Orig­i­nal source pub­li­ca­tion: Pereira, L., F. de Sá-Soares and M. Caldeira (2012). Infor­ma­tion Sys­tems Secu­rity Out­sourc­ing Key Issues: A Ser­vice Providers’ Per­spec­tive. Pro­ceed­ings of the Euro­pean Con­fer­ence on Infor­ma­tion Sys­tems 2012, Paper 121. Barcelona (Spain).
The final pub­li­ca­tion is avail­able here.

Infor­ma­tion Sys­tems Secu­rity Out­sourc­ing Key Issues: A Ser­vice Providers’ Per­spec­tive

Luís Pereira,^a Fil­ipe de Sá-Soares^b and Mário Caldeira^a

^a ISEG—Tech­ni­cal Uni­ver­sity of Lis­bon, Lis­bon, Por­tu­gal
^b Uni­ver­sity of Minho, Guimarães, Por­tu­gal

1. Introduction

The infor­ma­tion sys­tems secu­rity (ISS) out­sourc­ing rela­tion­ship, as any rela­tion­ship, pre­sup­poses the exis­tence of two or more par­ties. This type of rela­tion­ship is for­mally instan­ti­ated in the form of con­tracts between the party that resorts to out­sourc­ing (the client) and the ones per­form­ing the activ­i­ties out­sourced (the ser­vice providers).

If the ben­e­fits of out­sourc­ing are to be attained, the suc­cess of such rela­tion­ships is para­mount. That is why this study aims at unveil­ing which are the key issues in cre­at­ing and main­tain­ing a suc­cess­ful ISS rela­tion­ship between client and ser­vice provider. For­mer stud­ies usu­ally take on the client’s point of view, but, although that is an impor­tant point of view, the ser­vice providers’ point of view seems to be lack­ing the insight which this study intends to ful­fil.

The study aims to find key issues towards a suc­cess­ful ISS out­sourc­ing rela­tion­ship from the per­spec­tive of the ser­vice providers and rank those issues accord­ing to their impor­tance.

It is believed that this research is of par­tic­u­lar impor­tance due to the del­i­cate nature of its sub­ject (out­sourc­ing of ISS activ­i­ties by orga­ni­za­tions) but also in deep­en­ing the under­stand­ing of the ISS out­sourc­ing rela­tion­ship in order for orga­ni­za­tions to steer their path in the right direc­tion.

The paper is struc­tured as fol­lows. After this intro­duc­tion, we review the lit­er­a­ture on infor­ma­tion sys­tems (IS) out­sourc­ing and on ISS out­sourc­ing. Then, the research design is depicted, which is fol­lowed by a descrip­tion of the study. Finally, we present the main results of the study and dis­cuss them. The paper ends by draw­ing con­clu­sions and sug­gest­ing future work.

2. Literature Review

2.1 Information Systems Outsourcing

In the IS con­text, Kern and Will­cocks [2001] define the out­sourc­ing of IS as “the hand­ing over to a third party of the man­age­ment and oper­a­tion of an orga­ni­za­tion’s IT assets and activ­i­ties” (p. 1), as a whole or par­tially.

The cumu­la­tive knowl­edge on IS out­sourc­ing is sig­nif­i­cant. In a review of IS out­sourc­ing research, pub­lished between 1990 and 2008, Lac­ity et al. [2009] clas­si­fied 191 papers into six top­ics: deter­mi­nants of IS out­sourc­ing, IS out­sourc­ing strat­egy, IS out­sourc­ing risks, deter­mi­nants of IS out­sourc­ing suc­cess, client and sup­plier capa­bil­i­ties, and sourc­ing vari­etals.

The most researched topic has been the deter­mi­nants of IS out­sourc­ing suc­cess. The work on this topic can be clas­si­fied into three cat­e­gories: the IS out­sourc­ing deci­sion mak­ing, con­trac­tual gov­er­nance, and rela­tional gov­er­nance. Research on IS out­sourc­ing deci­sion mak­ing has focused on the degree of out­sourc­ing, top man­age­ment com­mit­ment/sup­port, and the eval­u­a­tion process for select­ing providers. Research on con­trac­tual gov­er­nance has con­sid­ered four deter­mi­nants of suc­cess related to the out­sourc­ing con­tract: its detail, type, dura­tion, and size. The stud­ies on rela­tional gov­er­nance cover soft issues in the client-provider rela­tion­ship man­age­ment, includ­ing trust, norms, com­mu­ni­ca­tion, shar­ing of infor­ma­tion, mutual depen­dency, and coop­er­a­tion.

Closely linked to these deter­mi­nants are the client and provider capa­bil­i­ties. These include over­all capa­bil­i­ties such as IS tech­ni­cal/method­olog­i­cal capa­bil­ity, IS human resource man­age­ment capa­bil­ity, provider man­age­ment capa­bil­ity, con­tract man­age­ment capa­bil­ity, domain capa­bil­ity, IS change man­age­ment capa­bil­ity, tran­si­tion man­age­ment capa­bil­ity, and client man­age­ment capa­bil­ity.

A ret­ro­spec­tive of the nearly 20 years of lit­er­a­ture analysed by Lac­ity et al. [2009] shows that the man­age­ment of the out­sourc­ing rela­tion­ship is “a peren­nial and chal­leng­ing issue” (p. 130). Not only are impor­tant the fac­tors that influ­ence the pro­mo­tion and main­te­nance of a suc­cess­ful out­sourc­ing rela­tion­ship (e.g., the capa­bil­i­ties and the rela­tional gov­er­nance), as well as the man­age­ment tool (the out­sourc­ing con­tract) that for­mal­izes and gov­erns that rela­tion­ship.

