Orig­i­nal source pub­li­ca­tion: Dhillon, G., R. Chowd­huri and F. de Sá-Soares (2013). Secure Out­sourc­ing: An Inves­ti­ga­tion of the Fit between Clients and Providers. In Janczewski, L. J., H. B. Wolfe and S. Shenoi (Eds.), Pro­ceed­ings of the 28^th IFIP TC 11 Inter­na­tional Con­fer­ence—Secu­rity and Pri­vacy Pro­tec­tion in Infor­ma­tion Pro­cess­ing Sys­tems—SEC 2013, 405–419. Auck­land (New Zeland). Springer 2013 IFIP Advances in Infor­ma­tion and Com­mu­ni­ca­tion Tech­nol­ogy, ISBN: 978-3-642-39217-7.
The final pub­li­ca­tion is avail­able here.

Secure Out­sourc­ing: An Inves­ti­ga­tion of the Fit between Clients and Providers

Gur­preet Dhillon^a, Romilla Chowd­huri^a and Fil­ipe de Sá-Soares^b

^a Vir­ginia Com­mon­wealth Uni­ver­sity, Rich­mond, USA
^b Uni­ver­si­dade do Minho, Por­tu­gal

1. Introduction

Infor­ma­tion secu­rity is a sig­nif­i­cant stick­ing point in estab­lish­ing a rela­tion­ship between Infor­ma­tion Tech­nol­ogy (IT) out­sourc­ing ven­dors and clients. While sta­tis­tics related to out­sourc­ing risks and fail­ures are abound, there has been a lim­ited empha­sis on under­stand­ing infor­ma­tion secu­rity related rea­sons for out­sourc­ing prob­lems. We believe that many of the prob­lems stem from a lack of fit between what IT out­sourc­ing ven­dors con­sider to be the key suc­cess fac­tors and what out­sourc­ing clients per­ceive to be crit­i­cal for the suc­cess of the rela­tion­ship. It is impor­tant to under­take such an inves­ti­ga­tion because of two pri­mary rea­sons. First, major­ity of IT out­sourc­ing projects fail because of a lack of appre­ci­a­tion as to what mat­ters to the clients and the ven­dors [Barthélemy 2001; Kaiser and Hawk 2004]. Sec­ond, sev­eral IT out­sourc­ing projects fall vic­tim to secu­rity breaches because of a range of issues—bro­ken processes, fail­ure to appre­ci­ate client require­ments [Earl 1996], among oth­ers. If strate­gic align­ment between IT out­sourc­ing ven­dors and clients were main­tained many of the secu­rity chal­lenges could be over­come.

A first step in ensur­ing a strate­gic fit with respect to infor­ma­tion secu­rity is to iden­tify as to what is impor­tant for the ven­dors and the clients respec­tively. In this paper we under­take an exten­sive Del­phi study to iden­tify infor­ma­tion secu­rity issues related to both the ven­dors and the clients. This is fol­lowed up by an inten­sive analy­sis of the issues through in depth inter­views with sev­eral client and ven­dor firms.

2. Informing Literature

In recent years there have been sev­eral secu­rity breaches where pri­vacy and con­fi­den­tial­ity of data has been com­pro­mised largely because there was a lack of con­trol over the remote sites. In 2011 an Irish hos­pi­tal reported breach of patient infor­ma­tion related to tran­scrip­tion ser­vices in the Philip­pines. In another US Gov­ern­ment Account­ing office sur­vey it was reported that at least 40 per­cent of fed­eral con­trac­tors and state Medicare agen­cies expe­ri­enced a pri­vacy breach (see GAO-06-676)¹. While it is manda­tory for the con­trac­tor to report breaches, there is lim­ited over­sight. Given the chal­lenges many cor­po­ra­tions have begun imple­ment­ing a range of tech­ni­cal con­trols to ensure secu­rity of their own infra­struc­tures rather than rely on the ven­dors.

In address­ing the secu­rity chal­lenges in out­sourc­ing rela­tion­ships or for that mat­ter any kind of a risk, man­age­ment of client-ven­dor rela­tion­ship has been argued as impor­tant. Dib­bern et al. [2004] pro­vide ref­er­ences to the lit­er­a­ture that mainly dis­cuss the phases of rela­tion­ship between client and ven­dor and the issues involved in each of the phases. For exam­ple, Rela­tion­ship Struc­tur­ing involves issues deemed impor­tant when the out­sourc­ing con­tract is being pre­pared, Rela­tion­ship Build­ing dis­cuss issues that con­trib­ute to strength­en­ing the rela­tion­ship between client and ven­dor, and Rela­tion­ship Man­age­ment involve issues that are rel­e­vant to drive the rela­tion­ship in the right direc­tion. Lac­ity et al. [2010] list 25 inde­pen­dent vari­ables that can impact the rela­tion­ship between out­sourc­ing client and ven­dor. The most cited fac­tors include effec­tive knowl­edge shar­ing, cul­tural dis­tance, trust, prior rela­tion­ship sta­tus, and com­mu­ni­ca­tion.

Stud­ies related to secure out­sourc­ing have been few and far between. In major­ity of the cases the empha­sis has been on con­trac­tual aspects of the rela­tion­ship between the client and the ven­dor. And many researchers have made calls for clar­ity in con­tracts as well as selec­tive out­sourc­ing [Lac­ity and Will­cocks 1998]. Man­ag­ing the IT func­tion as a value cen­ter [Venka­tra­man 1997] has also been pro­posed as a way for ensur­ing suc­cess of out­sourc­ing arrange­ments. There is no doubt that prior research has made sig­nif­i­cant con­tri­bu­tion to the man­ner in which advan­tages can be achieved from out­sourc­ing rela­tion­ships, how­ever there has been lim­ited con­tri­bu­tion with respect to man­age­ment of secu­rity and pri­vacy.

