against using that? So BS 7799 is an example, or ISO 27001 is another option. So you can get a handle on what their procedures are; you can read their processes and procedures that theyll share with you.