In a prior lit­er­a­ture analy­sis on IS out­sourc­ing, Gon­za­lez et al. [2006] found that the most fre­quent top­ics under study focused out­sourc­ing from the per­spec­tive of the client (48.7%), in com­par­i­son to the papers that con­sid­ered out­sourc­ing from the per­spec­tive of the provider (16.0%). Papers clas­si­fied in this last group focused three spe­cific top­ics: com­puter out­sourc­ing ser­vices in gen­eral, appli­ca­tion ser­vice providers, and global or off­shore out­sourc­ing. A sim­i­lar obser­va­tion had been pro­duced by Dib­bern et al. [2004], not­ing “the absence of research under­taken from the ven­dor’s per­spec­tive” (p. 88). Indeed, the vast major­ity of work on IS out­sourc­ing to that moment exam­ined issues of inter­est to the client, lead­ing those authors to call for research on the under-explored area of ven­dor ben­e­fits. Under­ly­ing this chal­lenge was the assump­tion that for out­sourc­ing to be effec­tive, both client and provider need to get value from the rela­tion­ship. Although a review of the last lit­er­a­ture on IS out­sourc­ing shows improve­ments in this area, we think there is still a need to com­ple­ment pre­vi­ous research, rein­forc­ing empir­i­cal stud­ies on IS out­sourc­ing suc­cess from the providers’ per­spec­tive. This per­cep­tion extends to the ISS out­sourc­ing field.

2.2 Information Systems Security Outsourcing

IS secu­rity out­sourc­ing may be under­stood as the trans­fer of an exist­ing in-house IS secu­rity func­tion to a third-party provider [Fenn et al. 2002], as a whole or par­tially. The ben­e­fits that may be achieved by a client through an ISS out­sourc­ing arrange­ment include cost sav­ings, access to high exper­tise, improved ser­vice per­for­mance, extra capac­ity to react to secu­rity inci­dents, increased capa­bil­ity to focus on core busi­ness com­pe­ten­cies, and staffing flex­i­bil­ity [Allen et al. 2003; Endorf 2004; Schneier 2002].

How­ever, the deci­sion for ISS out­sourc­ing is not risk free. Among the dis­ad­van­tages that an orga­ni­za­tion may face are breaches of con­fi­den­tial­ity, upfront invest­ment [Fenn et al. 2002], steal­ing of pro­pri­etary infor­ma­tion, and oppor­tunis­tic repric­ing of con­tract terms after the provider feels locked-in [Rowe 2007]. Beyond these, it may be added the risks of part­ner­ship fail­ure, unan­tic­i­pated hid­den costs and impacts, and legal issues [Allen et al. 2003].

As with IS out­sourc­ing, the man­age­ment of the ISS out­sourc­ing rela­tion­ship has attracted the inter­est of researchers. Fenn et al. [2002] argue that out­sourc­ing ISS is only as effec­tive as the rela­tion­ship between the provider and the client: find­ing the right provider and agree­ing appro­pri­ate and work­able ser­vice lev­els are of para­mount impor­tance.

Rec­og­niz­ing that out­sourc­ing suc­cess does not depend only on con­trac­tual aspects but also on the rela­tion­ship estab­lished between the par­ties, Tso­hou et al. [2007] iden­ti­fied six fac­tors affect­ing ISS out­sourc­ing out­come: par­tic­i­pa­tion, com­mu­ni­ca­tion, mutual under­stand­ing, infor­ma­tion shar­ing, top man­age­ment sup­port, and coor­di­na­tion. Although it is pos­si­ble to draw a par­al­lel between these fac­tors and the deter­mi­nants of IS out­sourc­ing suc­cess, Karyda et al. [2006] argue that ISS out­sourc­ing presents its own fea­tures and chal­lenges and it should be exam­ined using a dif­fer­ent lens.

Regard­ing the divi­sion of work between the out­sourc­ing par­ties, Alner [2001] advo­cates that great atten­tion must be given to deter­min­ing which parts of the ISS func­tion should be per­formed by the provider and which should be han­dled by the client.

To Endorf [2004], suc­cess­fully man­ag­ing ISS out­sourc­ing involves fol­low­ing best prac­tices, con­duct­ing due dili­gence, spec­i­fy­ing require­ments, and defin­ing roles and respon­si­bil­i­ties.

In what con­cerns ISS out­sourc­ing providers’ required fea­tures, Endorf [2004] argues that it is gen­er­ally bet­ter to deal with a provider with which a rela­tion­ship already exists. Power and Forte [2005] focus on assur­ing the provider has a well trained staff in the func­tions they would be per­form­ing and that it can inde­pen­dently assess the pro­fes­sional qual­i­fi­ca­tions of their secu­rity-related per­son­nel. Schneier [2002] advises on avoid­ing sit­u­a­tions of con­flict of inter­est by ser­vice providers (e.g., sell and man­age secu­rity prod­ucts).

The sur­vey of the lit­er­a­ture sug­gests that ISS out­sourc­ing is a some­what unex­plored area in IS at large. The rare occur­rences of papers deal­ing with this topic tend to assume the client’s per­spec­tive leav­ing the ser­vice provider’s per­spec­tive as almost uncharted ter­ri­tory.

Since out­sourc­ing implies a rela­tion­ship, which auto­mat­i­cally requires the exis­tence of two or more par­ties, and since the point of view of the ser­vice provider has some­what been neglected in aca­d­e­mic lit­er­a­ture, it makes sense to pur­sue the research goals set for this study.

3. Research Design

Given the goals of the study and the gap in lit­er­a­ture on deter­mi­nants of ISS out­sourc­ing suc­cess from the ser­vice providers’ per­spec­tive, we selected the Del­phi method as research strat­egy.

Usu­ally, a Del­phi study con­sists of a cycle of rounds where a group of experts in a spe­cific domain are inquired indi­vid­u­ally and anony­mously about issues per­tain­ing to their domain of exper­tise. Lin­stone and Tur­off [1975] char­ac­ter­ize the Del­phi method as a struc­tured group com­mu­ni­ca­tion process that is effi­cient in allow­ing indi­vid­u­als to deal with a com­plex prob­lem. To achieve this struc­tured com­mu­ni­ca­tion, a mea­sure of feed­back is given to par­tic­i­pants regard­ing their own answers and regard­ing the answer of the group (the Del­phi panel) as a whole. This form of inquiry gives par­tic­i­pants the pos­si­bil­ity of cor­rect­ing or revis­ing their answers.