Kern et al. [2002] con­sid­ered secu­rity of inter­net as one of the tech­no­log­i­cal risks. Khal­fan [2004] reported the results of a study in which secu­rity issues related to data con­fi­den­tial­ity, integrity and avail­abil­ity emerged as the top­most con­cerns in an out­sourc­ing arrange­ment. While few sur­veys report com­puter net­works, reg­u­la­tions and per­son­nel as the high­est secu­rity threats to orga­ni­za­tions [Chang and Yeh 2006] oth­ers rec­og­nize that not only tech­ni­cal but also non-tech­ni­cal threats can be detri­men­tal to an engage­ment [Chang and Yeh 2006; Dlamini et al. 2009; Pia and Basu 2007]. How­ever, most of the work cited under the domain of IS out­sourc­ing risks is generic and has a very lim­ited focus on secu­rity [Earl 1996; Sak­thivel 2007]. Sev­eral researchers have pro­vided the frame­works to iden­tify the orga­ni­za­tional assets at risk and to use finan­cial met­rics to deter­mine pri­or­ity of assets that need pro­tec­tion [Bojanc and Jer­man-Blazic 2008; Osei-Bryson and Ngwenyama 2006]. Col­will and Gray [2007] pro­vide a list of secu­rity threats preva­lent in an out­sourc­ing or off­shore envi­ron­ment and review risk man­age­ment mod­els. The polit­i­cal, cul­tural and legal dif­fer­ences between sup­plier and provider envi­ron­ment are sup­posed to make the envi­ron­ment less favor­able for oper­a­tors. Doomun [2008] pro­posed a multi-layer secu­rity model to mit­i­gate the secu­rity risks in out­sourc­ing domains. Eleven steps in an out­sourc­ing arrange­ment are divided across three lay­ers of secu­rity: iden­ti­fi­ca­tion, mon­i­tor­ing and improve­ment, and mea­sure­ment. And each layer addresses both tech­ni­cal and non­tech­ni­cal require­ments of secu­rity.

Wei and Blake [2010] pro­vided a com­pre­hen­sive list of infor­ma­tion secu­rity risk fac­tors involved in an out­sourc­ing IT projects and also pro­vide safe­guards for IT off­shore out­sourc­ing. Mostly, the risks iden­ti­fied in the study were bor­rowed from pre­vi­ous lit­er­a­ture. More recently, Nas­sim­beni et al. [2012] cat­e­go­rized the secu­rity risks into three phases: strate­gic plan­ning, sup­plier selec­tion and con­tract­ing, imple­men­ta­tion and mon­i­tor­ing. How­ever, the set of issues have been mainly bor­rowed from exist­ing lit­er­a­ture. Some of the researchers have also clas­si­fied the risks as exter­nal and inter­nal threats to an orga­ni­za­tion and human and non-human risks. Non­tech­ni­cal con­cerns such as employ­ees, reg­u­la­tions, trust have emerged as more severe than the tech­no­log­i­cal risks [Loch et al. 1992; Posthu­mus and von Solms 2004; Tickle 2002; Tran and Atkin­son 2002]. As such few stud­ies are con­cerned with a spe­cific type of secu­rity con­cern such as poli­cies [Ful­ford and Doherty 2003].

While the preva­lent IT out­sourc­ing research has cer­tainly helped in bet­ter under­stand­ing the client-ven­dor rela­tion­ships, an aspect that has largely remained unex­plored is that of orga­ni­za­tional fit. In the IT strat­egy domain orga­ni­za­tion fit has been explored in terms of align­ment between IT strat­egy and the busi­ness strat­egy [Hen­der­son and Venka­tra­man 1993]. In the strat­egy lit­er­a­ture it has been stud­ied in terms of the fit between an orga­ni­za­tion’s struc­ture and its strat­egy. Even though [Livari 1992] made a call for under­stand­ing orga­ni­za­tional fit of infor­ma­tion sys­tems with the con­text, lit­tle progress has been made to date.

In the con­text of IT out­sourc­ing the notion of the fit between a client and the ven­dor has also not been well stud­ied. Nightin­gale and Toulouse [1977] have sug­gested that fit can be under­stood through the ele­ments of con­gru­ence the­ory, which explains the inter­ac­tions among orga­ni­za­tional envi­ron­ment, val­ues, struc­ture, process and reac­tion-adjust­ment. Based on con­gru­ence the­ory, an out­sourc­ing envi­ron­ment thus can be defined as the exis­tence of any con­di­tion such as cul­ture, reg­u­la­tions, provider/sup­plier capa­bil­i­ties, secu­rity, and com­pe­tence that can deter­mine the suc­cess of an out­sourc­ing arrange­ment. Orga­ni­za­tional val­ues deter­mine the accept­able and unac­cept­able behav­ior. In this respect fac­tors such as trust, trans­parency and ethics fall under the value sys­tem of an orga­ni­za­tion. Struc­ture of an out­sourc­ing arrange­ment defines the fac­tors such as report­ing hier­ar­chy, own­er­ship and processes for com­mu­ni­ca­tion. Addi­tion­ally reac­tion-adjust­ments are required, which entail the feed­back and out­comes of an engage­ment and the related mod­i­fy­ing strat­egy in response to the reac­tions of clients for a bet­ter strate­gic fit and alliance between out­sourc­ing clients and ven­dors.

Clearly the exist­ing lit­er­a­ture on iden­ti­fi­ca­tion and mit­i­ga­tion of secu­rity risks is rich. The secu­rity risks at tech­ni­cal, human and reg­u­la­tory lev­els are well iden­ti­fied; many of the stud­ies high­light that non-tech­ni­cal risks are more severe than the tech­ni­cal ones. How­ever, the lit­er­a­ture is short of two per­spec­tives: First, gap analy­sis of how out­sourc­ing clients and out­sourc­ing ven­dors per­ceive the secu­rity risks does not exist. Sec­ond, the exist­ing lit­er­a­ture does not dis­cuss much about the con­gru­ence among dif­fer­ent con­cepts in an out­sourc­ing arrange­ment, par­tic­u­larly in the secu­rity domain. Hence to deter­mine a fit between sup­pli­ers and clients, we need to under­stand as to what secu­rity issues are impor­tant to the clients and the ven­dors and then to estab­lish a basis for their con­gru­ence.

3. Research Methodology

Given that the pur­pose of this study was to iden­tify secu­rity con­cerns amongst out­sourc­ing clients and ven­dors, a two-phased approach was adopted. In the first instance a Del­phi study was under­taken. This helped us in iden­ti­fy­ing the major secu­rity issues as per­ceived by the clients and the ven­dors. In the sec­ond phase an in depth analy­sis of clients and ven­dors was under­taken. This helped us in under­stand­ing the rea­sons for sig­nif­i­cant dif­fer­ences in their per­cep­tions.

