Don't limit offshore outsourcing security

Most organisations are not doing enough to ensure that adequate security provisions are factored into their outsourced IT service agreements, new research has warned.

According to a study by Meta Group, when dealing with reviews of outsourcer policies such as personnel, physical security, perimeter and remote access, it is crucial for any negotiations to be conducted as early as possible.

"Organisations should institute rigorous security reviews on all IT services procurements, regardless of provider," said Meta Group IT security analyst, Tom Scholtz, in a statement.

"Some offshore engagements have a few more areas of scrutiny (local laws and legal recourse) than similar onshore engagements, but otherwise there's little difference.

"In fact, some of the offshore outsourcers are actually doing more on the security front than their local counterparts."

The analyst advised companies interested in offshore IT outsourcing - particularly application development/maintenance and business process outsourcing - not to limit security reviews to their home country's domestic standards.

Offshore outsourcers, Meta pointed out, may pose some unique and unknown security concerns, such as differences in regulations, legal protections and recourse between the customer's and outsourcer's home countries.

But these can often be offset by policy statements and enumeration of appropriate penalties.