Since the study required not only the iden­ti­fi­ca­tion of the key issues, but also the rank­ing of those issues in terms of impor­tance, we com­bined the Del­phi method with Q-sort tech­nique. The use of this tech­nique facil­i­tates the order­ing pro­ce­dure by par­tic­i­pants, since they have to con­sider all the issues as a whole (mit­i­gat­ing the iso­lated con­sid­er­a­tion of issues), to divide them into three groups (the most impor­tant, the least impor­tant, and the neu­tral ones) and to rank them accord­ing to a pre­de­ter­mined quasi-nor­mal dis­tri­bu­tion.

The Del­phi method is essen­tially qual­i­ta­tive in its approach but resorts to quan­ti­ta­tive tools in what comes to deter­min­ing what are the most and least impor­tant issues and to assess­ing the degree of con­sen­sus within the group.

The deci­sion to rely on the Del­phi method and the Q-sort tech­nique as research tools capa­ble of allow­ing the study to reach its goals was taken due to sev­eral rea­sons, namely:

• The exploratory nature of the study, where the prob­lem can­not be ini­tially solved by ana­lyt­i­cal tech­niques, but can ben­e­fit from sub­jec­tive col­lec­tive judg­ments;

• The study dwells upon judg­ments that allow group involve­ment or a group deci­sion process may boost the out­come of the study and rein­force its find­ings;

• Time and cost do not allow fre­quent face to face meet­ings;

• The past appli­ca­tion of the Del­phi method to stud­ies with sim­i­lar objec­tives such as the key issues stud­ies by Brancheau and Wetherbe [1987] and Brancheau et al. [1996].

In set­ting up the Del­phi rounds, six tasks were com­pleted before the rounds cycle could effec­tively start, namely the selec­tion and invi­ta­tion of experts to form the Del­phi panel, def­i­n­i­tion of the com­mu­ni­ca­tion process with experts, deci­sion on the type of rounds, admin­is­tra­tion of the Del­phi method with Q-sort tech­nique, deci­sion on the trim­ming of issues, and def­i­n­i­tion of stop cri­te­ria.

The process of select­ing and invit­ing experts is extremely impor­tant because their ideas and opin­ions will deter­mine the rich­ness and qual­ity of the study. Besides pro­vid­ing the raw mat­ter to the study, it is the con­trolled inter­ac­tion between experts that will enable the study to meet its goals. Accord­ing to Okoli and Pawlowski [2004], a group of 10-18 experts is accept­able to con­duct a Del­phi study.

The selec­tion process began by list­ing a group of 20 com­pa­nies oper­at­ing in Por­tu­gal that pro­vide ISS ser­vices. The tar­gets in these com­pa­nies were man­agers and senior con­sul­tants work­ing in ISS. Sev­eral approaches were applied to com­pose the expert panel, namely using the researchers’ net­works of con­tacts, search­ing cor­po­rate web­sites, and resort­ing to Linkedin to browse for peo­ple with the char­ac­ter­is­tics that were pur­suit vis-à-vis their back­ground, expe­ri­ence, and cur­rent posi­tion.

Invi­ta­tions to par­tic­i­pate were sent and we got an agree­ment of par­tic­i­pa­tion from 14 pro­fes­sion­als rep­re­sent­ing 13 com­pa­nies. The aver­age work expe­ri­ence of these pro­fes­sion­als was 14.4 years (min = 8 years, max = 23 years).

Dur­ing the study, the com­mu­ni­ca­tion process with par­tic­i­pants would observe the fol­low­ing pro­to­col:

• An email ini­ti­ated each round con­vey­ing infor­ma­tion about the objec­tive of the round; the time period it would be open to answers; the Web link and cre­den­tials that would enable the expert to par­tic­i­pate; a guar­an­tee of con­fi­den­tial­ity and anonymity; a high­light of the impor­tance of their con­tri­bu­tion to the out­come of the study; dis­clo­sure of the researchers’ con­tacts for any unfore­seen cir­cum­stance; and in rounds after the sec­ond one, a brief descrip­tion of the con­sen­sus obtained in the pre­vi­ous round;

• To those par­tic­i­pants that had not yet responded, a reminder would be sent by email two days before the answer­ing period ended and on the day the answer­ing period ended;

• One exten­sion to the answer­ing period would be allowed, never exceed­ing one week; and

• In case of con­tacts made by par­tic­i­pants a timely answer by the research team was manda­tory.

In what con­cerns the type of rounds, we decided to per­form a blank sheet first round. The first round of the Del­phi process would be used to col­lect from par­tic­i­pants their opin­ions on what are the key issues sur­round­ing a suc­cess­ful ISS out­sourc­ing rela­tion­ship. This was seen nec­es­sary since no rel­e­vant issues were iden­ti­fied in the lit­er­a­ture specif­i­cally for the case of ISS out­sourc­ing and focus­ing on the point of view of the ser­vice provider. It was also decided to con­duct open rounds (in which par­tic­i­pants can add new issues they think are rel­e­vant) after the blank sheet first round until a round comes in which no issues are added.

A Web tool was used to admin­is­ter the ques­tion­naires to par­tic­i­pants. The use of this tool would give experts flex­i­bil­ity and con­ve­nience of answer­ing, speed­ing up the turn­around time between ques­tion­naires and help­ing par­tic­i­pants abide the rules of the Del­phi with Q-sort. It also served as a repos­i­tory of answers from which data could be retrieved to be analysed by researchers.

A deci­sion was also taken to trim the issues that were con­sid­ered less impor­tant in case the study should extend beyond the sec­ond round. This deci­sion was made in order to reduce par­tic­i­pants’ cog­ni­tive effort dur­ing rank­ing rounds, to moti­vate them to con­tinue answer­ing the ques­tion­naire, and to assist in the pro­mo­tion of con­sen­sus. The num­ber of issues to trim would be deter­mined tak­ing into account the mean and stan­dard devi­a­tion of the issue in the panel global rank­ing, its mode(s), the num­ber of respon­dents that scored the issue in the first posi­tions, and the exis­tence of out­liers.