3.1 Phase 1—A Delphi study

To ensure a reli­able and val­i­dated list of issues that are of con­cern to the orga­ni­za­tions, both from client and provider per­spec­tive, a process to inquire and seek the diver­gent opin­ions of dif­fer­ent experts is pro­vi­sioned in the first phase. A rank­ing method based on Schmidt’s Del­phi method­ol­ogy, designed to elicit the opin­ions of panel of experts through con­trolled inquiry and feed­back, is employed [Schmidt 1997]. Del­phi study allowed fac­tors to con­verge to the ones that really are impor­tant in out­sourc­ing infor­ma­tion tech­nol­ogy secu­rity.

Panel Demographics

To account for vary­ing expe­ri­ences, and role of experts, both out­sourc­ing ven­dors or providers and out­sourc­ing clients or sup­pli­ers were cho­sen as the tar­get pan­elists. A total of 11 pan­elists were drawn from the pool of 21 prospec­tive par­tic­i­pants. We iden­ti­fied senior IS exec­u­tives from major cor­po­ra­tions and asked them to iden­tify the most use­ful and expe­ri­enced peo­ple to par­tic­i­pate in the sur­vey. The par­tic­i­pants were divided into two groups—Out­sourc­ing Providers (5) and Out­sourc­ing Sup­pli­ers (6). The pan­elists had impres­sive and var­ied expe­ri­ences in IT out­sourc­ing and man­age­ment. The num­ber of pan­elists suf­fices the require­ment of elic­it­ing diverse opin­ions and pre­vents the pan­elists from being intim­i­dated with the vol­ume of feed­back. More­over, the com­par­a­tive size of the two pan­els is irrel­e­vant since it doesn’t have any impact on the response analy­sis. For detect­ing sta­tis­ti­cally sig­nif­i­cant results, the group size is depen­dent on the group dynam­ics rather than the num­ber of par­tic­i­pants; there­fore, 10 to 11 experts is a good sam­ple size [Okoli and Pawlowski 2004].

Data Collection

The data col­lec­tion phase is informed by Schmidt’s [1997] method, which divides the study into three major phases. The first round - brain­storm­ing or blank sheet round—was con­ducted to elicit as many issues as pos­si­ble from each pan­elist. Each par­tic­i­pant was asked to pro­vide at least 6 issues along with a short descrip­tion. The authors col­lated the issues by remov­ing dupli­cates. The com­bined list was sent to pan­elists explain­ing why cer­tain items were removed and fur­ther asked the pan­elists for their opin­ion on the integrity and uni­for­mity of the list. In the sec­ond round we asked each pan­elist to pare down the list to most impor­tant issues. A total of 26 issues were iden­ti­fied which were sent to pan­elists for fur­ther eval­u­a­tion, addi­tion, dele­tions and/or ver­i­fi­ca­tion. This is to ensure that a com­mon set of issues is pro­vided for the pan­elist to rank in sub­se­quent rounds. Rank­ing of the final 26 issues was done in phase 3. Dur­ing this phase each pan­elist was required to rank the issues in order of impor­tance with 1 being the most impor­tant secu­rity issue and 26 being the least impor­tant secu­rity issue in out­sourc­ing. The pan­elists were restricted to have the ties between two or more issues.

Mul­ti­ple rank­ing rounds were con­ducted until a con­sen­sus was achieved. To avoid bias a ran­domly ordered set of issues was sent to each pan­elist in the first rank­ing round. For the sub­se­quent rounds, the lists were ordered by aver­age ranks. In this study, we used Kendall’s Coef­fi­cient of Con­cor­dance W to eval­u­ate the level of agree­ment among respon­dents’ opin­ions in a given round. Accord­ing to Schmidt [1997] ‘W’ can range between 0.1 (very weak agree­ment) and 0.9 (unusu­ally strong agree­ment). More­over, Spear­man’s Rank Cor­re­la­tion Coef­fi­cient rho is used to eval­u­ate the level of sta­bil­ity of the panel’s opin­ion between two suc­ces­sive rounds and between two dif­fer­ent groups of respon­dents in a given round. The value of rho can range between -1 (per­fect neg­a­tive cor­re­la­tion) and 1 (per­fect pos­i­tive cor­re­la­tion) Sub­se­quent rank­ing rounds are stopped either if Kendall’s Coef­fi­cient of Con­cor­dance W indi­cated a strong con­sen­sus (>0.7) or if the level of con­sen­sus lev­eled off in two suc­ces­sive rounds.

At the end of every rank­ing round, five impor­tant pieces of feed­back were sent to pan­elists: (1) mean rank for each issue; (2) level of agree­ment in terms of Kendall’s W; (3) Spear­man cor­re­la­tion rho, (4) P-value; (5) rel­e­vant com­ments by the pan­elists.

Data Analysis

The analy­sis of the results was per­formed in two parts: First, an analy­sis of aggre­gated Del­phi study treats all respon­dents as a global panel and thus presents the uni­fied rank­ing results. Sec­ond, an analy­sis of par­ti­tioned Del­phi study presents the rank­ing results based on respon­dents group, i.e. out­sourc­ing providers and out­sourc­ing clients.

3.2 Phase 2—Probing for Congruence using Qualitative technique

The sec­ond round of data col­lec­tion was based on two work­shops with rep­re­sen­ta­tives from For­tune 500 com­pa­nies. There were 11 indi­vid­u­als with an aver­age of 8 years of work expe­ri­ence who par­tic­i­pated in these work­shops. The work­shops were con­ducted from May 2012 to July 2012. In the first work­shop, each par­tic­i­pant was required to answer three ques­tions for all 26 issues. Suit­able probes were added fol­low­ing each ques­tion. This helped in devel­op­ing a rich insight.

1. What do you think about the issue?

2. Why do you think it is impor­tant for out­sourc­ing provider?

3. Why do you think it is impor­tant for out­sourc­ing client?

The sec­ond work­shop was con­cen­trated to achieve con­gru­ence between out­sourc­ing sup­pli­ers and out­sourc­ing providers. Dif­fer­ent ranks assigned by clients and ven­dors to par­tic­u­lar issues were high­lighted. The par­tic­i­pants were asked answer two ques­tions so as to elicit their opin­ions on the gaps iden­ti­fied in the rank­ing sought by clients and providers for the issues.

