Thu, November 13, 2008 — CSO — As organizations pursue cost savings and operational efficiencies with their existing business processes, they often turn to service providers either in their home countries or abroad to reap additional cost savings associated with factors such as lower wages, lower operating costs and workers with experience that may not be available in-house. Alternatively, some organizations choose to move their operations to off-shore locations but retain control over their infrastructure, staff and processes. In either case, organizations need to manage the risks associated with safeguarding their assets and their information while complying with the various regulations and laws that govern their industry.

All business initiatives have an associated degree of risk. The risk associated with safeguarding the confidentiality, integrity and availability of information assets is a component of the overall business risk picture for all organizations worldwide. Ensuring that people, processes and technology are properly managed to address this risk is a challenge faced by information security professionals. There are, however, some unique risks associated with outsourcing that need to be addressed by various organizational stakeholders to avoid pitfalls. These risks include:

• Political and country risk: if the outsourcing is going to be done in a country other than the country in which the sourcing organization is located, it may be necessary to examine the political environment of the service provider's country.
• Cultural risk is introduced with language differences, varying communication protocols, differing work ethics and cultural norms. Organizations may be vulnerable to different types of ethics associated with information sharing.
• Contractual risk: if contracts are not specific or flexible enough to accommodate changes in the business environment, the organization may face risks. In addition, the viability of enforcing the contracts if the service provider is in a location other than their home country may be difficult.
• Operations risk: organizations face the risk of sub-par level service quality, cost overruns or business interruptions. Information security risk and compliance risks are often subsumed under operational risk.
• Compliance risk: the sanctions and/or material loss of any kind that any organization may experience if it fails to comply with the set of laws, industry standards and internal requirements that govern its environment/sector. For the purpose of this definition, reputational risk is considered part of material risk. (Source: Basel Committee on Banking Supervision — April 2005)
• Business Continuity Risk: the risk associated with an organization's ability to recover and/or restore partially or completely interrupted critical function(s) within a predetermined time after a disaster or extended disruption.