The inter­ac­tion between the experts’ opin­ions may lead to a vary­ing level of con­sen­sus. This level can be cal­cu­lated but there is a need to deter­mine at which level one con­sid­ers experts to have reached con­sen­sus. Pro­long­ing rounds indef­i­nitely would cer­tainly trig­ger the law of dimin­ish­ing returns if experts were to be taxed with too many ques­tion­naires. On the other hand, stop­ping the study too early could hin­der its out­come as well, pos­si­bly because no valu­able results were attained.

For this study, the set of stop­ping cri­te­ria for judg­ing pan­els’ con­sen­sus had three rules:

1. Kendall’s W of the round should be equal or greater than 0.7 (this rule estab­lishes a thresh­old for the con­sen­sus between par­tic­i­pants in a given round);

2. Spear­man’s rho between rounds should be equal or greater than 0.9 (this rule estab­lishes a thresh­old for the sta­bil­ity of answers between con­sec­u­tive rounds); and

3. If the cri­te­ria above were not met when the fourth round is reached then the study will stop at the end of the fourth round (this rules estab­lishes a max­i­mum num­ber of rounds to achieve con­sen­sus).
   If after the four rounds con­sen­sus was not reached, the researchers would try to qual­i­ta­tively elicit the ratio­nale behind each indi­vid­ual rank­ing by con­duct­ing inter­views with par­tic­i­pants.

4. Description of Study

The study involved the admin­is­tra­tion of four rounds of ques­tion­naires and a final inter­view to the par­tic­i­pants of the fourth Del­phi round.

4.1 Delphi Rounds

Table 1 sum­ma­rizes the four Del­phi rounds. For each round, it is indi­cated its type, the num­ber of experts that par­tic­i­pated (responses), the num­ber of issues involved, and the val­ues for Kendall’s W and Spear­man’s rho where applic­a­ble. All the 14 experts that agreed to par­tic­i­pate in the study were con­tacted to take part in each of the four rounds.

Table 1: Sum­mary of Del­phi Rounds

The first round was a blank sheet round, i.e., a round where par­tic­i­pants were asked to pro­vide, fol­low­ing the sug­ges­tion of Schmidt [1997], at least six issues that, from their point of view, are key to the suc­cess of an ISS out­sourc­ing rela­tion­ship from the ser­vice provider’s stand­point. For each issue, par­tic­i­pants were also asked to pro­vide a brief descrip­tion.

The ten experts that con­trib­uted to the round sug­gested 57 issues. These raw issues under­went a process of con­sol­i­da­tion by the research team. This process con­sisted of group­ing sim­i­lar issues beneath an umbrella issue, and for­mu­lat­ing a state­ment to des­ig­nate the group of issues and a state­ment to pro­vide a brief descrip­tion aimed at clar­i­fy­ing the mean­ing of the over­all issue. After a few iter­a­tions, this process was con­sid­ered com­plete, result­ing in a list of 25 con­sol­i­dated issues.

In the sec­ond round par­tic­i­pants were asked to rank the list of 25 con­sol­i­dated issues accord­ing to their own point of view. The rank­ing of issues resorted to the Q-Sort tech­nique which is embed­ded in the Web tool that medi­ated the admin­is­tra­tion of ques­tion­naires. The issues were pre­sented to par­tic­i­pants with­out any mean­ing­ful order.

This sec­ond round allowed par­tic­i­pants to add new issues they thought were miss­ing from the list pro­vided. These new issues would be included in future rounds. None did so which can be an indi­ca­tor that the con­sol­i­da­tion process was good and that the list was con­sid­ered com­plete by par­tic­i­pants.

The answers to the sec­ond round were analysed in rela­tion to their degree of con­sen­sus. Kendall’s W was cal­cu­lated to be 0.231 (p < .001). Accord­ing to Schmidt [1997], this reveals a weak agree­ment among experts. Since none of the stop­ping cri­te­ria were met, a third round was pro­moted.

Before start­ing the third round two deci­sions were taken. Since no par­tic­i­pant added new issues to the list in the sec­ond round, it was decided to no longer allow that pos­si­bil­ity to par­tic­i­pants and thus the list was con­sid­ered closed to new issues. The sec­ond deci­sion was about reduc­ing the set of issues to be ranked by par­tic­i­pants in the third round. The deci­sion was to trim the five issues that were con­sid­ered less impor­tant by the panel in the sec­ond round.

The issues were pre­sented to par­tic­i­pants in the order of impor­tance given by the panel as a whole in the pre­vi­ous round, from most impor­tant to least impor­tant.

The out­come of the round was mea­sured in terms of con­sen­sus and in terms of con­ver­gence between this round and the pre­vi­ous one. Respec­tively, Kendall’s W was cal­cu­lated to be 0.120 (p = .361) and Spear­man’s rho to be 0.614 (p = .004). This value of Kendall’s W, accord­ing to Schmidt [1997], shows a weak agree­ment among par­tic­i­pants and it is in fact worse in terms of con­sen­sus than the Kendall’s W cal­cu­lated in the pre­vi­ous round. Con­fi­dence in ranks was quite low. Regard­ing Spear­man’s rho, it shows that although the answer to these two rounds can be cor­re­lated pos­i­tively, a move­ment occurred between rounds and so it is pos­si­ble to con­clude that the experts’ col­lec­tive answer did not stay sta­tic to a degree that it would be bet­ter to stop the study. None of the stop­ping cri­te­ria were met and so a fourth and last round ensued.