1. Explain what do you think is the rea­son for assign­ing dif­fer­ent ranks by out­sourc­ing clients and out­sourc­ing providers?

2. Explain what can be done to resolve the dif­fer­ence in order to seek a com­mon ground of under­stand­ing between clients and providers?

4. Findings from the Delphi Study

For phase one, the results were ana­lyzed from a global or aggre­gated view and par­ti­tioned or client vs. ven­dor view. The global panel reached a weak con­sen­sus by third rank­ing round (see Table 1).

Table 1: Global Con­sen­sus

On the other hand, by the third rank­ing round, Clients had fair agree­ment whereas ven­dors had very weak agree­ment. More­over, a weak pos­i­tive cor­re­la­tion exists between round 2 and round 3 in global rank­ing as well as between clients and providers by round 3 (see Table 2).

Table 2: Client and Ven­dor Con­sen­sus

The weak con­sen­sus in global rank­ing clearly sug­gests that out­sourc­ing clients and out­sourc­ing ven­dors have con­flict of inter­est. More­over, the weak con­sen­sus within ven­dors indi­cates that not all ven­dors per­ceive the impor­tance of secu­rity at same level. And finally the dif­fer­ence between ranks assigned to each issue by clients and ven­dors fur­ther high­light the con­flict of inter­est between two. Table 3 presents a com­par­i­son of the ranks from client and ven­dor per­spec­tives and shows a sig­nif­i­cant divide between the two groups. The issues are sorted com­pos­itely; how­ever, given the sig­nif­i­cant dif­fer­ence for few of the issues, the com­pos­ite rank is irrel­e­vant. For this paper we assume a dif­fer­ence of more than three between the ranks sought by client and ven­dors as sig­nif­i­cant. Thereby, a total of 16 issues out of 26 show sig­nif­i­cant dif­fer­ence between the rank­ings of two groups.

Table 3: Com­par­i­son of Client and Ven­dor ranks (only sig­nif­i­cant issue are pre­sented)

5. Reviewing Congruence amongst Issues

It is inter­est­ing to note that there is a sig­nif­i­cant dif­fer­ence in the client and ven­dor per­spec­tives of the top secure out­sourc­ing issues. In this sec­tion we explore these issues fur­ther to develop a bet­ter under­stand­ing of secure out­sourc­ing. In terms of man­ag­ing secu­rity of out­sourc­ing it makes sense to develop a fit between what the clients and the ven­dors con­sider impor­tant.

Two issues that seem to be of sig­nif­i­cant con­cern for both the client and the ven­dors is of diver­sity of laws and the legal and judi­cial frame­work of the ven­dor’s envi­ron­ment. Both these con­cerns are indeed sig­nif­i­cant. Our dis­cus­sions with a CIO of a major bank in the US, which has out­sourced sig­nif­i­cant amount of IT ser­vices to India, sug­gest juris­dic­tional issues to be a major con­cern. The CIO noted:

I can say with absolute cer­tainty that we have our out­sourc­ing expe­ri­ence has been very pos­i­tive. We found sig­nif­i­cantly high level of com­pe­tence in our ven­dor. How­ever there are con­stant chal­lenges of deal­ing with the reg­u­la­tory envi­ron­ment. Laws in the US are rather strict in terms of dis­clo­sure and we feel that to be an imped­i­ment to get­ting our work done.

The lit­er­a­ture has reported sim­i­lar con­cerns, albeit with respect to main­stream out­sourc­ing issues rather than secu­rity. Pai and Basu [2007] have argued that there are issues of con­for­mance and con­trac­tual vio­la­tions, which can have a detri­men­tal impact on out­sourc­ing rela­tion­ships. It is inter­est­ing to note though that both issues 10 and 14 rank higher amongst the clients than the ven­dors. It seems that reg­u­la­tory com­pli­ance and preva­lence of a judi­cial frame­work is more of a con­cern to the out­sourc­ing clients than the ven­dors. Another IT man­ager in our study com­mented:

Increased trans­parency regard­ing the laws gov­ern­ing the ven­dor may mit­i­gate the risk for the client. How­ever, the bur­den is on the ven­dor to reas­sure the client that the risk is min­i­mal. There­fore the ven­dor should be sup­ply­ing as much infor­ma­tion to reas­sure the client that they are work­ing under the same legal con­text and that their legal agree­ments are mutu­ally ben­e­fi­cial.

In the lit­er­a­ture sev­eral calls have been made that sug­gest clar­ity of legal and reg­u­la­tory frame­works (e.g. [Raghu 2009]). Beyond clar­ity how­ever there is a need to work on align­ing the legal and reg­u­la­tory frame­works at a national level. Coun­try spe­cific insti­tu­tions shall play a crit­i­cal role ensur­ing such align­ment (e.g. NASS­COM in India). To bet­ter mit­i­gate the risks and to ensure that the inter­est of both par­ties are secured, there needs to be increased trans­parency in legal struc­ture. The bur­den lies on the sup­plier though. There­fore the ven­dor should be mak­ing avail­able as much infor­ma­tion to reas­sure the client that they are work­ing under the same legal con­text and that their legal agree­ments are mutu­ally ben­e­fi­cial. As a prin­ci­ple we there­fore pro­pose:

Prin­ci­ple 1—Reduc­ing the diver­sity of laws and ensur­ing con­gru­ence of leg­isla­tive con­trols ensure secu­rity in out­sourc­ing.

Another issue, dis­si­pa­tion of out­sourc­ing ven­dors knowl­edge, emerged to be sig­nif­i­cant. While this issue seems more crit­i­cal for the ven­dors, there are some sig­nif­i­cant impli­ca­tions for the client firms as well. Ven­dors believe that because of the unto­ward need to com­ply with the whims and fan­cies for the clients, there is usu­ally a dis­si­pa­tion of the knowl­edge over a period of time. One of the mem­bers of our inten­sive study was the coun­try head for a large Indian out­sourc­ing ven­dor. When asked to com­ment of this issue, he said:

The out­sourc­ing indus­try has a seri­ous prob­lem. While we have our own busi­ness processes, we usu­ally have to recre­ate or recon­fig­ure them based on our client needs and wants. We are usu­ally rather happy to do so. How­ever in the process we lose our tacit knowl­edge. From our per­spec­tive it is impor­tant to ensure pro­tec­tion of this knowl­edge. Many of our secu­rity and pri­vacy con­cerns would be man­aged if we got a lit­tle bet­ter in knowl­edge man­age­ment.

