Another good thing to be specific about with them is how they're going to deal with any problems that might occur. No matter what you're doing, if it's a call center or if it's development, there will be problems at some point. And especially if they're doing some monitoring of your network or infrastructure, you want to know that you've got an alert path in place and that that actual problem is going to be escalated up to the right person at the right time. So, for example, if they're doing network infrastructure monitoring and a patch needs to be applied or a service has been tampered with, what should they do? Do they shut the service down? You need to know that someone from that vendor can contact somebody within your organization, get a resolution, get accountability, rather than it happening after the fact. For example, it's a month later and you say, "Why was this system never patched?"

"We don't know, we thought somebody knew about it."

You don't want these kinds of things to fall on the floor, so that accountability path is really important.

Another thing is quantifying what kind of remuneration they're going to give you if there is a down time, if there is data loss. I said earlier that it's very hard to outsource your reputational risk or to transfer your reputational risk, which is true. Something that is fixed in a lot of people's minds is last August, when the Veterans Administration lost a lot of patient insurance claim data, but it wasn't directly the Veterans Administration that did itit was their subcontractor, Unisys. But we associate that breach with the Veterans Administration. So you can't quantify necessarily the cost of reputational risk, but you could start to put some kind of a number on it.

What you might be able to quantify more easily is, what's the cost of down time? What if your users can't use that system? What if it's a call center for reservations, but those reservations can't be made. What would that cost your business? And put that into the SLA. We want to have that amount of money come back to us in the event of data loss or in the event of a service not being available.

CSOonline.com: Is there anything that someone might not know, might not even think to ask about?

Kelley: The number one thing is that very often companies have not sat down and thought about what the real risk is associated with the information that they're outsourcing. Your vendor could be very, very adept at what they're doing. They could actually have better processes and better security than you do, but you can't just trust that blindly. You still have to get a handle on the level of risk management you require, and then make sure that that outsourcer's up to it.