Before start­ing the fourth round a deci­sion had to be taken regard­ing the reduc­tion of the list of issues to be con­sid­ered by par­tic­i­pants in this round. The first inten­tion was to trim 10 issues off the list. Con­sen­sus in the third round was weak and since the fourth was the last round it was con­sid­ered a good trade-off to reduce the list of issues to 10, boost­ing the pos­si­bil­i­ties of con­sen­sus by hav­ing a shorter list. Deeper analy­sis of the 10 issues com­ing last in the third round clas­si­fi­ca­tion enabled tak­ing a bet­ter deci­sion regard­ing how many issues to trim. Rely­ing only on the rel­a­tive posi­tion of the issues in the rank­ing to decide on what issues to trim can be mis­lead­ing because the con­fi­dence in ranks is quite low and the active panel was com­posed of only 10 experts. It was con­sid­ered rel­e­vant to bring to the analy­sis the mode and how many par­tic­i­pants scored that issue in the first 10 posi­tions. This analy­sis led to the trim­ming of the last seven issues so the fourth round pre­sented 13 issues to par­tic­i­pants ranked accord­ing to the impor­tance given to them in the pre­vi­ous round by the panel.

Once again Kendall’s W was cal­cu­lated together with Spear­man’s rho, show­ing val­ues of 0.120 (p = .374) and 0.324 (p = .280), respec­tively. Again Kendall’s W showed weak agree­ment among par­tic­i­pants. Con­fi­dence in ranks was low. Spear­man’s rho showed that the third and fourth rounds can be cor­re­lated pos­i­tively but not to a degree that it could be stated that no change occurred in the experts’ answers. The third of the stop­ping cri­te­ria was met and con­se­quently the ques­tion­naires were halted.

Using descrip­tive sta­tis­tics, the fourth round was fur­ther analysed with the aim of under­stand­ing the dis­per­sion of choice among the var­i­ous par­tic­i­pants. Each issue was analysed con­sid­er­ing the best rank posi­tion it reached (the min­i­mum), the worst rank posi­tion it reached (the max­i­mum), the cor­re­spond­ing range, first quar­tile, median, third quar­tile, inter quar­tile range, and lower and upper lim­its for out­liers. The aver­age inter quar­tile range was ~5.7 which con­firmed the sig­nif­i­cant dis­per­sion of choice among par­tic­i­pants for a set of only 13 issues. The analy­sis of the lower lim­its showed that the exis­tence of mod­er­ate out­liers would be extremely improb­a­ble.

4.2 Interviews

After three rank­ing rounds, con­sen­sus among par­tic­i­pants was still weak even after reduc­ing the set of issues to rank from 25 to the 13 con­sid­ered most impor­tant by the panel. The analy­sis had to reach deeper into the moti­va­tions and rea­sons of the par­tic­i­pants to answer like they did. We tried to achieve this under­stand­ing by inter­view­ing the experts.

Inter­views were pro­posed to the par­tic­i­pants of the fourth and last round, and six of them accepted the invi­ta­tion and had the oppor­tu­nity to con­vey their opin­ions through a tele­phone inter­view. The inter­view script was sim­ple and involved dis­cussing the moti­va­tions of the par­tic­i­pants to hav­ing selected the top three issues they did in the fourth round, prompted by the ques­tion Why are they the most impor­tant?. Then the panel’s top three issues were con­veyed and the pos­si­ble match or mis­match of opin­ions was dis­cussed. All experts were inter­viewed by the first author, who asked experts’ autho­riza­tion to record the inter­views. All the inter­vie­wees allowed the record­ing of the con­ver­sa­tion.

In analysing the inter­views, the record­ings were replayed and every inde­pen­dent aspect men­tioned by each inter­vie­wee was high­lighted. All aspects were then com­pared and con­sol­i­dated.

5. Results

The first result of this study is the list of 25 con­sol­i­dated issues result­ing from the first round, pre­sented in Table 2 (issues were clas­si­fied into five groups that will be dis­cussed in the next sec­tion).

Table 2: Con­sol­i­dated List of Issues

The sec­ond result of the study was reached in the end of the fourth round, con­sist­ing of the final ranked list of the 13 most impor­tant issues from the stand­point of the panel as a whole. Table 3 presents that rank­ing, along with the mean and stan­dard devi­a­tion (SD) for each issue.

Table 3: Final Rank of Issues

The third result of the study derived from the analy­sis of the inter­views. From a gen­eral point of view, when address­ing their top three issues and the rea­sons for their choice, par­tic­i­pants assumed two per­spec­tives. The more com­mon was see­ing the client and the rela­tion­ship as a future client and a future rela­tion­ship, which still have to be won. The suc­cess fac­tors of the rela­tion­ship are taken for the issues that enable the sell­ing of the ser­vice (cost-ben­e­fit ratio, cred­i­bil­ity, and expe­ri­ence). This per­spec­tive con­trasted with the one that focused on the fac­tors that enabled a good ongo­ing rela­tion­ship (response time, def­i­n­i­tion of respon­si­bil­i­ties, and the exis­tence of a busi­ness con­ti­nu­ity plan) and the pos­si­bil­ity of assess­ing the ser­vice being pro­vided.

Most par­tic­i­pants focused on the price of the ser­vice as a key point to win the client and also to main­tain the ser­vice and the rela­tion­ship. Issues such as qual­ity of ser­vice, expe­ri­ence of the provider, and exis­tence of pre­vi­ous suc­cess­ful rela­tion­ships take sec­ond place behind that fac­tor. The price fac­tor takes prece­dence when the ser­vice being deliv­ered is not dif­fer­en­ti­ated and is seen as a com­mod­ity to a large extent. Here the client does not under­stand the real value of the ser­vice and some­times deci­sion-mak­ers are truly not aware of the value of cer­tain ser­vices. For the clients that under­stand the value of ISS, their demand tends to be based on the qual­ity of the ser­vice and not as much on the price.

Accord­ing to some par­tic­i­pants, the moti­va­tion for some clients to out­source is the reduc­tion of their costs. This, how­ever, can­not be done suc­cess­fully if the client does not know itself and does not know its processes. The matu­rity level of orga­ni­za­tions also has to be high enough for them to resort to out­sourc­ing suc­cess­fully. Accord­ing to one par­tic­i­pant the exis­tence of a busi­ness con­ti­nu­ity plan is a sign of that matu­rity.