Per­haps Will­cocks et al. [2004] are among the few researchers who have stud­ied the impor­tance of pro­tec­tion of intel­lec­tual prop­erty. Most of the empha­sis has how­ever been on pro­tect­ing loss of intel­lec­tual prop­erty–largely of the client firm. Man­age­ment of knowl­edge to pro­tect tacit knowl­edge has also been stud­ied in the lit­er­a­ture (e.g. see [Arora 1996], [Nor­man 2002]), though rarely in con­nec­tion with out­sourc­ing.

It goes with­out say­ing that poor knowl­edge man­age­ment struc­tures will dis­ap­point the prospects of procur­ing of new con­tracts. In com­par­i­son, the clients seem to either assume that the sup­plier has a sus­tain­able struc­ture that pre­vents or min­i­mizes the loss of intel­lec­tual cap­i­tal and ensures con­fi­den­tial­ity or client is ready to bear the risk for the per­ceived poten­tial ben­e­fits. Clients expect skilled resources as a con­tract require­ment. As the risk for clients is min­i­mal, there­fore they rank this in less impor­tance in com­par­i­son to the ven­dor. As Will­cocks et al. men­tion that for the bet­ter man­age­ment of expec­ta­tions, both clients and sup­pli­ers need to under­stand the util­ity of knowl­edge man­age­ment, impli­ca­tions of loss and the struc­tural require­ment. This is also reflected in the com­ments of one of secu­rity assur­ance man­ager:

Sup­pli­ers need to min­i­mize staff turnover and find ways to ensure staff reten­tion and knowl­edge shar­ing. There are many meth­ods to achieve this such as bet­ter wages, ben­e­fits, flex time, encour­age­ment, knowl­edge repos­i­to­ries, edu­ca­tion oppor­tu­ni­ties, etc. They should pair vet­eran staff mem­ber with new staff mem­bers to improve their under­stand­ing of con­fi­den­tial­ity, integrity and avail­abil­ity.

As a prin­ci­ple we there­fore pro­pose:

Prin­ci­ple 2—Tacit knowl­edge man­age­ment and ensur­ing the integrity of ven­dor busi­ness processes is a pre-req­ui­site for good and secure out­sourc­ing.

Our research also found infor­ma­tion secu­rity com­pe­tency of out­sourc­ing ven­dor as a sig­nif­i­cant issue. Many schol­ars have com­mented on the impor­tance of ven­dor com­pe­tence [Goles 2001; Lev­ina and Ross 2003; Will­cocks and Lac­ity 2000]. Lev­ina and Ross [2003] in par­tic­u­lar have argued that value based out­sourc­ing out­come should be gen­er­ated and trans­ferred from the ven­dor to the client. How­ever, as is indica­tive from our study, clients and ven­dors dif­fer in their opin­ions on what is most impor­tant when select­ing and pro­mot­ing out­sourc­ing secu­rity ser­vices. While, ven­dors often believe that prov­ing their com­pe­tency through a large list of cer­ti­fi­ca­tions, awards, and large clien­tele is impor­tant to have to prove their com­pe­tency, the client’s per­spec­tive is geared towards the appli­ca­tion and uti­liza­tion of sup­plier com­pe­tency. One of the IT man­agers from a bank noted:

The ven­dor is expected to be com­pe­tent in their area of exper­tise, so the client needs to make clear to the ven­dor that a basic expec­ta­tion should not be at the top of their list as there are more impor­tant fac­tors that will be used to dif­fer­en­ti­ate the ven­dors from one another.

As is rightly pointed out by the IT Man­ager, the issue with man­ag­ing com­pe­tence is not to present a base­line of what the ven­dor knows (i.e. the skill set), but a demon­stra­tion of the know-that (see [Dhillon 2008]). Assess­ment of com­pe­tence is out­wardly dri­ven and hence a pre­sen­ta­tion of some sort of matu­rity in secu­rity man­age­ment is essen­tial (e.g. ISO 21827). As a prin­ci­ple we pro­pose:

Prin­ci­ple 3—A com­pe­tence in ensur­ing secure out­sourc­ing is to develop an abil­ity to define indi­vid­ual know-how and know-that.

Process is a for­mal­ized sequence of actions guided “infor­mally” by the orga­ni­za­tion’s struc­ture and orga­ni­za­tion’s value sys­tem. There is enough evi­dence in lit­er­a­ture about the impact of process stan­dard­iza­tion on out­sourc­ing suc­cess [Wul­len­we­ber 2008]. How­ever, the vari­a­tions in the ranks of one of the issues iden­ti­fied—abil­ity of out­sourc­ing ven­dor to com­ply with client’s secu­rity poli­cies, stan­dards and processes—is a cause of con­cern. The issue here is indica­tive of the need for facil­i­tat­ing com­mu­ni­ca­tion and coor­di­na­tion required for the align­ment of poli­cies, stan­dards and processes guid­ing infor­ma­tion secu­rity in an out­sourc­ing engage­ment. Clients cer­tainly place high impor­tance on its own poli­cies and processes, giv­ing this issue a higher rank. Mean­while, providers view their poli­cies, pro­ce­dures, and stan­dards as being best-in-class. Clearly the ven­dors seem to be igno­rant of the fact that hav­ing a process frame­work that is not cus­tomiz­able to the indi­vid­ual require­ments of dif­fer­ent clients can be a poten­tial hin­drance. As one of the client notes:

It is great that a com­pany can claim they are com­pe­tent in pro­vid­ing out­sourced infor­ma­tion secu­rity but it means noth­ing to the client unless the client per­ceives their spe­cific poli­cies as being effec­tively applied by the provider.