It was also evi­dent that existed two con­flict­ing views on how ISS out­sourc­ing con­tracts are cel­e­brated in Por­tu­gal. On the one hand, con­tracts are spe­cific enough to effec­tively reg­u­late the ISS ser­vice and the rela­tion­ship between client and provider. This point of view tends to see con­fi­den­tial­ity, integrity, and avail­abil­ity as premises of the ser­vice, enacted in the con­tract and with­out room for dis­cus­sion on their con­tri­bu­tion to a suc­cess­ful out­sourc­ing rela­tion­ship. The oppos­ing view reports con­tracts as generic, with no speci­ficity regard­ing ISS and leaves to the provider the respon­si­bil­ity of find­ing the scope of its ser­vice and almost self-reg­u­lat­ing. As stated by par­tic­i­pants, this may be the evi­dence of dif­fer­ent matu­rity lev­els between orga­ni­za­tions.

When par­tic­i­pants con­fronted their answers to the fourth round with the group’s answer, almost with­out excep­tion, they tended to relate their own choices with the ones of the group. In fact, issues are not mutu­ally exclu­sive and have some over­lap­ping that can­not be excised. For exam­ple, trust can be related to cred­i­bil­ity and the exis­tence of pre­vi­ous rela­tion­ships, and qual­ity may be related to the com­pe­ten­cies of human resources. Issues also have dif­fer­ent gran­u­lar­ity, with some issues being more gen­eral than other (e.g., trust was per­ceived wider than the exis­tence of a busi­ness con­ti­nu­ity plan).

6. Discussion

The goals of this study were to iden­tify key issues lead­ing to a suc­cess­ful ISS out­sourc­ing rela­tion­ship from the point of view of the provider and rank these issues accord­ing to their per­ceived impor­tance.

The first goal–obtain­ing a list of the most rel­e­vant issues–was pur­sued mainly in the first round of the Del­phi study and then refined over sub­se­quent rounds. The blank sheet first round sup­plied the study with 25 issues (cf. Table 2) that were then trimmed to 13 lead­ing up to the fourth round, and fol­low­ing the stated pref­er­ences of the par­tic­i­pants (cf. Table 3).

The study accom­plished the first goal sat­is­fac­to­rily. This is due to issues span­ning a vari­ety of sub­jects and also because they can be related to issues men­tioned in the lit­er­a­ture review on ISS out­sourc­ing.

In Table 2 we clas­si­fied the 25 con­sol­i­dated issues into five groups. The clas­si­fi­ca­tion resorted to a sub­set of cat­e­gories advanced by Dib­bern et al. [2004], only this time used from the providers’ angle.

Nine of the issues (36% of the 25 issues) were aggre­gated in the group “Provider Selec­tion”. This group includes issues that serve as selec­tion cri­te­ria of the provider by the client, such as providers’ rep­u­ta­tion, cost propo­si­tion, capa­bil­i­ties, and suc­cess­ful past col­lab­o­ra­tions. The next three groups focus on the rela­tion­ship between the two par­ties of the out­sourc­ing arrange­ment. The group “Rela­tion­ship Struc­tur­ing” con­tains three issues (12%) that are deemed impor­tant when the out­sourc­ing con­tract is being pre­pared. The group “Rela­tion­ship Build­ing” com­bines five issues (20%) that con­trib­ute to strength­en­ing the rela­tion­ship between provider and client. It is pos­si­ble to link these issues with the cat­e­gory “rela­tional gov­er­nance” used by Lac­ity et al. [2009]. The group “Rela­tion­ship Man­age­ment” brings together four issues (16%) that are rel­e­vant to drive the rela­tion­ship in the right direc­tion, such as being able to show the deliv­ery of the cost-ben­e­fit ratio, pair­ing ISS tech­ni­cal capa­bil­i­ties with soft skills com­pe­ten­cies dur­ing the actual ser­vice deliv­ery, and clear dis­crim­i­na­tion of out­sourc­ing tasks per­form­ers in the course of pro­vid­ing ser­vice. The last group com­prises four issues (16%) con­nected to the results of out­sourc­ing (“Out­comes”). These issues high­light the real added value of the out­sourc­ing arrange­ment, namely by demon­strat­ing the real­iza­tion of client’s expec­ta­tions, the level of ser­vice qual­ity, and the oper­a­tional effi­ciency of the provider.

A sim­i­lar analy­sis for the 13 most impor­tant issues (cf. Table 3) shows that five issues (~40% of the 13), namely issues #2, #6, #7, #10, and #13 per­tain to the “Providers Selec­tion” group, rein­forc­ing the cen­tral nature of provider’s proven capa­bil­ity to per­form the ser­vices to con­tract. The other four groups include two issues each (15%). The con­trac­tual gov­er­nance issues focus the clear def­i­n­i­tion of respon­si­bil­i­ties attrib­ut­able to each party and the asso­ci­ated scope of action/role (#1) and the assur­ance that the provider will not unlaw­fully dis­close or share client’s infor­ma­tion (#3). In the “Rela­tion­ship Build­ing” group one finds the recur­ring theme of trust (#5) with an empha­sis on the tech­ni­cal capa­bil­ity of the provider and its finan­cial sta­bil­ity, so that the client does not fear the provider exit­ing the mar­ket and leav­ing the client in a dif­fi­cult sit­u­a­tion, par­tic­u­larly given the sen­si­tive ser­vices out­sourced. An addi­tional issue (#12) relates to the exis­tence of a busi­ness con­ti­nu­ity plan the respon­si­bil­ity of the provider, so the provider is able to com­bine its ISS ser­vices to pro­ce­dures deal­ing with inci­dents and dis­as­ter recov­ery. Regard­ing the man­age­ment of the out­sourc­ing rela­tion­ship, the panel high­lighted the impor­tance of hav­ing clear meth­ods and met­rics (e.g., SLA) to mea­sure, con­trol, and audit the level of the ISS ser­vice pro­vided (#8). In addi­tion, par­tic­i­pants stressed the need to form teams that con­gre­gate tech­ni­cal com­pe­ten­cies (tech­ni­cal knowl­edge, cer­ti­fi­ca­tions, etc.) together with non-tech­ni­cal skills, such as inter­per­sonal, per­sonal man­age­ment, and com­mu­ni­ca­tions skills (#11). The last two issues (#4 and #9) per­tain to the “Out­comes” group and under­score what may be under­stood as ulti­mate proofs of a suc­cess­ful out­sourc­ing arrange­ment: the com­pli­ance with the require­ments ini­tially con­tracted with the client and the avail­abil­ity of the provider to answer with a prompt­ness match­ing the sever­ity of the ISS event.

Part of these issues has been men­tioned in the lit­er­a­ture review and were known as rel­e­vant to the ISS out­sourc­ing rela­tion­ship. It should how­ever be noted that the exist­ing lit­er­a­ture focuses on the client side while this study focuses on the ser­vice provider side, thence it is pos­si­ble to rea­son that sev­eral issues appear to be com­mon to both sides of the out­sourc­ing rela­tion­ship. Nev­er­the­less, there are issues that seem spe­cific to how ser­vice providers per­ceive the pur­suit of a suc­cess­ful ISS out­sourc­ing rela­tion­ship with the client (secu­rity ser­vices diver­sity offered, sup­port in reg­u­la­tory and legal com­pli­ance, exis­tence of a busi­ness con­ti­nu­ity plan, and decreased oper­a­tional costs for the provider).

Two crit­i­cisms arise though: the first deals with the fact that, even after being stressed con­stantly through­out the study that the intended point of view was the ser­vice providers’, it became obvi­ous in the inter­views that some par­tic­i­pants always default (maybe unknow­ingly) to the client’s point of view. To them it is mainly a ques­tion of what the client is look­ing for in a ser­vice provider and what can they do to turn the deci­sion in their favour. To a cer­tain extent this makes sense, since the providers’ first goal is to stay in busi­ness and there­fore have to think like the client in order to posi­tion them­selves in the mar­ket. On the other hand, it makes it more dif­fi­cult to under­stand which issues are spe­cific to the provider. The sec­ond crit­i­cism deals with the fact that the issues have dif­fer­ent gran­u­lar­ity and they are not com­pletely inde­pen­dent from each other, trig­ger­ing the par­tic­i­pants to eas­ily relate their most impor­tant issues to the panel’s most impor­tant issues.

The sec­ond goal of this study was to rank the issues accord­ing to the rel­e­vance per­ceived by the group of par­tic­i­pants. The results were not sat­is­fac­tory. Kendall’s W receded round after round, even when fewer issues were being con­sid­ered, show­ing a weak agree­ment between par­tic­i­pants.

The analy­sis of the con­ver­gence effort done by par­tic­i­pants over the rounds showed that only 39% of the 104 issues that were ranked over the three rounds (con­sid­er­ing the eight par­tic­i­pants that answered all rank­ing rounds and the final thir­teen issues) con­vey a con­sis­tent effort by par­tic­i­pants to align with the panel’s answer. This means that the con­ver­gence effort as a whole was not sig­nif­i­cant through­out the study. Also, volatil­ity is an issue for sev­eral par­tic­i­pants. This could be explained by the con­ver­gence effort of each par­tic­i­pant, try­ing to move towards the group’s answer. Since the con­ver­gence effort was deemed not sig­nif­i­cant, other rea­sons have to come into play, such as the degree of robust­ness of par­tic­i­pants’ opin­ions or shifts on suc­ces­sive answers by par­tic­i­pants if they are not aware of their pre­vi­ous answers when they rank issues.

Regard­ing an over­all sim­i­lar answer­ing behav­iour by experts, there is a mild trend, which could be explained by the fact that, round after round, the num­ber of issues is being reduced which inevitably leads to putting the sur­viv­ing issues in the first posi­tions. Another mild trend noticed is the match of par­tic­i­pants’ answers to the group’s, but when the lat­ter changes an over­shoot effect seems to arise on the part of the par­tic­i­pants.

We think that there is no clear and final rea­son to why agree­ment between experts was weak. Volatil­ity of the par­tic­i­pants answers, usabil­ity of the Web tool used to admin­is­ter the ques­tion­naires, sim­i­lar­ity or depen­dence between issues, time taken to com­plete the four rounds of the ques­tion­naires can all be waved but all with­out proof.

7. Conclusion

This is an exploratory study since no infor­ma­tion relat­ing to the ser­vice providers’ point of view in ISS out­sourc­ing was found in the lit­er­a­ture review and so this study treads new ground. This is increas­ingly impor­tant as out­sourc­ing rela­tion­ships become more com­mon and tend to become more bal­anced and regarded as part­ner­ships by the enti­ties involved.

In spite dwelling on a dif­fi­cult sub­ject, the study was suc­cess­ful. The argu­ment for it being dif­fi­cult comes from the fact that it is a largely unex­plored domain in which there is no back­ground to pro­vide struc­ture to ensu­ing works, and also because in the field of ISS it is typ­i­cally hard to har­vest infor­ma­tion and prac­ti­tion­ers tend to not be as forth­com­ing as they could be.

How­ever, the list of issues here com­piled can cer­tainly be a start­ing point to fur­ther stud­ies dwelling on this topic. It can be pre­sented to experts in a Del­phi first round, so they can agree or dis­agree with them, refine and resolve pos­si­ble incon­sis­ten­cies and inter­de­pen­den­cies between them.

It would also be inter­est­ing to assess the clients’ response to this list. Whether they agree or dis­agree and whether there is any issue which stems any kind of dis­cus­sion lead­ing to a deeper under­stand­ing of the ISS out­sourc­ing rela­tion­ship.