To elim­i­nate the gap, processes and poli­cies need to be com­pre­hen­sive enough and the con­tracts need to empha­size the impli­ca­tions of non-com­pli­ance. For the sake of con­tin­ued alliance, the respon­si­bil­ity lies more on ven­dor to ensure process com­pli­ance and gov­er­nance. Another man­ager from a client orga­ni­za­tion com­mented:

Clients are usu­ally out­sourc­ing to relieve their work­load and per­form­ing a com­pre­hen­sive analy­sis is viewed as adding to the exist­ing work­load they are try­ing to relieve. The more a poten­tial sup­plier is will­ing to be an active part­ner and point out the pros and cons of their own pro­pos­als as well as the oth­ers, the smaller the gap will be.

As a prin­ci­ple, we pro­pose:

Prin­ci­ple 4—Estab­lish­ing con­gru­ence between client and ven­dor secu­rity poli­cies ensures pro­tec­tion of infor­ma­tion resources and a good work­ing arrange­ment between the client and the ven­dor.

If lever­ag­ing the core com­pe­tency of sup­pli­ers is the main motive to out­source secu­rity oper­a­tions, the lower rank­ing by clients for the issue—audit of out­sourced infor­ma­tion secu­rity oper­a­tions—is jus­ti­fied. Clients expect com­pe­tency of the out­sourc­ing ven­dor to be in place. How­ever, clients also seem to lack con­sen­sus on the need for con­tin­ued mon­i­tor­ing and gov­er­nance pro­ce­dures. Audit­ing is one of the means for the client to ver­ify whether the ven­dor is adher­ing to the secu­rity poli­cies. Ven­dors by virtue of pro­vid­ing a higher rank in com­par­i­son to clients, appear to be aware of the impor­tance of prov­ing con­tin­ued com­pli­ance with agree­ments. Pro­vid­ing audited or auditable infor­ma­tion relat­ing to the clients data and processes is a must for estab­lish­ing trust. Much of the research in IS out­sourc­ing has focused on dif­fer­ent dimen­sions of gov­er­nance pro­ce­dures includ­ing con­tracts, and non-con­trac­tual mech­a­nisms of trust build­ing [Miranda and Kavan 2005]. Audit­ing and third party assur­ance, which leads to increased trust (see issues 4 and 9 in our study), typ­i­cally do not seem to be touched upon.

A related issue (and also con­nected to prin­ci­ple 4 above) is that of a com­pe­tence audit. Any audit of ven­dor oper­a­tions must include sev­eral aspects includ­ing—over­all com­pe­tence in infor­ma­tion secu­rity (issue 15 in our study) and qual­ity of ven­dor staff (issue 13). Our research sub­jects reported sev­eral instances where there was a gen­eral loss of com­pe­tence over a period of time. This usu­ally occurs when either the ven­dor orga­ni­za­tion gets too entrenched with one client and hence over­look­ing the needs of the other or when inter­nal processes are patched and recon­fig­ured in a reac­tive man­ner to ensure com­pli­ance with the expec­ta­tions of a given client (refer to issue 5 in our study). One Chief Infor­ma­tion Secu­rity Offi­cer from a health­care orga­ni­za­tions com­mented:

There seems to be this half-life of a secu­rity com­pe­tence. I have seen that after a con­tract has been signed, there is a some­what expo­nen­tial decay in qual­ity.

In the lit­er­a­ture there is some men­tion of such decay in qual­ity, although not directly in rela­tion to out­sourc­ing (e.g. see [Ster­man et al. 1997]). Ster­man et al [1997] found that many of the qual­ity improve­ment ini­tia­tives can inter­act with pre­vail­ing sys­tems and rou­tines to under­cut com­mit­ment to con­tin­u­ous improve­ment. While our research does not sug­gest this to be the case in terms of secure out­sourc­ing, the dif­fer­ences in opin­ion between the clients and the ven­dors seem indica­tive. As a prin­ci­ple we there­fore pro­pose:

Prin­ci­ple 5—An inter­nal audit of both the client and ven­dor oper­a­tions is crit­i­cal to under­stand cur­rent weak­nesses and poten­tial prob­lems there might be with respect to infor­ma­tion secu­rity struc­tures, pro­ce­dures and capa­bil­i­ties.

Based on our research, two major con­structs seem to emerge–strate­gic con­text of secure out­sourc­ing and orga­ni­za­tional capa­bil­ity in out­sourc­ing (Fig­ure 1). The strate­gic con­text is defined by legal/reg­u­la­tory con­gru­ence and secu­rity pol­icy align­ment. In our con­text orga­ni­za­tional capa­bil­ity is a func­tion of knowl­edge man­age­ment, com­pe­tence and audit. Com­bined together, our con­structs define secu­rity con­gru­ence. The level of con­gru­ence how­ever can only be assessed through out­come mea­sures (secure out­sourc­ing). Such out­come mea­sures could include reduced inci­dents of secu­rity breaches, high ranks from exter­nal vet­ting orga­ni­za­tions etc.

Fig­ure 1: Mod­el­ing Secu­rity Con­gru­ence

A cen­tral theme in orga­ni­za­tion strat­egy lit­er­a­ture is that of “fit”. Find­ings from our research seem to be in res­o­nance with that body of work. For instance, and as noted pre­vi­ously, Nightin­gale and Toulouse [1977] com­ment on the mutual inter­ac­tion amongst val­ues, struc­ture, process, reac­tion-adjust­ment and envi­ron­ment leads to the con­gru­ent orga­ni­za­tion.

In the con­text of secu­rity of infor­ma­tion resources, the need to develop a fit between out­sourc­ing part­ners seems to be appro­pri­ate. Sig­nif­i­cant vari­a­tions in the rank­ings on part of ven­dor raise some doubts: if they value the sen­si­tiv­ity of client data; if they ensure ade­quate pro­tec­tion of the assets; if the ven­dor is aware of the vul­ner­a­bil­i­ties in their processes. All these issues would also raise con­cern about the atti­tude of the client, par­tic­u­larly in rela­tion to shun­ning respon­si­bil­i­ties. This can indeed be a clas­sic exam­ple of strife between fac­tions of afford­abil­ity and avail­abil­ity.

In order to achieve the con­gru­ence between clients and ven­dors, the dis­cus­sion so far leads to the emer­gence of one main theme—man­ag­ing expec­ta­tions. In the purview of con­gru­ence the­ory this requires elim­i­na­tion of gaps between the two par­ties and even­tu­ally align the two orga­ni­za­tions (in our case around strat­egy and capa­bil­ity as per fig­ure 1). Fig­ure 1 pro­vides a con­cep­tual design of such an aligned orga­ni­za­tion. For bet­ter man­age­ment of expec­ta­tions, the sup­plier and ven­dor orga­ni­za­tions need to com­mu­ni­cate and coor­di­nate their respec­tive oper­a­tions.

Both the orga­ni­za­tions align to the required dimen­sions and in effect over­time the two orga­ni­za­tions involved in an out­sourc­ing con­tract appear to be one “vir­tual” orga­ni­za­tion, which has just one goal—deliv­er­ing ser­vices in a secure man­ner (i.e. secure out­sourc­ing). As long as a gap exists in processes, struc­ture or val­ues between the two orga­ni­za­tions, the align­ment is ques­tion­able. The time taken by the two orga­ni­za­tions to align—align­ment latency would be a crit­i­cal suc­cess fac­tor of a secured out­sourc­ing engage­ment.

6. Conclusion

In this paper we have pre­sented an in depth study of secure out­sourc­ing. We argued that while sev­eral schol­ars have stud­ied the rel­a­tive suc­cess and fail­ure of IT out­sourc­ing, the emer­gent secu­rity issues have not been addressed ade­quately. Con­sid­er­ing this gap in the lit­er­a­ture we con­ducted a Del­phi study to iden­tify the top secu­rity out­sourc­ing issues from both the clients and the ven­dors per­spec­tives. Finally we engaged in an inten­sive study to under­stand why there was a sig­nif­i­cant dif­fer­ence in rank­ing of the issues by the ven­dors and the clients. This in depth under­stand­ing lead us to pro­pose five prin­ci­ples that orga­ni­za­tions should adhere to in order to ensure secu­rity of out­sourc­ing rela­tions. A model for secu­rity con­gru­ence is also pro­posed. While we believe there to be a pos­i­tive cor­re­la­tion amongst the pro­posed con­structs, clearly fur­ther research is nec­es­sary in this regard.

Secure out­sourc­ing is an impor­tant aspi­ra­tion for orga­ni­za­tions to pur­sue. There is no doubt that many busi­nesses thrive on get­ting part of their oper­a­tions taken care of by a ven­dor. It not only makes busi­ness sense to do so, but it also allows enter­prises to tap into the exper­tise that may reside else­where. Secu­rity then is sim­ply a means to ensure smooth run­ning of the busi­ness. And def­i­n­i­tion of the per­ti­nent issues allows us to strate­gi­cally plan secure out­sourc­ing rela­tion­ships.

References

• Arora, A. (1996). Con­tract­ing for tacit knowl­edge: the pro­vi­sion of tech­ni­cal ser­vices in tech­nol­ogy licens­ing con­tracts. Jour­nal of Devel­op­ment Eco­nom­ics 50(2), 233–256.

  Barthelemy, J. (2001). The hid­den costs of IT out­sourc­ing. MIT Sloan Man­age­ment Review 42(3), 60–69.

  Beth, T., M. Borcherd­ing and B. Klein (1994). Val­u­a­tion of trust in open net­works. Com­puter Secu­rity—ESORICS 94, 1–18.

  Bojanc, R. and B. Jer­man-Blažič (2008). An eco­nomic mod­el­ling approach to infor­ma­tion secu­rity risk man­age­ment. Inter­na­tional Jour­nal of Infor­ma­tion Man­age­ment 28(5), 413–422

  Chang, A. J. T.a nd Q. J. Yeh (2006). On secu­rity prepa­ra­tions against pos­si­ble IS threats across indus­tries. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 14(4), 343–360.

  Col­will, C. and A. Gray (2007). Cre­at­ing an effec­tive secu­rity risk model for out­sourc­ing deci­sions. BT Tech­nol­ogy Jour­nal 25(1), 79–87.

  Dhillon, G. (2008). Orga­ni­za­tional com­pe­tence in har­ness­ing IT: a case study. Infor­ma­tion & Man­age­ment 45(5), 297–303.

  Dhillon, G. and G. Torkzadeh (2006). Value­‐focused assess­ment of infor­ma­tion sys­tem secu­rity in orga­ni­za­tions. Infor­ma­tion Sys­tems Jour­nal 16(3), 293–314.

  Dib­bern, J., T. Goles, R. Hirschheim and B. Jay­ati­laka (2004). Infor­ma­tion sys­tems out­sourc­ing: a sur­vey and analy­sis of the lit­er­a­ture. ACM SIG­MIS Data­base 35(4), 6–102.

  Dlamini, M. T., J. H. Eloff and M. M. Eloff (2009). Infor­ma­tion secu­rity: The mov­ing tar­get. Com­put­ers & Secu­rity 28(3), 189–198.

  Doomun, M. R. (2008). Multi-level infor­ma­tion sys­tem secu­rity in out­sourc­ing domain. Busi­ness Process Man­age­ment Jour­nal 14(6), 849–857.

  Earl, M. J. (1996). The risks of out­sourc­ing IT. Sloan Man­age­ment Review 37, 26–32.

  Ful­ford, H. and N. F. Doherty (2003). The appli­ca­tion of infor­ma­tion secu­rity poli­cies in large UK-based orga­ni­za­tions: an exploratory inves­ti­ga­tion. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(3), 106–114.

  Goles, T. (2001). The Impact of Client-Ven­dor Rela­tion­ship on Out­sourc­ing Suc­cess. Uni­ver­sity of Hous­ton, Hous­ton, TX.

  Hen­der­son, J. C. and N. Venka­tra­man (1993). Strate­gic align­ment: lever­ag­ing infor­ma­tion tech­nol­ogy for trans­form­ing organ­i­sa­tions. IBM Sys­tems Jour­nal 32(1), 4–16.

  Kaiser, K. M. and S. Hawk (2004). Evo­lu­tion of off­shore soft­ware devel­op­ment: From out­sourc­ing to cosourc­ing. MIS Quar­terly Exec­u­tive 3(2), 69–81.

  Kern, T., L. P. Will­cocks and M. C. Lac­ity (2002). Appli­ca­tion ser­vice pro­vi­sion: Risk assess­ment and mit­i­ga­tion. MIS Quar­terly Exec­u­tive 1(2), 113–126.