Sev­eral issues have sur­faced in the course of this study that may con­sti­tute addi­tional work pro­pos­als to researchers intend­ing to pur­sue the topic of ISS out­sourc­ing.

It would be worth to inquire deeper into the aspects that are para­mount in win­ning the client and on the aspects that are para­mount in retain­ing the client. This would help to bet­ter under­stand which aspects are rel­e­vant in set­ting the ISS out­sourc­ing rela­tion­ship and then in main­tain­ing it.

A sec­ond issue is the matu­rity level of orga­ni­za­tions and how it con­di­tions the suc­cess of out­sourc­ing rela­tion­ships at large and ISS out­sourc­ing rela­tion­ships in par­tic­u­lar. Can an orga­ni­za­tion that does not know itself well be suc­cess­ful in out­sourc­ing any IS func­tion? A related idea would be to study to which extent is the price the dom­i­nant fac­tor in resort­ing to ISS out­sourc­ing and how this relates to the matu­rity of the orga­ni­za­tion and its depen­dence on IS.

Another issue that emerged from this study is about the ISS out­sourc­ing con­tract. Which is the cur­rent state of these con­tracts and are they generic or spe­cific, help­ful or not, and are they effec­tive man­age­ment tools, lit­i­ga­tion instru­ments or are just ignored?

Lastly, the gran­u­lar­ity and over­lap­ping of key issues was a topic of debate dur­ing the inter­views. Would it be pos­si­ble to develop a set of key issues bal­anced in their intrin­sic dimen­sion and inde­pen­dent so that a pro­vi­sional deduc­tive-nomo­log­i­cal model may be devel­oped?

These are ques­tions worth pur­su­ing so that we can bet­ter under­stand the per­spec­tives of both par­ties involved in an ISS out­sourc­ing rela­tion­ship and to improve the chances of it being suc­cess­ful.

References

• Allen, J., D. Gab­bard and C. May (2003). Out­sourc­ing Man­aged Secu­rity Ser­vices. Soft­ware Engi­neer­ing Insti­tute, Carnegie Mel­lon Uni­ver­sity, Pitts­burgh.

  Alner, M. (2001). The Effects of Out­sourc­ing on Infor­ma­tion Secu­rity. Infor­ma­tion Sys­tems Secu­rity 10(2), 1–9.

  Brancheau, J., B. Janz and J. Wetherbe (1996). Key Issues in Infor­ma­tion Sys­tems Man­age­ment: 1994-95 SIM Del­phi Results. MIS Quar­terly 20(2), 225–242.

  Brancheau, J. and J. Wetherbe (1987). Key Issues in Infor­ma­tion Sys­tems Man­age­ment. MIS Quar­terly 11(1), 23–45.

  Dib­bern, J., T. Goles, R. Hirschheim and B. Jay­ati­laka (2004). Infor­ma­tion Sys­tems Out­sourc­ing: A Sur­vey and Analy­sis of the Lit­er­a­ture. The DATA BASE for Advances in Infor­ma­tion Sys­tems 35(4), 6–102.

  Endorf, C. (2004). Out­sourc­ing Secu­rity: The Need, the Risks, the Providers, and the Process. Infor­ma­tion Sys­tems Secu­rity 12(6), 17–23.

  Fenn, C., R. Shooter and K. Allan. (2002). IT Secu­rity Out­sourc­ing: how safe is your IT secu­rity? Com­puter Law & Secu­rity Report 18(2), 109–111.

  Gon­za­lez, R., J. Gasco and J. Llopis (2006). Infor­ma­tion sys­tems out­sourc­ing: A lit­er­a­ture analy­sis. Infor­ma­tion & Man­age­ment 43(7), 821–834.

  Karyda, M., E. Mitrou and G. Quirch­mayr (2006). A frame­work for out­sourc­ing IS/IT secu­rity ser­vices. Infor­ma­tion Man­age­ment and Com­puter Secu­rity 14(5), 402–415.

  Kern, T. and L. Will­cocks (2001). The Rela­tion­ship Advan­tage: Infor­ma­tion Tech­nolo­gies, Sourc­ing, and Man­age­ment. Oxford: Oxford Uni­ver­sity Press.

  Lac­ity, M. C., S. A. Khan and L. P. Will­cocks (2009). A review of the IT out­sourc­ing lit­er­a­ture: Insights for prac­tice. Jour­nal of Strate­gic Infor­ma­tion Sys­tems 18(3), 130–146.

  Lin­stone, H. and M. Tur­off (1975). The Del­phi Method: Tech­niques and Appli­ca­tions. Lon­don: Addi­son-Wes­ley.

  Okoli, C. and S. Pawlowski (2004). The Del­phi method as a research tool: an exam­ple, design con­sid­er­a­tions and appli­ca­tions. Infor­ma­tion & Man­age­ment 42(1), 15–29.

  Power, R. and D. Forte (2005). Out­sourced or out­smarted? Part II: secu­rity out­sourc­ing issues. Com­puter Fraud & Secu­rity 12, 17–20.

  Rowe, B., (2007). Will Out­sourc­ing IT Secu­rity Lead to a Higher Social Level of Secu­rity? WEIS 2007—Work­shop on the Eco­nom­ics of Infor­ma­tion Secu­rity. Pitts­burgh.

  Schmidt, R. (1997). Man­ag­ing Del­phi sur­veys using non­para­met­ric sta­tis­ti­cal tech­niques. Deci­sion Sci­ences 28(3), 763–774.

  Schneier, B. (2002). The case for out­sourc­ing secu­rity. Com­puter 35(4), 20–26.

  Tso­hou, A., M. Theo­hari­dou, S. Koko­lakis and D. Gritza­lis (2007). Address­ing cul­tural dis­sim­i­lar­ity in the Infor­ma­tion Secu­rity Man­age­ment Out­sourc­ing rela­tion­ship. Trust, Pri­vacy and Secu­rity in Dig­i­tal Busi­ness, LNCS 4657, 24–33. Springer.