  Khal­fan, A. M. (2004). Infor­ma­tion secu­rity con­sid­er­a­tions in IS/IT out­sourc­ing projects: a descrip­tive case study of two sec­tors. Inter­na­tional Jour­nal of Infor­ma­tion Man­age­ment 24(1), 29–42.

  Lac­ity, M. C. and L. P. Will­cocks (1998). An Empir­i­cal Inves­ti­ga­tion of Infor­ma­tion Tech­nol­ogy Sourc­ing Prac­tices: Lessons from Expe­ri­ence. MIS Quar­terly 22(3), 363–408.

  Lac­ity, M. C., S. Khan, A. Yan and L. P. Will­cocks (2010). A review of the IT out­sourc­ing empir­i­cal lit­er­a­ture and future research direc­tions. Jour­nal of Infor­ma­tion Tech­nol­ogy 25(4), 395–433.

  Lev­ina, N. and J. W. Ross (2003). From the ven­dor’s per­spec­tive: explor­ing the value propo­si­tion in infor­ma­tion tech­nol­ogy out­sourc­ing. MIS Quar­terly 27(3), 331–364.

  Livari, J. (1992). The orga­ni­za­tional fit of infor­ma­tion sys­tems. Infor­ma­tion Sys­tems Jour­nal 2(1), 3–29.

  Loch, K. D., H. H. Carr and M. E. Warkentin (1992). Threats to infor­ma­tion sys­tems: today’s real­ity, yes­ter­day’s under­stand­ing. MIS Quar­terly 16(2), 173–186.

  Miranda, S. M. and C. B. Kavan (2005). Moments of gov­er­nance in IS out­sourc­ing: con­cep­tu­al­iz­ing effects of con­tracts on value cap­ture and cre­ation. Jour­nal of Infor­ma­tion Tech­nol­ogy 20(3), 152–169.

  Nas­sim­beni, G., M. Sar­tor and D. Dus (2012). Secu­rity risks in ser­vice off­shoring and out­sourc­ing. Indus­trial Man­age­ment & Data Sys­tems 112(3), 4.

  Nightin­gale, D. V. and J. M. Toulouse (1977). Toward a mul­ti­level con­gru­ence the­ory of orga­ni­za­tion. Admin­is­tra­tive Sci­ence Quar­terly 22(2), 264–280.

  Nor­man, P. M. (2002). Pro­tect­ing knowl­edge in strate­gic alliances: Resource and rela­tional char­ac­ter­is­tics. The Jour­nal of High Tech­nol­ogy Man­age­ment Research 13(2), 177–202.

  Okoli, C. and S. D. Pawlowski (2004). The Del­phi method as a research tool: an exam­ple, design con­sid­er­a­tions and appli­ca­tions. Infor­ma­tion & Man­age­ment 42(1), 15–29.

  Osei-Bryson, K.-M. and O. K. Ngwenyama (2006). Man­ag­ing risks in infor­ma­tion sys­tems out­sourc­ing: an approach to ana­lyz­ing out­sourc­ing risks and struc­tur­ing incen­tive con­tracts. Euro­pean Jour­nal of Oper­a­tional Research 174 (1), 245–264

  Pai, A. K. and S. Basu (2007). Off­shore tech­nol­ogy out­sourc­ing: overview of man­age­ment and legal issues. Busi­ness Process Man­age­ment Jour­nal 13(1), 21–46.

  Posthu­mus, S. and R. von Solms (2004). A frame­work for the gov­er­nance of infor­ma­tion secu­rity. Com­put­ers & Secu­rity 23(8), 638–646.

  Raghu, T. (2009). Cyber-secu­rity poli­cies and legal frame­works gov­ern­ing Busi­ness Process and IT Out­sourc­ing arrange­ments. Indo-US Con­fer­ence on Cyber­se­cu­rity, Cyber-crime & Cyber Foren­sics.

  Sak­thivel, S. (2007). Man­ag­ing risk in off­shore sys­tems devel­op­ment. Com­mu­ni­ca­tions of the ACM 50(4), 69–75

  Schmidt, R. (1997). Man­ag­ing Del­phi sur­veys using non­para­met­ric sta­tis­ti­cal tech­niques. Deci­sion Sci­ences 28(3), 763–774.

  Sird­esh­mukh, D., J. Singh and B. Sabol (2002). Con­sumer trust, value, and loy­alty in rela­tional exchanges. The Jour­nal of Mar­ket­ing 66(1), 15–37.

  Ster­man, J. D., N. P. Repen­ning and F. Kof­man (1997). Unan­tic­i­pated side effects of suc­cess­ful qual­ity pro­grams: Explor­ing a para­dox of orga­ni­za­tional improve­ment. Man­age­ment Sci­ence 43(4), 503–521.

  Tickle, I. (2002). Data integrity assur­ance in a lay­ered secu­rity strat­egy. Com­puter Fraud & Secu­rity 2002(10), 9–13.

  Tran, E. and M. Atkin­son (2002). Secu­rity of per­sonal data across national bor­ders. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 10(5), 237–241.

  Venka­tra­man, N. (1997). Beyond out­sourc­ing: man­ag­ing IT resources as a value cen­ter. Sloan Man­age­ment Review 38(3), 51–64.

  Wei, Y. and M. Blake (2010). Ser­vice-ori­ented com­put­ing and cloud com­put­ing: Chal­lenges and oppor­tu­ni­ties. Inter­net Com­put­ing 14(6), 72–75.

  Will­cocks, L. and M. C. Lac­ity (2000). Rela­tion­ships in IT Out­sourc­ing: A Stakholder Per­spec­tive. In Zmud, R. (Ed.), Fram­ing the Domains of IT Man­age­ment, 355–384. Pin­naflex Inc., Ohio.

  Will­cocks, L., J. Hin­dle, D. Feeny and M. Lac­ity (2004). IT and busi­ness process out­sourc­ing: The knowl­edge poten­tial. Infor­ma­tion Sys­tems Man­age­ment 21(3), 7–15.

  Wül­len­we­ber, K., D. Beim­born, T. Weitzel and W. König (2008). The impact of process stan­dard­iza­tion on busi­ness process out­sourc­ing suc­cess. Infor­ma­tion Sys­tems Fron­tiers 10(2), 211–224.

Endnotes

¹ http://www.gao.gov/assets/260/251282.pdf. Accessed Jan­u­ary 29, 2013